chore: Added CodeRabbit config and AGENTS.md - BED-7115 #2238
Conversation
📝 WalkthroughWalkthroughAdds a comprehensive CodeRabbit configuration file ( Changes
Sequence Diagram(s)(omitted — changes are configuration and documentation only) Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In @.coderabbit.yaml:
- Around line 156-168: The ast-grep configuration uses the wrong key name:
change the plural key "utils_dirs" to the schema-approved singular "util_dirs"
so the setting is recognized; update the block under "ast-grep" replacing
"utils_dirs: []" with "util_dirs: []" (keep the value/type unchanged) to match
the schema.
In @AGENTS.md:
- Around line 5-11: Change the phrase "user or agent written code" to "user or
agent-written code" (add the hyphen) and correct the misspelling "commiting" to
"committing" wherever it appears (the section listing Golang code standards,
specifically the line with "commiting").
🧹 Nitpick comments (1)
.coderabbit.yaml (1)
154-168: Consider removing version numbers from tool comments.The version numbers in comments (e.g.,
v0.31.1for ast-grep) are already outdated compared to what CodeRabbit currently uses. These comments may cause confusion over time as they become stale. Consider either removing them or relying solely on the official CodeRabbit documentation for version info.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.coderabbit.yamlAGENTS.md
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-06-06T23:12:14.181Z
Learnt from: elikmiller
Repo: SpecterOps/BloodHound PR: 1563
File: packages/go/graphschema/azure/azure.go:24-24
Timestamp: 2025-06-06T23:12:14.181Z
Learning: In BloodHound, files in packages/go/graphschema/*/`*.go` are generated from CUE schemas. When `just prepare-for-codereview` is run, it triggers code generation that may automatically add import aliases or other formatting changes. These changes are legitimate outputs of the generation process, not manual edits that would be overwritten.
Applied to files:
AGENTS.md.coderabbit.yaml
🪛 LanguageTool
AGENTS.md
[grammar] ~6-~6: Use a hyphen to join words.
Context: ... enforced specifically for user or agent written code, not code that is automatic...
(QB_NEW_EN_HYPHEN)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: Build BloodHound Container Image / Build and Package Container
- GitHub Check: run-analysis
- GitHub Check: run-tests
- GitHub Check: build-ui
🔇 Additional comments (2)
AGENTS.md (1)
17-26: LGTM!The test code instructions and code review instructions are well-structured. The guidance on package naming conventions (
_testsuffix), build tags (serial_integration), and the mock generation expectations aligns well with Go best practices and the project's code generation workflow..coderabbit.yaml (1)
1-6: Well-structured CodeRabbit configuration.The configuration file is comprehensive, well-documented with inline comments explaining each setting, and follows the schema conventions. Settings match defaults where appropriate, providing a solid foundation for customization.
sircodemane
force-pushed
the
bed-7115-add-coderabbit-config
branch
from
459b2d3 to
8ff2aed
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.coderabbit.yaml:
- Around line 193-195: The inline comment for the timeout_ms setting is wrong;
update the comment that currently reads ">= 0 and <= 300000" to reflect the
schema's maximum value ">= 0 and <= 900000" (keep the existing default: 90000)
so the comment matches the actual allowed range for timeout_ms.
🧹 Nitpick comments (1)
.coderabbit.yaml (1)
154-364: Tool version numbers in comments are outdated.Many version numbers documented in comments differ significantly from the current schema versions. Examples:
ast-grep: v0.31.1 → v0.40.4Ruff: v0.8.2 → v0.14.10Biome: v1.9.4 → v2.1.2golangci-lint: v1.64.8 → v2.5.0OXC: v0.16.5 → v1.38.0Semgrep: v1.99.0 → v1.146.0While these comments don't affect functionality (CodeRabbit uses its own versions), keeping them current would reduce confusion for maintainers.
