chore: configure CodeRabbit so it reviews PRs against version branches

[uzayer]

What?

Adds .coderabbit.yaml. Until now CodeRabbit ran on its defaults, with no config file in the repo.

Why?

CodeRabbit's defaults only auto-review PRs whose base is the default branch (main). Atlas PRs target version branches, so contributor PRs were being skipped. #391 shows it:

Review skipped — Auto reviews are disabled on base/target branches other than the default branch. … Configuration used: defaults

#394 was only reviewed because its author commented @CodeRabbit review. Fork PRs were never the issue; the base branch was.

How?

• auto_review.base_branches: [".*"]. Every base branch is reviewed: version branches and one-off bases like 0.3.0-strip alike.
• Docstring-coverage pre-merge check off. Its 80% default failed feat(keybindings): show modifier-held navigation hints #394 at 41%. The house style comments where a reason is needed, not on every function.
• Generated files filtered out: lockfiles, src-tauri/gen, icons, the vendored icon theme, the generate-theme-keys.mjs outputs, and the engine's protocol and hook schemas. CI already checks each one against its generator.
• Path instructions taken from CONTRIBUTING.md, CONTEXT.md and vendor/atlas-engine/ATLAS-CHANGES.md:
  • capability gating, never agent-identity checks
  • storage keys aren't renamed in passing
  • atlas_profile for directory names
  • the createSelectors / cn() / feature-folder conventions
  • mock-backend coverage for new invoke() calls
  • the Apache §4(b) "Modified by Atlas" notice for files changed under vendor/atlas-engine
  • TELEMETRY.md updated with telemetry changes
  • fork-safety checks for workflow changes (pull_request_target, secrets in fork jobs, unpinned actions)
  • don't comment on what lint, typecheck or clippy already enforce
• Tools: oxlint and clippy on (CodeRabbit skips either when a workflow already runs it). Biome and ESLint are off: oxlint won't run while Biome is on, and ESLint would contradict oxlint.
• Code guidelines: CLAUDE.md and AGENTS.md are picked up by default. This adds CONTRIBUTING.md, CONTEXT.md and TELEMETRY.md. ADRs aren't listed because a guideline file only governs its own directory, so ADRs listed there would only cover docs/. The general instruction points reviewers at them instead.
• scripts/ci-affected.mjs: .coderabbit.yaml joins NON_RUST. ci-affected.test.ts requires every tracked file to be classified.

Keys were checked against CodeRabbit's schema and the current docs. Every path_filters / path_instructions glob was matched against git ls-files and hits real files.

CI cost: touching scripts/ci-affected.mjs makes the planner run all 32 Rust jobs for this PR. The change is one string in a list that no Rust job reads.

After merge: depending on which branch CodeRabbit reads the config from, PRs already open may not pick this up until they merge 0.4.1 back in. Setting the base-branch pattern .* in the CodeRabbit dashboard covers them now; where both are set, this file takes precedence.

Fixes #

Checklist

• Targets the current version branch, unless it's a small standalone fix
• New behaviour has a test; a bug fix has a test that fails without it. No new runtime behaviour; the existing ci-affected.test.ts covers the planner entry and fails without it.
• You've run the app and used the change in a window. Not applicable: config only. Locally bun run lint, format:check, typecheck and test all pass (2569 tests).

🤖 Generated with Claude Code

https://claude.ai/code/session_01LLChyBTpyz2EVmMaCstCzd

---

Generated by Claude Code

Summary by CodeRabbit

• Chores
  • Updated repository review and validation settings to provide more consistent checks across project areas and exclude generated content from review.
  • Changes to review settings no longer trigger Rust-specific CI jobs, helping keep routine validation focused on relevant changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: pacifio/atlas/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4699ff33-3df5-4968-a52e-684c95d7972b

---

📥 Commits

Reviewing files that changed from the base of the PR and between a67becd and 4c2c5ef.

---

📒 Files selected for processing (2)

• .coderabbit.yaml
• scripts/ci-affected.mjs

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

---

📝 Walkthrough

Walkthrough

The pull request adds CodeRabbit review settings, path-specific instructions, exclusions, and checks. It also enables chat and knowledge-base features and classifies .coderabbit.yaml as non-Rust for affected CI.

Changes

Repository review configuration

Layer / File(s)	Summary
Review policy and scope .coderabbit.yaml	Configures review behavior, branch coverage, draft handling, docstring checks, and excluded paths.
Path guidance and review checks .coderabbit.yaml	Adds repository and path-specific instructions. Enables selected review checks and disables Biome and ESLint.
Chat, knowledge base, and CI classification .coderabbit.yaml, scripts/ci-affected.mjs	Enables chat auto-replies and knowledge-base scopes. Classifies .coderabbit.yaml as non-Rust for affected CI.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

---

Merge Risk

Merge Risk: ⚪ Minimal · up to 4c2c5

The review configuration and CI classification appear mergeable after normal checks. The GitHub-check timeout setting has not been confirmed.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 4c2c5

The CI exemption is limited to the exact review configuration path and does not suppress checks for accompanying Rust changes. No introduced vulnerability was established. Automated reviews will cover more target branches, but the review service’s effective permissions, tool isolation, and knowledge-sharing scope could not be verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The directly supported exposure change is broader automatic processing of contributor PR content across target branches. The changed code does not demonstrate expanded application, tenant, credential, or deployment authority.

Trust Boundaries and Controls

• observed — The CI exemption cannot use the .coderabbit.yaml name to match unrelated paths, and accompanying Rust or global-input changes still select their required packages. Modifying the planner itself remains a global input that selects everything.
• observed — The review configuration directs attention to fork-triggered secret exposure, pull_request_target, untrusted text in shell steps, and unpinned actions. These are review instructions, not enforced execution or credential boundaries.

Resilience and Maintainability Implications

• observed — The classifier retains its fail-closed unknown-file behavior and uses invocation-local sets for package selection. The added exemption does not introduce a shared-state transition, reservation, migration, or cleanup obligation.

Hardening Proposals

• proposed — Confirm that the review service’s effective automatic knowledge scopes and enabled-tool isolation match the intended handling of fork PRs and any private repositories. This is a validation proposal, not an observed authority expansion or data leak.

---

---

---

Pre-merge checks | 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the primary change: configuring CodeRabbit to review pull requests targeting version branches.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

---

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}