coderabbit

# .coderabbit.yaml — Project-level configuration
language: en-US

tone_instructions: >
  Be direct. Show the exact code fix, not just the problem.
  Prioritize: security > bugs > performance > style.
  Don't nitpick formatting — the linter handles that.

early_access: true                         # Enable experimental features

reviews:
  request_changes_workflow: true           # PR status: changes requested
  high_level_summary: true                 # Summary comment at top
  review_status: true                      # Show review progress
  auto_review:
    enabled: true
    drafts: false                          # Skip draft PRs
    base_branches:
      - main
      - develop

  # Path-specific instructions — different rules for different code
  path_instructions:
    - path: "src/server/**/*.ts"
      instructions: |
        Backend review checklist:
        - Input validation with Zod on all endpoints
        - SQL injection prevention (parameterized queries only)
        - Authentication check on protected routes
        - Rate limiting on public endpoints
        - Error responses don't leak internal details
        - Database transactions for multi-step operations

    - path: "src/app/**/*.tsx"
      instructions: |
        Frontend review checklist:
        - Server components preferred (no unnecessary "use client")
        - Loading states and error boundaries
        - Accessibility: labels, alt text, ARIA attributes
        - No inline styles (use Tailwind classes)
        - Memoization only when profiler shows need (no premature useMemo)

    - path: "**/*.test.ts"
      instructions: |
        Test review checklist:
        - Tests describe user behavior, not implementation
        - No snapshot tests for component logic
        - Edge cases covered: empty state, error state, boundary values
        - Mocks are minimal and well-documented

    - path: "drizzle/migrations/**"
      instructions: |
        Migration safety:
        - Reversible migrations (down migration included)
        - No DROP COLUMN without data backup plan
        - Indexes on foreign keys
        - Default values for new NOT NULL columns

  path_filters:
    - "!**/*.lock"                         # Skip lock files
    - "!**/generated/**"                   # Skip generated code
    - "!**/*.min.js"                       # Skip minified files

chat:
  auto_reply: true                         # Reply to developer questions

## Talking to CodeRabbit in PR comments

# Ask for explanations
@coderabbit explain this function

# Ask for alternative implementations
@coderabbit suggest a more efficient approach

# Dismiss a review comment (with reason)
@coderabbit resolve — this is intentional for backwards compatibility

# Re-review after changes
@coderabbit review

# Generate summary
@coderabbit summary

# Ask about the full PR
@coderabbit what are the main risks in this PR?

## Review categories (auto-detected)

1. **Security** — SQL injection, XSS, hardcoded secrets, auth bypass
2. **Bugs** — Null pointer, race conditions, off-by-one, type errors
3. **Performance** — N+1 queries, unnecessary re-renders, memory leaks
4. **Error handling** — Uncaught exceptions, missing try/catch, silent failures
5. **Best practices** — Anti-patterns, deprecated APIs, code smells
6. **Accessibility** — Missing labels, keyboard navigation, screen reader support
7. **Testing** — Missing tests for new code, test quality issues
8. **Documentation** — Missing JSDoc, outdated comments, API docs

## Setup (2 minutes)

1. Go to https://coderabbit.ai
2. Install the GitHub App on your organization
3. Add .coderabbit.yaml to your repo
4. CodeRabbit reviews every new PR automatically

## Pricing
- Open source: Free
- Pro: $12/seat/month
- Enterprise: Custom