Additionally, several newer tools from the schema are not listed:
flake8,pylint,clippy,brakeman,osvScanner,luacheck,htmlhint,checkmake,dotenvLint, etc. These will use schema defaults (enabled).
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.coderabbit.yamlAGENTS.md
🚧 Files skipped from review as they are similar to previous changes (1)
- AGENTS.md
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: Build BloodHound Container Image / Build and Package Container
- GitHub Check: run-tests
- GitHub Check: run-analysis
- GitHub Check: build-ui
🔇 Additional comments (5)
.coderabbit.yaml (5)
1-18: LGTM!Global settings are valid and comments accurately reflect the schema defaults.
125-151: LGTM!The
auto_reviewandfinishing_touchesconfiguration is valid. Missing optional fields likeignore_usernamesandunit_testswill use their schema defaults.
366-377: LGTM!Chat configuration is valid. The optional
artsetting will default totrueper the schema.
379-427: LGTM!The
knowledge_baseandcode_generationsections are valid. Optional sections likecode_guidelines,mcp,unit_tests, andissue_enrichmentwill use their schema defaults.
61-63: Incorrect default value in comment.The comment states
default: false, but according to the schema, the default forcollapse_walkthroughistrue.📝 Proposed fix
# Generate walkthrough in a Markdown collapsible section. - # default: false + # default: true collapse_walkthrough: falseLikely an incorrect or invalid review comment.
TheNando
left a comment
TheNando
left a comment
There was a problem hiding this comment.
Just some suggestions. Otherwise, looks good to me!
.coderabbit.yaml
Outdated
|
|
||
| # Generate walkthrough in a Markdown collapsible section. | ||
| # default: false | ||
| collapse_walkthrough: false |
There was a problem hiding this comment.
This would be on my personal wishlist.
| collapse_walkthrough: false | |
| collapse_walkthrough: true |
|
|
||
| # Automatically apply the suggested labels to the PR/MR. | ||
| # default: false | ||
| auto_apply_labels: false |
There was a problem hiding this comment.
I've seen quite a few PRs slip through with no labels. From what I can tell, CodeRabbit gets it right most often.
| auto_apply_labels: false | |
| auto_apply_labels: true |
| ignore_title_keywords: [] | ||
| # Restrict automatic reviews to only those pull requests that match one of the specified labels. | ||
| # default: [] | ||
| labels: [] |
There was a problem hiding this comment.
Oh dang. I thought this would allow us to apply labels to ignore, but this suggests the labels would be FOR review. Oh well.
| integrations: | ||
| jira: | ||
| # Jira | Enable the Jira integration for opening issues, etc. 'auto' disables the integration for public repositories. `auto`, `enabled`, `disabled` | ||
| # default: auto | ||
| usage: auto |
There was a problem hiding this comment.
If we did want to add a Jira integration, so that CodeRabbit could compare the code to what was requested, we'd need to also enable Jira integration here:
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Fix all issues with AI agents
In @.coderabbit.yaml:
- Around line 379-419: The config currently enables the knowledge base and web
search (knowledge_base.opt_out: false and knowledge_base.web_search.enabled:
true), which may violate organizational data retention or outbound query
policies; confirm with security/compliance whether these features are permitted,
and if not, change knowledge_base.opt_out to true or set
knowledge_base.web_search.enabled to false accordingly. Locate and update the
settings for the knowledge_base block (symbols: knowledge_base.opt_out and
knowledge_base.web_search.enabled) to match the approved policy, and add a short
inline comment documenting the decision and reference to the organization
approval or the docs.coderabbit.ai policy link.
- Around line 4-124: Add a top-level "inheritance: true" key to enable merging
with org-level CodeRabbit config and remove or reduce entries that are just
defaults (e.g., "language: en-US", "early_access: false", "enable_free_tier:
true") so the file only overrides intentional settings (keep customized keys
like "poem: false" and "collapse_walkthrough: true"); this prevents
unintentionally overriding org policies and keeps the repo config minimal.
