Skip to content

Remove dead .coderabbit.yaml; port its useful rules into AGENTS.md #95

New issue
New issue
Closed
#96
Closed
Remove dead .coderabbit.yaml; port its useful rules into AGENTS.md#95
#96
Labels
documentationready-to-codeTriggers code agent dispatch

Description

@fege
fege
opened on Oct 30, 2026

Summary

The repo moved into the fullsend org, which doesn't have the CodeRabbit app installed. .coderabbit.yaml is therefore dead config, but AGENTS.md still points to it under "Where things are", and two of its rule sets are useful as conventions for the code agent that implements issues.

Proposed change

  1. AGENTS.md (Code conventions) — add script security rules, from the .coderabbit.yaml threat model:

    • no writes that follow a planted symlink
    • no destinations escaping the intended root (absolute paths, .., unsanitized CLI/frontmatter values used as filesystem destinations)
    • no secrets in argv, URLs, logs, exception messages, or JSON output

    This bug class has already produced Harden fetch_issue.py output path handling #62 (fetch_issue.py output path) and bootstrap.sh can place the .odh-test-gen symlink inside the generated run directory #79 (bootstrap.sh symlink inside the run directory).

  2. AGENTS.md (Test conventions) — add the test anti-patterns from .coderabbit.yaml: no effective assertion, mocking the unit under test, asserting only on the mock, tautological expectations, swallowed failures, weak JSON checks.

  3. Delete .coderabbit.yaml and its entry in the "Where things are" list in AGENTS.md.

Activity

  1. fullsend-ai-triage commented on Oct 30, 2026

    @fullsend-ai-triage
    fullsend-ai-triageBot
    on Oct 30, 2026 – with fullsend-ai-triage

    🤖 Finished Triage · ✅ Success · Started 10:10 AM UTC · Completed 10:12 AM UTC

    Commit: aa84460 · View workflow run →

    Runtime: claude · Model: sonnet → claude-sonnet-5-5 · Effort: high · Cost: $0.22

  2. fullsend-ai-triage
    added
    documentation
    ready-to-codeTriggers code agent dispatch
    on Oct 30, 2026

  3. fullsend-ai-triage commented on Oct 30, 2026

    @fullsend-ai-triage
    fullsend-ai-triageBot
    on Oct 30, 2026 – with fullsend-ai-triage

    Triage notes:

    • Additional references to clean up. Besides the AGENTS.md entry, two other files still link to .coderabbit.yaml: CLAUDE.md (last sentence of "Code Review Invariants") and CONTRIBUTING.md (the CodeRabbit paragraph under "Opening a pull request"). Deleting the file without updating them would leave dead links, so the fix should cover them too.
    • Possible merge conflict. Open PR docs: fix marketplace install instructions and stale symlink claims #93 also edits CLAUDE.md and CONTRIBUTING.md. It does not block this work, but keep edits to those files limited to the dead-reference lines.
    • Wording to reconcile. AGENTS.md already says to prefer exact substring assertions. The ported "weak JSON checks" rule says to assert on parsed JSON structure. Phrase the new rule so the two do not read as contradictory.
    • Threat-model context. It is worth carrying over the short note that scripts are a local single-user CLI, so agents do not flag TOCTOU or SSRF-style findings that do not apply here.

    No open PR addresses this issue and there are no blocking dependencies. It touches documentation only, with no workflow file changes.

    Suggested verification:

    - .coderabbit.yaml no longer exists
- grep -ri "coderabbit.yaml" (excluding .git) returns nothing
- AGENTS.md lists 3 script security rules and 6 test anti-patterns
- pre-commit (pymarkdown) passes on the edited markdown

    Next steps:

    • /fs-code — agent creates a PR to implement this issue
    • /fs-code <your instruction> — agent implements with your specific guidance

  4. fullsend-ai-coder commented on Oct 30, 2026

    @fullsend-ai-coder
    fullsend-ai-coderBot
    on Oct 30, 2026 – with fullsend-ai-coder
    Contributor

    🤖 Finished Code · ✅ Success · Started 10:14 AM UTC · Completed 10:19 AM UTC

    Commit: aa84460 · View workflow run →

    Runtime: claude · Model: opus → claude-opus-5-5 · Effort: high · Cost: $0.77

  5. fege
    closed this as completedin #96on Oct 30, 2026
  6. fege
    added 2 commits that reference this issue on Oct 30, 2026

    Merge pull request #96 from fullsend-ai/agent/95-remove-coderabbit-co…

    4759986

    docs(fullsend-ai#95): port CodeRabbit rules into AGENTS.md, drop config

    4a83bfd
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    documentationready-to-codeTriggers code agent dispatch

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions