roost.tools
Mirrored from GitHub
github.com/roostorg/osprey
1# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
2#
3# Review rules live in `.github/copilot-instructions.md` and `AGENTS.md`
4# CodeRabbit picks both up automatically. This file only carries settings that
5# differ from CodeRabbit's defaults.
6
7reviews:
8 profile: chill
9 request_changes_workflow: false
10 high_level_summary: true
11 poem: false
12 review_status: true
13 collapse_walkthrough: true
14
15 auto_review:
16 enabled: true
17 drafts: false
18 base_branches:
19 - main
20 ignore_usernames:
21 - 'dependabot[bot]'
22 - 'dependabot-preview[bot]'
23 labels:
24 - '!dependabot'
25
26 path_filters:
27 # Generated protobuf bindings — regenerate via ./gen-protos.sh, never
28 # hand-edit (AGENTS.md > Architecture).
29 - '!osprey_rpc/src/osprey/rpc/**/*_pb2*.py'
30 - '!osprey_rpc/src/osprey/rpc/**/*_pb2*.pyi'
31 - '!osprey_coordinator/src/proto/**'
32 # Build artifacts and caches.
33 - '!**/node_modules/**'
34 - '!**/dist/**'
35 - '!**/build/**'
36 - '!**/target/**'
37 - '!**/__pycache__/**'
38 - '!**/.venv/**'
39 - '!**/*.snap'
40
41 # Cross-cutting rules live in .github/copilot-instructions.md.
42 path_instructions:
43 - path: 'osprey_worker/src/osprey/worker/ui_api/**/*.py'
44 instructions: |
45 Flask HTTP API on port 5004. Verify each view enforces authentication
46 and that any caller-supplied IDs are authorization-checked, not just
47 existence-checked (IDOR). Flag string-built SQL or shell commands —
48 SQLAlchemy bound parameters and `subprocess` arg arrays (no
49 `shell=True`) are required. Validate request bodies and query params
50 (Pydantic preferred). Error responses must not leak Python stack
51 traces or internal exception messages.
52
53 - path: 'osprey_worker/src/osprey/worker/sinks/**/*.py'
54 instructions: |
55 Output sinks emit verdicts/effects to external systems (Kafka, HTTP,
56 etc.). Flag sink writes that don't bound retries or backoff, that log
57 full request/response bodies or raw Kafka payloads (PII risk), or
58 that swallow exceptions without a metric, log, or rethrow.
59
60 - path: 'osprey_worker/src/osprey/worker/adaptor/**/*.py'
61 instructions: |
62 Pluggy plugin manager and hookspecs (`register_udfs`,
63 `register_output_sinks`, `register_labels_service_or_provider`). New
64 or renamed hookspecs change the plugin contract — surface signature
65 changes that would break `example_plugins/` or downstream consumers.
66 Generic-name UDFs collide silently; flag duplicates.
67
68 - path: 'osprey_ui/src/**/*.{ts,tsx}'
69 instructions: |
70 - XSS: flag `dangerouslySetInnerHTML`, `innerHTML`, `document.write`,
71 `javascript:` URLs, and unsanitized `href`/`src` from user input.
72 Prefer `textContent`; sanitize with DOMPurify when raw HTML is
73 unavoidable.
74 - Token storage: auth tokens belong in HttpOnly, Secure, SameSite
75 cookies — flag `localStorage` or `sessionStorage` use for tokens.
76 - Open redirects: redirecting to a user-supplied URL without an
77 allowlist is risky.
78
79 - path: 'osprey_coordinator/src/**/*.rs'
80 instructions: |
81 - `unwrap()` / `expect()` / `panic!` on user-driven or RPC paths
82 turn a bad input into a process crash; prefer `?` or explicit
83 error mapping.
84 - `unsafe` blocks deserve a justifying comment and the tightest
85 possible scope.
86 - Holding a `std::sync::Mutex` guard across `.await` deadlocks the
87 tokio runtime; long-lived `tokio::sync` guards can starve other
88 tasks. Flag them.
89 - Spawned tasks should be cancellation-safe — surface anything that
90 will leak on shutdown.
91
92 - path: 'proto/osprey/rpc/**/*.proto'
93 instructions: |
94 gRPC contract consumed by both Python workers and the Rust
95 coordinator. Removing or renaming fields, changing field numbers, or
96 changing tag types is a breaking change — flag it and ask for a
97 migration plan. Bindings must be regenerated with `./gen-protos.sh`
98 in the same PR.
99
100 - path: 'example_plugins/**/*.py'
101 instructions: |
102 Reference plugins. Per AGENTS.md > Architecture no production code
103 belongs here — flag if production-only logic is being added.
104
105 - path: 'example_rules/**'
106 instructions: |
107 Sample SML rules and YAML config. Reference, not production — flag
108 if production rule logic is being added here instead of in the
109 consumer's own rules directory.
110
111 - path: '**/{pyproject.toml,uv.lock,Cargo.toml,Cargo.lock,package.json,package-lock.json}'
112 instructions: |
113 Dependency additions, removals, or upgrades (including transitive
114 bumps) require human approval for license (Apache 2.0, per
115 `LICENSE.md`) and CVE review per AGENTS.md > "Human-approval-required
116 actions". Surface every change so reviewers don't miss it. New
117 Python deps must also be exercised by `fawltydeps` or added to
118 `[tool.fawltydeps].ignore_unused` with a comment.
119
120 - path: '{docker-compose.yaml,start.sh,entrypoint.sh,**/Dockerfile,.github/workflows/publish-coordinator-image.yml,.github/workflows/release-osprey-rpc.yml,.github/workflows/mdbook.yml}'
121 instructions: |
122 AGENTS.md > "Human-approval-required actions" lists these as
123 restricted: release/deploy workflows, production Dockerfiles,
124 signing/tagging, and infra entrypoints. Flag any change here as
125 needing explicit human approval. Default Docker bindings are
126 `127.0.0.1` — flag any bind-address change.
127
128 # These overlap with checks already enforced in CI, or add style noise.
129 tools:
130 ruff:
131 enabled: false
132 prettier:
133 enabled: false
134 markdownlint:
135 enabled: false
136 languagetool:
137 enabled: false