- Around line 125-365: The config enables many linters irrelevant to this repo
(phpstan, rubocop, swiftlint, detekt, pmd, cppcheck) which wastes CI resources;
update the YAML to disable or remove those keys (set enabled: false for phpstan,
rubocop, swiftlint, detekt, pmd, cppcheck) and keep only golangci-lint, eslint,
ruff, shellcheck, biome, gitleaks and checkov as active tools (ensure their
enabled: true remains); also remove the inline version comments (the "vX.Y.Z"
annotations) throughout the tools section so versions don't drift.
🧹 Nitpick comments (5)
AGENTS.md (3)
1-2: Avoid thehttps://agents.mdmeta comment unless it’s intentional/maintainedLine 1 reads like an external canonical doc pointer; if there isn’t a maintained contract around that URL, it’s likely to confuse more than help.
5-12: Tighten wording + add an explicit note for generated Go (graphschema) files
- Line 11: “Prefer rich variables names” → “Prefer rich variable names”.
- Consider explicitly calling out that
packages/go/graphschema/**is generated (and may change formatting/import aliases when runningjust prepare-for-codereview). Based on learnings, this is a recurring source of review noise.Proposed diff
## Golang code standards - Golang code standards are enforced specifically for user or agent-written code, not code that is automatically generated by tooling (example: unit test mocks) +- Some Go code is generated (e.g., `packages/go/graphschema/**`). Don’t hand-edit generated outputs; regeneration may change formatting/import aliasing. - Receiver functions on structs should prefer `s` as the variable name instead of the first letter of the struct type. - Named returns are not allowed; all return variables must be defined in the function. - Group variable initializations in a `var ( ... )` block and hoist them to the top of the function when possible. - Use `any` instead of `interface{}`. -- Prefer rich variables names, for example: `databaseInterface` instead of `di` or `dbi`. +- Prefer rich variable names, for example: `databaseInterface` instead of `di` or `dbi`.
17-23: *Clarify the build-tag guidance (“integration” reads like wildcard syntax)Line 22: “
*integrationbuild tag” could be interpreted as a glob/wildcard requirement. Suggest rephrasing to “an integration-related build tag (e.g. …)”.Proposed diff
-- Integration test files should have an `*integration` build tag at the top of the file, underneath the license header: example: `//go:build integration` or `//go:build serial_integration` or `//go:build slow_integration` +- Integration test files should have an integration-related build tag at the top of the file, underneath the license header: example: `//go:build integration` or `//go:build serial_integration` or `//go:build slow_integration`.coderabbit.yaml (2)
1-3: Docs link looks stale; consider updating to the current “YAML configuration” pageYour “Docs” URL appears to have moved/redirected; consider updating it to the current YAML configuration page to reduce churn for future editors. (docs.coderabbit.ai)
366-378:chat.auto_reply: trueis a behavior change—confirm expected noise levelAuto-replies can be helpful, but can also spam threads in a busy repo. If you only want responses when tagged, consider setting
chat.auto_reply: false.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.coderabbit.yamlAGENTS.md
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-06-06T23:12:14.181Z
Learnt from: elikmiller
Repo: SpecterOps/BloodHound PR: 1563
File: packages/go/graphschema/azure/azure.go:24-24
Timestamp: 2025-06-06T23:12:14.181Z
Learning: In BloodHound, files in packages/go/graphschema/*/`*.go` are generated from CUE schemas. When `just prepare-for-codereview` is run, it triggers code generation that may automatically add import aliases or other formatting changes. These changes are legitimate outputs of the generation process, not manual edits that would be overwritten.
Applied to files:
.coderabbit.yamlAGENTS.md
🪛 LanguageTool
AGENTS.md
[style] ~29-~29: The verb “get” can be informal. Consider replacing it with a form of “to be”.
Context: ...existing API endpoint (url, models that get marshaled to JSON, query params, etc), there shou...
