.coderabbit.yaml

# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
# Per-repo CodeRabbit config for opendatahub-io/odh-dashboard
# Inherits org-wide baseline from opendatahub-io/security-config.
# Only overrides listed below differ from the org baseline.

inheritance: true

reviews:
  # "chill" (default) misses bugs; noise is solved via targeted suppression.
  profile: "assertive"
  # Decorative features that add clutter to review summaries.
  in_progress_fortune: false
  estimate_code_review_effort: false
  # TODO:  Temporary — shows which KB files were ingested. Remove after confirming.
  review_details: true
  auto_review:
    # Review every push, not just the first; avoids stale reviews on force-pushes.
    auto_pause_after_reviewed_commits: 0
  # ── Path filters (additive to baseline) ─────────────────────────
  path_filters:
    # Baseline already excludes: vendor, node_modules, bin, __pycache__,
    #   *.sum, *.pb.go, *.generated.go, synced security configs
    - "!package-lock.json"
    - "!.tekton/**"
    - "!**/@mf-types/**"
    - "!**/dist/**"
    - "!**/coverage/**"
    - "!**/upstream/**"

  # ── Monorepo path instructions ──────────────────────────────────
  # These supplement the baseline instructions (Go, Python, TS, etc.)
  # with odh-dashboard-specific architectural guidance.
  path_instructions:
    # ── Global reviewer identity (extends org baseline) ─────────
    # CodeRabbit has no top-level reviews.instructions field; a catch-all
    # path instruction injects reviewer priorities on every file.
    - path: "**"
      instructions: |
        REVIEW PRIORITIES:
        1. Security vulnerabilities — provide severity, exploit scenario,
           and remediation code. Cite CWE/CVE IDs.
        2. Bugs that could reach production — logic errors, null/undefined,
           race conditions, incorrect async handling, resource leaks.
        3. API contract correctness — shape mismatches, missing error handling,
           silent failures, wrong HTTP status codes.
        4. Performance only when measurable — O(n^2) in hot paths, unbounded
           memory growth, missing pagination.

        Do not comment on:
        - Naming preferences (unless genuinely misleading)
        - Import ordering or formatting (handled by ESLint and Prettier)
        - Alternative patterns that are equally valid
        - Missing docs unless a public API is genuinely unclear
        - Code deduplication / DRY suggestions where both copies are short
          and self-contained (< 20 lines)
        - Adding explicit type annotations when TypeScript can infer the type
        - Suggesting exhaustive switch/if-else when a default branch exists

    # ── Main frontend app ─────────────────────────────────────────
    - path: "frontend/src/**/*.{ts,tsx}"
      instructions: |
        ODH DASHBOARD FRONTEND (main app):
        1. PatternFly v6: use PF6 imports from @patternfly/react-core, not custom wrappers.
           Avoid custom CSS — if you need to "nudge" PF layout, check frontend/src/concepts/dashboard first.
        2. Functional components only (no class components). Use hooks for state management.
        3. API calls: use the shared API utilities, never raw fetch(); handle loading/error states.
        4. No hardcoded cluster URLs or API endpoints — use config from backend.
        5. Route guards: protected routes must check user permissions before rendering.
        6. Performance: avoid unnecessary useCallback/useMemo/useRef — React is performant by default.
           Only use useCallback when the function is passed as a prop, used as a useEffect dependency,
           or returned from a custom hook (see docs/best-practices.md).
        7. Custom components go in frontend/src/components. PF-first: verify with the team before
           creating new custom components.

    - path: "frontend/src/**/*.{test,spec}.{ts,tsx}"
      instructions: |
        FRONTEND UNIT TESTS (Jest):
        1. Co-locate tests with source: MyComponent.test.tsx next to MyComponent.tsx
           (or in __tests__/ subdirectory).
        2. Follow conventions in .claude/rules/unit-tests.md.
        3. (Suppression) Clearly synthetic credentials in test code are intentional.
           Suppress only values that are obviously fake: placeholder strings
           (e.g. "my-secret", "12345"), K8s Secret field-name references
           (e.g. accessKey: 'AWS_ACCESS_KEY_ID'), base64-encoded empty or
           placeholder data, or values from mock factory functions.
           Still flag any value matching a real credential format (40-char hex,
           AWS AKIA keys, GitHub ghp_/gho_ PATs, JWTs with valid structure, etc.)
           even in test code.
        4. (Suppression) Do not flag conditional test logic (if/else in test
           bodies) unless it causes a test to silently pass with zero assertions.
           Conditional setup for different environments is intentional.

    # ── Main backend (Node.js/TypeScript) ─────────────────────────
    - path: "backend/src/**/*.{ts,js}"
      instructions: |
        ODH DASHBOARD BACKEND (Node.js BFF):
        1. All external API calls must use the service account token, never user-provided tokens.
        2. Validate and sanitize route parameters before K8s API calls (prevent injection).
        3. Proxy endpoints must not expose internal cluster addresses to the client.
        4. Error responses must not leak cluster internals (pod names, IPs, stack traces).
        5. Verify RBAC: backend routes should check user permissions via SubjectAccessReview.

