.coderabbit.yaml

# Enables IDE autocompletion for this config file
# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

# Language for CodeRabbit's review comments
language: en

# Enable experimental features (currently not using any specific early_access features)
early_access: true

# Multi-repo analysis: link ThruBox-Server for API contract context
knowledge_base:
  linked_repositories:
    - repository: "AOSSIE-Org/ThruBox-Server"
      instructions: "Contains the Go relay server REST API that this SDK communicates with"

chat:
  # CodeRabbit will automatically respond to @coderabbitai mentions in PR comments
  auto_reply: true

issue_enrichment:
  labeling:
    auto_apply_labels: true
    labeling_instructions:
      - label: bug
        instructions: Issues reporting bugs, errors, crashes, incorrect behavior, or unexpected results. This includes runtime errors, logic errors, broken functionality, regressions, and any deviation from expected or documented behavior.
      - label: enhancement
        instructions: Feature requests, improvements to existing functionality, performance optimizations, refactoring suggestions, UI/UX enhancements, and any suggestions to make the project better or add new capabilities.
      - label: documentation
        instructions: Documentation updates, additions, corrections, or clarifications needed. This includes missing docs, outdated information, unclear instructions, API documentation, code examples, README improvements, and any requests for better explanations or guides.
  planning:
    enabled: true
    auto_planning:
      enabled: true
      labels:
        - "plan-me" # Auto-plan issues with this label
        - "feature" # Also auto-plan these
        - "!no-plan" # Never auto-plan issues with this label

reviews:
  profile: assertive

  auto_review:
    enabled: true
    ignore_title_keywords:
      - "WIP"
    drafts: false
    base_branches:
      - main
      - develop

  high_level_summary: true
  sequence_diagrams: true
  poem: true
  review_status: true
  collapse_walkthrough: false
  changed_files_summary: true
  request_changes_workflow: true

  pre_merge_checks:
    description:
      mode: warning
    docstrings:
      mode: off

  # Exclude these paths from reviews (build artifacts and dependencies)
  path_filters:
    - "!**/node_modules/**" # npm dependencies
    - "!**/dist/**" # Build output
    - "!**/coverage/**" # Test coverage reports

  # Use the following tools when reviewing
  tools:
    shellcheck:
      enabled: true
    markdownlint:
      enabled: true
    github-checks:
      enabled: true
      timeout_ms: 90000
    languagetool:
      enabled: true
      enabled_only: false
      level: default
    biome:
      enabled: true
    yamllint:
      enabled: true
    gitleaks:
      enabled: true
    eslint:
      enabled: true

  # Apply the following labels to PRs
  labeling_instructions:
    - label: Typescript Lang
      instructions: Apply when the PR/MR contains changes to typescript source-code
    - label: Bash Lang
      instructions: >-
        Apply when the PR/MR contains changes to shell-scripts or BASH code
        snippets
    - label: Documentation
      instructions: >-
        Apply whenever project documentation (namely markdown source-code) is
        updated by the PR/MR
    - label: Linter
      instructions: >-
        Apply when the purpose of the PR/MR is related to fixing the feedback
        from a linter

  # Review instructions that apply to all files
  instructions: >-
    - Verify that documentation and comments are free of spelling mistakes
    - Ensure that test code is automated, comprehensive, and follows testing best practices
    - Verify that all critical functionality is covered by tests
    - Confirm that the code meets the project's requirements and objectives
    - Point out redundant obvious comments that do not add clarity to the code
    - Ensure that comments are concise and suggest more concise comment statements if possible
    - Look for code duplication
    - Suggest code completions when:
        - seeing a TODO comment
        - seeing a FIXME comment

  # Custom review instructions for specific file patterns
  path_instructions:
    # TypeScript source files
    - path: "**/*.ts"
      instructions: |
        TypeScript:
        - Avoid 'any', use explicit types
        - Prefer 'import type' for type imports
        - Ensure proper error handling (typed errors, no swallowed exceptions)
        - Verify that public API methods have JSDoc comments
        - Check that fetch calls handle network errors and timeouts correctly
        - Ensure retry logic uses exponential backoff correctly
        - This is a zero-dependency SDK — do NOT suggest adding runtime dependencies

        Security:
        - No exposed API keys or sensitive data in source
        - Validate that user input is not directly interpolated into URLs
        - Check for common security vulnerabilities (XSS, injection)

    # TypeScript test files
    - path: "**/*.test.ts"
      instructions: |
        Review test files for:
        - Comprehensive coverage of success paths, error paths, and edge cases
        - Proper mocking of fetch for network tests
        - Async behavior is properly tested
        - Test descriptions are clear and descriptive
        - Tests are not tautological

    # Dependency manifest and lock files
    - path: "**/{package.json,package-lock.json}"
      instructions: |
        This file may be modified by a dependency bot (e.g., Dependabot, Renovate).
        Perform a structured dependency upgrade analysis:

        **1. Version Change Assessment**
        - Identify all version bumps (major, minor, patch) and flag major/minor upgrades explicitly.

        **2. Breaking Change Detection**
        - Breaking changes: removed or renamed APIs, changed function signatures.
        - Security fixes: highlight CVE patches.

        **3. Zero-Dependency Rule**
        - This SDK must have ZERO runtime dependencies. Only devDependencies are allowed.
        - Flag any additions to "dependencies" as a critical issue.

        Conclude with a **risk level**: Low / Medium / High, with justification.