(GET_USED_ARE_USED)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: run-tests
- GitHub Check: run-analysis
- GitHub Check: build-ui
| # Set the language for reviews by using the corresponding ISO language code. | ||
| # default: en-US | ||
| language: en-US | ||
|
|
||
| # Set the tone of reviews and chat. Example: 'You must use talk like Mr. T. I pity the fool who doesn't!' | ||
| # default: '' | ||
| tone_instructions: '' | ||
|
|
||
| # Enable early-access features. | ||
| # default: false | ||
| early_access: false | ||
|
|
||
| # Enable free tier features for users not on a paid plan. | ||
| # default: true | ||
| enable_free_tier: true | ||
|
|
||
| reviews: | ||
| # Set the profile for reviews. `Assertive` profile yields more feedback, that may be considered nitpick. | ||
| # default: chill | ||
| profile: chill | ||
|
|
||
| # Approve the review once CodeRabbit's comments are resolved. Note: In GitLab, all discussions must be resolved. | ||
| # default: false | ||
| request_changes_workflow: false | ||
|
|
||
| # Generate a high level summary of the changes in the PR/MR description. | ||
| # default: true | ||
| high_level_summary: true | ||
|
|
||
| # Placeholder in the PR/MR description that gets replaced with the high level summary. | ||
| # default: '@coderabbitai summary' | ||
| high_level_summary_placeholder: '@coderabbitai summary' | ||
|
|
||
| # Include the high level summary in the walkthrough comment. | ||
| # default: false | ||
| high_level_summary_in_walkthrough: false | ||
|
|
||
| # Add this keyword in the PR/MR title to auto-generate the title. | ||
| # default: '@coderabbitai' | ||
| auto_title_placeholder: '@coderabbitai' | ||
|
|
||
| # Auto Title Instructions | Custom instructions for auto-generating the PR/MR title. | ||
| # default: '' | ||
| auto_title_instructions: '' | ||
|
|
||
| # Post review details on each review. Additionally, post a review status when a review is skipped in certain cases. | ||
| # default: true | ||
| review_status: true | ||
|
|
||
| # Set the commit status to 'pending' when the review is in progress and 'success' when it is complete. | ||
| # default: true | ||
| commit_status: true | ||
|
|
||
| # Set the commit status to 'failure' when the PR cannot be reviewed by CodeRabbit for any reason. | ||
| # default: false | ||
| fail_commit_status: false | ||
|
|
||
| # Generate walkthrough in a Markdown collapsible section. | ||
| # default: false | ||
| collapse_walkthrough: true | ||
|
|
||
| # Generate a summary of the changed files in the walkthrough. | ||
| # default: true | ||
| changed_files_summary: true | ||
|
|
||
| # Generate sequence diagrams in the walkthrough. | ||
| # default: true | ||
| sequence_diagrams: true | ||
|
|
||
| # Generate an assessment of how well the changes address the linked issues in the walkthrough. | ||
| # default: true | ||
| assess_linked_issues: true | ||
|
|
||
| # Include possibly related issues in the walkthrough. | ||
| # default: true | ||
| related_issues: true | ||
|
|
||
| # Related PRs | Include possibly related pull requests in the walkthrough. | ||
| # default: true | ||
| related_prs: true | ||
|
|
||
| # Suggest labels based on the changes in the pull request in the walkthrough. | ||
| # default: true | ||
| suggested_labels: true | ||
|
|
||
| # Automatically apply the suggested labels to the PR/MR. | ||
| # default: false | ||
| auto_apply_labels: false | ||
|
|
||
| # Suggest reviewers based on the changes in the pull request in the walkthrough. | ||
| # default: true | ||
| suggested_reviewers: true | ||
|
|
||
| # Automatically assign suggested reviewers to the pull request | ||
| # default: false | ||
| auto_assign_reviewers: false | ||
|
|
||
| # Generate a poem in the walkthrough comment. | ||
| # default: true | ||
| poem: false # :-( | ||
|
|
||
| # Labeling Instructions | Provide guidelines for suggesting labels for the PR/MR. When specific labels or instructions are provided, only those labels are considered, though previous examples are still used to inform the suggestions. If no such labels are provided, suggestions are based solely on previous PR/MRs. | ||
| # default: [] | ||
| labeling_instructions: [ ] | ||
|
|
