Add the CodeRabbit configuration - #12
Merged
Merged
Conversation
CodeRabbit reviews every pull request on Ares2 but has never commented on one here, on any of the pull requests checked including the two merged today. The app itself is not installed for this repository, which cannot be done from the command line. This puts the configuration in place so that the first review after someone installs it is already tuned, rather than running on defaults. Taken from the Ares2 configuration: the British English enforcement, the assertive profile and the review display options, the auto-review settings, the workflow least-privilege instruction, and the chat and knowledge base sections. Adapted, because the Ares2 file describes a Java framework: the labels now name the layers that exist here (filesystem, network, timeout, policy, prune, images) instead of AspectJ, ArchUnit and jqwik. The path filters and path instructions follow this tree rather than src/main/java, and each one states what actually goes wrong in that directory: an allow-list entry broader than the policy asked for, a rule reported as enforced when it cannot be, word splitting on attacker-influenced paths, a cached network entry carrying a port authorisation it never had, or a prune run recorded as successful when it was skipped. Two custom pre-merge checks are added for properties specific to a sandbox: a change to what is permitted has to be tested in both directions, because a one-sided test passes even for a sandbox that denies everything, and a change affecting confinement has to state the container invocation it was exercised with. Tool selection follows the languages in this repository: shellcheck, cppcheck and clang, ruff, hadolint, yamllint, actionlint and markdownlint, plus the secret and dependency scanners. The Java-only tools of the Ares2 file (pmd, fbinfer with enable_java) are left out. The file validates against the published CodeRabbit schema and passes yamllint under the configuration added in the lint cleanup branch.
MarkusPaulsen
pushed a commit
that referenced
this pull request
Sep 8, 2026
Two corrections to the previous commit, both found by comparing against the Ares2 originals rather than by reading my own version again. Section 4 had lost its fill-in scaffold. Ares2 ends the section with Prerequisites, Steps, Expected result, Negative case and the modes exercised, so an author is asked for the negative case in the body of the pull request, where a reviewer looks for it. My version dropped all of it and then reintroduced the same idea as a checklist tick, which is weaker: a tick claims the case was covered, the scaffold makes the author write down what it was. The scaffold is back, with the four Ares enforcement combinations replaced by the three layers this project composes, each of which can be disabled on its own. Section 4 had also lost both recurring meta-rules, its character limit and the "simple words" paragraph, even though the template states in its own header that they are repeated in every section where they apply. The counts now match Ares2 exactly: seven limits, six "simple words" paragraphs, eleven "always required" statements. The template check itself is adopted, which is what makes the template binding rather than advisory: - .github/scripts/CheckPullRequestTemplate.java differs from the Ares2 version in a single line, the escape phrase for section 5, because this repository has no production Java code to report coverage for and answers that section with "No behaviour covered by the suites changed". - .github/workflows/pullrequest-template.yml is taken over unchanged. It runs the checker in single-file source mode, so there is no build step, exempts Renovate and Dependabot at step level so a required check never hangs pending, and passes the pull request body through the environment rather than interpolating it into the shell, since a fork author controls it verbatim. Running the checker locally against the open pull requests: #11 and #12 pass, #8, #9 and #10 do not yet, and their descriptions are being brought into shape separately.
Three findings from a key-by-key comparison rather than a reread. Two paths fell through the filters. assets/ holds phobos-policy.yaml, an example policy, and the compose file at the repository root orchestrates the prune phase. Both are reviewable content; the images beside the policy stay excluded by their extensions. The "Trusted boundary preservation" check had been dropped without a replacement. Ares2 uses it to keep trusted infrastructure, fixtures and supervised code apart, and that separation exists here just as plainly: the layer scripts, the enforcement helper and the policies on one side, the code a run confines on the other. It is back, worded for this repository. After this, the two configurations differ only where the repositories do: pmd, fbinfer and checkmake are gone because there is no Java and no Makefile here, cppcheck, clang, ruff and hadolint are added for the languages that are, the labels name the layers this project composes instead of AspectJ and ArchUnit, and the path instructions follow this tree instead of src/main/java. Fifty configuration keys are carried over unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CodeRabbit reviews every pull request on Ares2 but has never commented on one here. The app is not installed for this repository, which cannot be done from the command line. This puts the configuration in place so the first review after someone installs it is already tuned rather than running on defaults.
Linked issues
No linked issues.
1. Problem
Nothing is broken, this is a gap. Checked five pull requests here (#2, #3, #8, #9, #10), including the two merged today: zero CodeRabbit comments and zero reviews. On Ares2 the bot comments on every open pull request. The difference is the app installation, not the configuration, which does not exist here either.
2. Improvement from the user's perspective
No Improvement from the user's perspective. This changes how contributions are reviewed, not how Phobos behaves.
3. Improvement from the maintainer's perspective
Once the app is installed, reviews arrive tuned to this repository instead of to defaults: the path instructions state what actually goes wrong per directory, and two custom pre-merge checks enforce properties that are specific to a sandbox and easy to forget.
4. Testing manual
No manual testing possible until the CodeRabbit app is installed for this repository. What was verified instead:
https://storage.googleapis.com/coderabbit_public_assets/schema.v2.jsonusingjsonschema. Every tool key was checked against the schema rather than guessed.yamllint --strictunder the.yamllintadded in Clear the findings that stand in the way of linting in CI #9, which is why the long instruction strings are folded.After installation, a new pull request should receive a CodeRabbit review that uses the labels defined here.
5. Test case coverage regarding this PR
No behaviour covered by the suites changed.
Breaking changes and migration
No breaking changes or migration.
Checklist
README.md, the comments incore/) was updated where the change is user-facing.Review progress