    # ── Feature plugin frontends (packages with frontend/ subdir) ─
    - path: "packages/*/frontend/src/**/*.{ts,tsx}"
      instructions: |
        FEATURE PLUGIN FRONTEND (Module Federation):
        These packages (automl, autorag, eval-hub, gen-ai, maas, mlflow) use Module Federation
        to load as remotes into the host dashboard app.
        1. Plugins must use plugin-core APIs for navigation, not direct router manipulation.
        2. Shared dependencies (React, PatternFly, Redux) must come from the host app — do not
           bundle duplicates.
        3. No global CSS — use PatternFly utility classes or CSS modules only.
        4. Lazy-load heavy components; plugins load on demand via Module Federation.
        5. Follow PatternFly v6 patterns consistent with the main frontend app.

    # ── Feature plugin source (packages with direct src/) ─────────
    - path: "packages/{model-registry,model-serving,model-training,kserve,llmd-serving,feature-store,observability,plugin-core,app-config}/src/**/*.{ts,tsx}"
      instructions: |
        FEATURE PACKAGE SOURCE:
        These packages contribute to the dashboard via extensions or direct imports.
        1. Follow the same PatternFly v6 and TypeScript strict-mode conventions as the main frontend.
        2. Exports must be stable — other packages depend on them.
        3. Co-locate tests with source files.
        4. Check for AGENTS.md in the package root for package-specific guidance.

    - path: "packages/mlflow-embedded/{experiments,prompts,shared}/**/*.{ts,tsx}"
      instructions: |
        MLFLOW EMBEDDED PACKAGE:
        This package contributes to the dashboard via extensions or direct imports.
        1. Follow the same PatternFly v6 and TypeScript strict-mode conventions as the main frontend.
        2. Exports must be stable — other packages depend on them.
        3. Co-locate tests with source files.

    - path: "packages/model-serving/modelRegistry/**/*.{ts,tsx}"
      instructions: |
        MODEL SERVING — MODEL REGISTRY INTEGRATION:
        1. Follow the same PatternFly v6 and TypeScript strict-mode conventions as the main frontend.
        2. Ensure model registry API calls use shared utilities and handle errors consistently.
        3. Co-locate tests with source files.

    # ── Go BFF services ───────────────────────────────────────────
    - path: "packages/*/bff/**/*.go"
      instructions: |
        GO BFF SERVICE (Backend-for-Frontend):
        Packages with BFFs: automl, autorag, eval-hub, gen-ai, maas, mlflow.
        1. Validate all incoming request bodies and query parameters at handler level.
        2. No credentials in BFF code — use mounted secrets or environment variables.
        3. Use the shared K8s client config; do not create ad-hoc kubeconfig readers.
        4. HTTP clients to external services must set timeouts and use TLS verification.
        5. No panic in handlers — use explicit error returns with context.
        6. OpenAPI spec in api/ or docs/ must match actual handler signatures.
        7. Follow .golangci.yaml rules in the package root.
        8. Repository pattern: data access through repository interfaces, not direct K8s calls
           in handlers. Mock interfaces for unit testing (see mocks/ directory).

    # ── OpenAPI / API specs ───────────────────────────────────────
    - path: "packages/*/api/**/*.{yaml,yml,json}"
      instructions: |
        OPENAPI SPECIFICATIONS:
        1. API specs must stay in sync with the corresponding BFF handler implementations.
        2. Breaking changes to API specs require corresponding contract test updates.

    # ── Cypress E2E tests (shared framework) ──────────────────────
    - path: "packages/cypress/**/*.{ts,js}"
      instructions: |
        CYPRESS E2E TESTS (shared test framework):
        1. Use data-testid selectors, not CSS classes (resilient to style changes).
        2. Avoid cy.wait(ms) with fixed delays — use cy.intercept() for API readiness.
        3. Follow conventions in .claude/rules/cypress-e2e.md and .claude/rules/cypress-mock.md.
        4. (Suppression) Fixtures contain K8s resource manifests (including
           Secret-type objects with structural field names like secretKey,
           accessKey) and test configuration — not actual credential values.
           Suppress false positives on these structural property names and
           placeholder data values. Still flag any value matching a real
           credential format (AKIA keys, PATs, JWTs, 40-char hex strings, etc.)
           — real credentials belong only in test-variables.yml (gitignored).
        5. (Suppression) Do not flag cy.exec() shell commands as injection
           risks (CWE-78) when the command string is composed from controlled
           sources: Cypress.env() CI variables, hardcoded fixture values, K8s
           API response fields (resource names, namespaces), or literal strings.
           DO still flag cy.exec() calls that incorporate user-facing input
           (form field values, URL parameters from the app under test, or
           unvalidated external API responses).
        6. (Suppression) Do not suggest restructuring test isolation patterns,
           extracting shared beforeEach blocks, or changing import boundaries
           across test files. Test architecture is intentional.