||
| # Specify file patterns to include or exclude in a review using glob patterns (e.g., !dist/**, src/**). These patterns also apply to 'git sparse-checkout', including specified patterns and ignoring excluded ones (starting with '!') when cloning the repository. | ||
| # default: [] | ||
| path_filters: [ ] | ||
|
|
||
| # Path Instructions | Provide specific additional guidelines for code review based on file paths. | ||
| # default: [] | ||
| path_instructions: [] | ||
|
|
||
| # Abort the in-progress review if the pull request is closed or merged. | ||
| # default: true | ||
| abort_on_close: true | ||
|
|
||
| # Disable caching of code and dependencies. This will force CodeRabbit to download the code and dependencies fresh from the repository each time. | ||
| # default: false | ||
| disable_cache: false | ||
|
|
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
CodeRabbit configuration inheritance true documentation
💡 Result:
Short summary — CodeRabbit configuration inheritance ("inheritance: true") (docs):
- Purpose: when set at a config level, CodeRabbit merges that level with parent levels instead of using only the highest-priority source. Inheritance is disabled by default and must be enabled with inheritance: true in .coderabbit.yaml. [1]
- Chain behavior: CodeRabbit walks up the configuration hierarchy and merges while each parent has inheritance: true; the chain stops at the first level where inheritance is false or unset. Missing levels are skipped. [1]
- Merge rules:
- Objects: deep merge; child properties override parent properties at each nesting level.
- Arrays: child items first, then unique parent items appended; deduplication uses keys like path, label, name, id, or key.
- Scalars: child value overrides parent. [1]
- Configuration hierarchy / precedence (with inheritance off, only highest-priority source applies; with inheritance on merge happens across levels). See documentation for Cloud/SaaS vs self-hosted source order. [1][2]
- Example: docs include a full repo+central merge example showing scalars, objects, arrays behavior. [1]
Docs: Configuration inheritance guide (primary) and configuration reference. [1][2]
🏁 Script executed:
#!/bin/bash
# Check what values are different from CodeRabbit defaults
# Most of the shown YAML appears to have default values commented
# Let's count lines with "default:" comments
grep -c "^ # default:" <<'EOF'
language: en-US
tone_instructions: ''
early_access: false
enable_free_tier: true
profile: chill
request_changes_workflow: false
high_level_summary: true
high_level_summary_placeholder: '@coderabbitai summary'
high_level_summary_in_walkthrough: false
auto_title_placeholder: '@coderabbitai'
auto_title_instructions: ''
review_status: true
commit_status: true
fail_commit_status: false
collapse_walkthrough: true
changed_files_summary: true
sequence_diagrams: true
assess_linked_issues: true
related_issues: true
related_prs: true
suggested_labels: true
auto_apply_labels: false
suggested_reviewers: true
auto_assign_reviewers: false
poem: false
labeling_instructions: [ ]
path_filters: [ ]
path_instructions: []
abort_on_close: true
disable_cache: false
EOF
# Count the actual settings to see how many are shown
echo "---"
echo "Settings that deviate from defaults (value != default):"
echo "- poem: false (default: true) - DIFFERENT"
echo "- collapse_walkthrough: true (default: false) - DIFFERENT"
</parameter>Repository: SpecterOps/BloodHound
Length of output: 351
Consider enabling inheritance: true if this repository uses org-level CodeRabbit configuration.
This file contains mostly default values (e.g., language: en-US, early_access: false, enable_free_tier: true, etc.). Without inheritance enabled, this configuration completely overrides any org-level settings. If your organization has central CodeRabbit configuration that should still apply here, add inheritance: true at the top level and trim this file to only the values you're actually customizing (e.g., poem: false, collapse_walkthrough: true). This prevents unintended loss of org-wide policies and keeps the repo config focused on local overrides. See configuration inheritance documentation for details on how the merge behavior works.
