chore: add CodeRabbit AI review config

[ndreno]

What

Adds a .coderabbit.yaml at the repo root to enable CodeRabbit automated AI review on pull requests.

Config highlights

• Profile chill — less noisy, skips nitpicks already enforced by rustfmt/clippy/eslint.
• Auto-review on PRs targeting main (drafts excluded).
• Path filters exclude target/, lockfiles, ui/dist, *.bca, schemas/, book/, snapshots, testdata/.
• Path instructions encode the repo conventions from CLAUDE.md:
  • Rust: no unwrap()/panic!() in prod, thiserror vs anyhow, parking_lot, is_some_and, HeaderValue::from_static, no unjustified #[allow(dead_code)].
  • barbacane-wasm: sandbox-escape / host↔guest trust boundary focus.
  • barbacane-control: SQLi, authz, input validation.
  • UI TS: any, unhandled promises, XSS.
  • Workflows: unpinned actions, ${{ }} injection, broad GITHUB_TOKEN perms.
• Tools enabled: clippy, eslint, hadolint, actionlint, yamllint, markdownlint, shellcheck, gitleaks.

Note

Requires the CodeRabbit GitHub App to be installed on the barbacane-dev org (free for public repos). Once installed, this PR itself becomes the first review target.

Summary by CodeRabbit

• Chores
  • Added automated CodeRabbit review configuration with reviews enabled for the main development branch.
  • Improved review consistency through language, tone, and path-specific guidance.
  • Enabled checks for code quality, security, workflows, shell scripts, and documentation.
  • Reduced review noise by excluding generated artifacts and dependency lockfiles.
  • Enabled automated summaries, walkthroughs, diagrams, chat responses, and knowledge-base learning.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a complete .coderabbit.yaml configuration covering review defaults, automatic review scope, path-specific guidance, analysis tools, chat replies, and knowledge-base learning.

Changes

CodeRabbit configuration

Layer / File(s)	Summary
Review defaults and scope .coderabbit.yaml	Sets review language, tone, profile, output controls, automatic review behavior, base branch, and path exclusions.
Path-specific review guidance .coderabbit.yaml	Adds targeted guidance for Rust, WASM, control-plane security, UI TypeScript, and GitHub Actions workflows.
Tooling and conversation settings .coderabbit.yaml	Enables configured linting and security tools, automatic chat replies, and automatic knowledge-base learning.

Estimated code review effort: 3 (Moderate) | ~15–30 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding a CodeRabbit review configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/coderabbit-config

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.coderabbit.yaml (1)

62-66: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Add dedicated GitHub Actions security analysis.

The workflow guidance covers action pinning, expression injection, and token permissions, but actionlint is primarily a static checker. Enable CodeRabbit’s supported zizmor analyzer, or document the equivalent security check elsewhere. (docs.coderabbit.ai)

Suggested configuration

     actionlint:
       enabled: true
+    zizmor:
+      enabled: true

Also applies to: 75-76

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.coderabbit.yaml around lines 62 - 66, Update the GitHub Actions
configuration in .coderabbit.yaml to enable CodeRabbit’s supported zizmor
security analyzer, or add an equivalent dedicated workflow-security check
alongside the existing actionlint-related guidance. Keep the current checks for
unpinned actions, expression injection, and GITHUB_TOKEN permissions intact.

Source: MCP tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.coderabbit.yaml:
- Around line 62-66: Update the GitHub Actions configuration in .coderabbit.yaml
to enable CodeRabbit’s supported zizmor security analyzer, or add an equivalent
dedicated workflow-security check alongside the existing actionlint-related
guidance. Keep the current checks for unpinned actions, expression injection,
and GITHUB_TOKEN permissions intact.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 267c2a31-28fd-45ed-96fd-def379a9876c

📥 Commits

Reviewing files that changed from the base of the PR and between a99a1d7 and 28c2f20.

📒 Files selected for processing (1)

• .coderabbit.yaml