    # ── Package-level Cypress tests ───────────────────────────────
    - path: "packages/*/frontend/src/__tests__/cypress/**/*.{ts,js}"
      instructions: |
        PACKAGE CYPRESS TESTS:
        Same conventions as the shared Cypress framework (packages/cypress).
        Use data-testid selectors, cy.intercept() instead of cy.wait(), and ensure idempotency.
        Same suppressions apply: do not flag structural K8s Secret field
        names or placeholder values (but still flag real credential formats),
        do not flag cy.exec() as injection when inputs come from controlled
        sources (CI env, fixtures, K8s API), do not suggest restructuring
        test isolation or import boundaries.

    # ── Contract tests ────────────────────────────────────────────
    - path: "packages/*/contract-tests/**/*.{ts,js}"
      instructions: |
        CONTRACT TESTS (BFF API validation):
        Packages with contract tests: automl, autorag, eval-hub, gen-ai, mlflow, model-registry.
        1. Contracts must match the OpenAPI spec in the corresponding api/ directory.
        2. Contract tests run against the Mock BFF provider patterns defined in the shared framework (.claude/rules/contract-tests.md); do not mock the HTTP layer itself.
        3. Follow conventions in .claude/rules/contract-tests.md.

    - path: "packages/contract-tests/**/*.{ts,js}"
      instructions: |
        SHARED CONTRACT TEST UTILITIES:
        This package provides shared test infrastructure for per-package contract tests.
        Changes here affect all packages with contract tests — ensure backward compatibility.
        Shared helpers must be generic; package-specific logic belongs in per-package tests.

    # ── Shared config packages ────────────────────────────────────
    - path: "packages/{eslint-config,eslint-plugin,jest-config,tsconfig}/**"
      instructions: |
        SHARED CONFIG PACKAGES:
        Changes here affect ALL packages — ensure backward compatibility.
        ESLint rule changes must not introduce new warnings in existing packages.

    # ── Kubernetes manifests ──────────────────────────────────────
    - path: "manifests/**/*.yaml"
      instructions: |
        K8S DEPLOYMENT MANIFESTS (Kustomize-based):
        1. No :latest image tags — use pinned versions or digests.
        2. SecurityContext: runAsNonRoot, readOnlyRootFilesystem, drop ALL capabilities.
        3. No hostPath volumes or privileged containers.
        4. Resource requests and limits must be set on all containers.
        5. RBAC changes must follow least-privilege principle.

    - path: "manifests/base/sa-rbac/**"
      instructions: |
        Any changes in this folder are likely incorrect.
        Confirm the user has sought out a Staff+ engineer for confirmation on changes.

    - path: "manifests/base/rbac/all-users/**"
      instructions: |
        Verify all new "kind: RoleBinding" resources are to the subject `system:authenticated`.
        Changes do not belong in here if they are not to that role binding.

    - path: "manifests/base/rbac/project-users/**"
      instructions: |
        This folder shouldn't get changes, if changes are here, ask for an explanation.
        Point the user at the README.md in this folder for clarification

    # ── GitHub Actions / CI config ────────────────────────────────
    - path: ".github/workflows/**/*.{yml,yaml}"
      instructions: |
        GITHUB ACTIONS WORKFLOWS – review scope is security only:
        - Flag: secret exposure, unpinned actions (require SHA pins), overly
          broad permissions.
        - Ignore: CI pattern alternatives, job naming, permission restructuring,
          and fail-open (|| true) unless it bypasses a security check.

    # ── Dockerfiles ───────────────────────────────────────────────
    - path: "**/Dockerfile*"
      instructions: |
        DOCKERFILES:
        1. Multi-stage builds: separate build and runtime stages.
        2. Copy only necessary artifacts to runtime stage (no source code, node_modules, .git).
        3. Use the same base image version as the main Dockerfile where possible.
        4. No npm install in runtime stage — copy from build stage.
        5. Dockerfile.workspace files are for dev workspace images — follow the same base image
           conventions.

    # ── Turbo / monorepo build config ─────────────────────────────
    - path: "turbo.json{,c}"
      instructions: |
        TURBOREPO CONFIG:
        1. Task dependencies must reflect the actual package dependency graph.
        2. Cache inputs/outputs must be accurate — incorrect caching causes stale builds.
        3. Changes here affect all package build ordering and CI performance.

    # ── Webpack config ────────────────────────────────────────────
    - path: "**/webpack.{common,dev,prod}.{ts,js}"
      instructions: |
        WEBPACK CONFIG:
        (Suppression) Do not suggest alternative bundler configurations
        or plugin replacements. Only flag security issues and broken build logic.

    # ── Module Federation config ──────────────────────────────────
    - path: "**/moduleFederation.{ts,js}"
      instructions: |
        MODULE FEDERATION CONFIG:
        1. Shared dependencies in ModuleFederationPlugin must match host app versions.
        2. Remote entry configuration must be consistent with manifests/sidecar/.
        3. Changes to shared dependency list require coordination across all plugins.


# AGENTS.md, CLAUDE.md, and .claude/rules/* are auto-detected by default.
# filePatterns supplements the built-in defaults; does not replace them.
knowledge_base:
  code_guidelines:
    filePatterns:
      - "**/.claude/rules/*"