🤖 Prompt for AI Agents
In @.coderabbit.yaml around lines 4 - 124, Add a top-level "inheritance: true"
key to enable merging with org-level CodeRabbit config and remove or reduce
entries that are just defaults (e.g., "language: en-US", "early_access: false",
"enable_free_tier: true") so the file only overrides intentional settings (keep
customized keys like "poem: false" and "collapse_walkthrough: true"); this
prevents unintentionally overriding org policies and keeps the repo config
minimal.
| # Settings related to reviews. | ||
| auto_review: | ||
| # Automatic Review | Automatic code review | ||
| # default: true | ||
| enabled: true | ||
| # Automatic Incremental Review | Automatic incremental code review on each push | ||
| # default: true | ||
| auto_incremental_review: true | ||
| # Ignore reviewing if the title of the pull request contains any of these keywords (case-insensitive). | ||
| # default: [] | ||
| ignore_title_keywords: [] | ||
| # Restrict automatic reviews to only those pull requests that match one of the specified labels. | ||
| # default: [] | ||
| labels: [] | ||
| # Review draft PRs/MRs. | ||
| # default: false | ||
| drafts: false | ||
| # Base branches (other than the default branch) to review. Accepts regex patterns. | ||
| # default: [] | ||
| base_branches: [] | ||
|
|
||
| finishing_touches: | ||
| # Docstrings | Options for generating Docstrings for your PRs/MRs. | ||
| docstrings: | ||
| # Docstrings | Allow CodeRabbit to generate docstrings for PRs/MRs. | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| # Tools that provide additional context to code reviews. | ||
| tools: | ||
| # Enable ast-grep | ast-grep is a code analysis tool that helps you to find patterns in your codebase using abstract syntax trees patterns. | v0.31.1 | ||
| ast-grep: | ||
| # List of rules directories. | ||
| # default: [] | ||
| rule_dirs: [] | ||
| # List of utils directories. | ||
| # default: [] | ||
| util_dirs: [] | ||
| # Use ast-grep essentials package. | ||
| # default: true | ||
| essential_rules: true | ||
| # Predefined packages to be used. | ||
| # default: [] | ||
| packages: [] | ||
|
|
||
| # ShellCheck is a static analysis tool that finds bugs in your shell scripts. | ||
| shellcheck: | ||
| # Enable ShellCheck | ShellCheck is a static analysis tool that finds bugs in your shell. | Enable ShellCheck integration. | v0.10.0 | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| # Ruff is a Python linter and code formatter. | ||
| ruff: | ||
| # Enable Ruff | Ruff is a Python linter and code formatter. | Enable Ruff integration. | v0.8.2 | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| # markdownlint-cli2 is a static analysis tool to enforce standards and consistency for Markdown files. | ||
| markdownlint: | ||
| # Enable markdownlint | markdownlint-cli2 is a static analysis tool to enforce standards and consistency for Markdown files. | Enable markdownlint integration. | v0.17.2 | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| # GitHub Checks integration configuration. | ||
| github-checks: | ||
| # Enable GitHub Checks | Enable integration, defaults to true | Enable GitHub Checks integration. | ||
| # default: true | ||
| enabled: true | ||
| # Time in milliseconds to wait for all GitHub Checks to conclude. >= 0 and <= 900000 | ||
| # default: 90000 | ||
| timeout_ms: 90000 | ||
|
|
||
| # LanguageTool is a style and grammar checker for 30+ languages. | ||
| languagetool: | ||
| # Enable LanguageTool | Enable LanguageTool integration. | ||
| # default: true | ||
| enabled: true | ||
| # IDs of rules to be enabled. The rule won't run unless 'level' is set to a level that activates the rule. | ||
| # default: [] | ||
| enabled_rules: [] | ||
| # IDs of rules to be disabled. Note: EN_UNPAIRED_BRACKETS, and EN_UNPAIRED_QUOTES are always disabled. | ||
| # default: [] | ||
| disabled_rules: [] | ||
| # IDs of categories to be enabled. | ||
| # default: [] | ||
| enabled_categories: [] | ||
| # IDs of categories to be disabled. Note: TYPOS, TYPOGRAPHY, and CASING are always disabled. | ||
| # default: [] | ||
| disabled_categories: [] | ||
| # Only the rules and categories whose IDs are specified with 'enabledRules' or 'enabledCategories' are enabled. | ||
| # default: false | ||
| enabled_only: false | ||
| # If set to `picky`, additional rules will be activated, i.e. rules that you might only find useful when checking formal text. | ||
| # default: default | ||
| level: default | ||
|
|
||
| # Biome is a fast formatter, linter, and analyzer for web projects. | ||
| biome: | ||
| # Enable Biome | Biome is a fast formatter, linter, and analyzer for web projects. | Enable Biome integration. | v1.9.4 | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| # Hadolint is a Dockerfile linter. | ||
| hadolint: | ||
| # Enable Hadolint | Hadolint is a Dockerfile linter. | Enable Hadolint integration. | v2.12.0 | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| # SwiftLint integration configuration object. | ||
| swiftlint: | ||
| # Enable SwiftLint | SwiftLint is a Swift linter. | Enable SwiftLint integration. | v0.57.0 | ||
| # default: true | ||
| enabled: true | ||
| # Optional path to the SwiftLint configuration file relative to the repository. This is useful when the configuration file is named differently than the default '.swiftlint.yml' or '.swiftlint.yaml'. | ||
| # config_file: | ||
|
|
||
| # PHPStan is a tool to analyze PHP code. | ||
| phpstan: | ||
| # Enable PHPStan | PHPStan requires [config file](https://phpstan.org/config-reference#config-file) in your repository root. Please ensure that this file contains the `paths:` parameter. | v2.0.3 | ||
| # default: true | ||
| enabled: true | ||
| # Level | Specify the [rule level](https://phpstan.org/user-guide/rule-levels) to run. This setting is ignored if your configuration file already has a `level:` parameter. | ||
| # default: default | ||
| level: default | ||
|
|
||
| # golangci-lint is a fast linters runner for Go. | ||
| golangci-lint: | ||
| # Enable golangci-lint | golangci-lint is a fast linters runner for Go. | Enable golangci-lint integration. | v1.64.8 | ||
| # default: true | ||
| enabled: true | ||
| # Optional path to the golangci-lint configuration file relative to the repository. Useful when the configuration file is named differently than the default '.golangci.yml', '.golangci.yaml', '.golangci.toml', '.golangci.json'. | ||
| # config_file: | ||
|
|
||
| # YAMLlint is a linter for YAML files. | ||
| yamllint: | ||
| # Enable YAMLlint | YAMLlint is a linter for YAML files. | Enable YAMLlint integration. | v1.35.1 | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| # Gitleaks is a secret scanner. | ||
| gitleaks: | ||
| # Enable Gitleaks | Gitleaks is a secret scanner. | Enable Gitleaks integration. | v8.21.2 | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| # Checkov is a static code analysis tool for infrastructure-as-code files. | ||
| checkov: | ||
| # Enable Checkov | Checkov is a static code analysis tool for infrastructure-as-code files. | v3.2.334 | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| # Detekt is a static code analysis tool for Kotlin files. | ||
| detekt: | ||
| # Enable detekt | detekt is a static code analysis tool for Kotlin files. | v1.23.7 | ||
| # default: true | ||
| enabled: true | ||
| # Optional path to the detekt configuration file relative to the repository. | ||
| # config_file: | ||
|
|
||
| # ESLint is a static code analysis tool for JavaScript files. | ||
| eslint: | ||
| # Enable ESLint | ESLint is a static code analysis tool for JavaScript files. | v8.45.0 | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| # RuboCop is a Ruby static code analyzer (a.k.a. linter ) and code formatter. | ||
| rubocop: | ||
| # Enable RuboCop | RuboCop is a Ruby static code analyzer (a.k.a. linter ) and code formatter. | v1.73 | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| # Buf offers linting for Protobuf files. | ||
| buf: | ||
| # Enable Buf | Buf offers linting for Protobuf files. | v1.47.2 | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| # Regal is a linter and language server for Rego. | ||
| regal: | ||
| # Enable Regal | Regal is a linter and language server for Rego. | v0.29.2 | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| # actionlint is a static checker for GitHub Actions workflow files. | ||
| actionlint: | ||
| # Enable actionlint | is a static checker for GitHub Actions workflow files. | v1.7.4 | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| # PMD is an extensible multilanguage static code analyzer. It’s mainly concerned with Java. | ||
| pmd: | ||
| # Enable PMD | PMD is an extensible multilanguage static code analyzer. It’s mainly concerned with Java. | v7.8.0 | ||
| # default: true | ||
| enabled: true | ||
| # Optional path to the PMD configuration file relative to the repository. | ||
| # config_file: | ||
|
|
||
| # Cppcheck is a static code analysis tool for the C and C++ programming languages. | ||
| cppcheck: | ||
| # Enable Cppcheck | Cppcheck is a static code analysis tool for the C and C++ programming languages. | v2.10-2 | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| # Semgrep is a static analysis tool designed to scan code for security vulnerabilities and code quality issues. | ||
| semgrep: | ||
| # Enable Semgrep | Semgrep is a static analysis tool designed to scan code for security vulnerabilities and code quality issues. | Enable Semgrep integration. | v1.99.0 | ||
| # default: true | ||
| enabled: true | ||
| # Optional path to the Semgrep configuration file relative to the repository. | ||
| # config_file: | ||
|
|
||
| # CircleCI tool is a static checker for CircleCI config files. | ||
| circleci: | ||
| # Enable CircleCI | CircleCI tool is a static checker for CircleCI config files. | v0.1.31151 | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| # SQLFluff is an open source, dialect-flexible and configurable SQL linter. | ||
| sqlfluff: | ||
| # Enable SQLFluff | SQLFluff is an open source, dialect-flexible and configurable SQL linter. | v3.3.0 | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| # Configuration for Prisma Schema linting to ensure schema file quality | ||
| prismaLint: | ||
| # Enable Prisma Schema linting | Prisma Schema linting helps maintain consistent and error-free schema files | v0.10.0 | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| # OXC is a JavaScript/TypeScript linter written in Rust. | ||
| oxc: | ||
| # Enable OXC | OXC is a JavaScript/TypeScript linter written in Rust. | v0.16.5 | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| # Configuration for Shopify Theme Check to ensure theme quality and best practices | ||
| shopifyThemeCheck: | ||
| # Enable Shopify Theme Check | A linter for Shopify themes that helps you follow Shopify theme & Liquid best practices | cli 3.77.1 | theme 3.58.2 | ||
| # default: true | ||
| enabled: true | ||
|
|
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Determine repo context
echo "=== Repository Root ==="
pwd
# 1) Detect whether the repo contains files for languages with enabled linters
echo -e "\n=== Checking for PHP files ==="
rg -c '\.php$' --hidden -g'!*node_modules/**' -g'!*dist/**' -g'!*build/**' -g'!*vendor/**' . 2>/dev/null || echo "No PHP files found"
echo -e "\n=== Checking for Ruby files ==="
rg -c '\.rb$' --hidden -g'!*node_modules/**' -g'!*dist/**' -g'!*build/**' . 2>/dev/null || echo "No Ruby files found"
echo -e "\n=== Checking for Swift files ==="
rg -c '\.swift$' --hidden -g'!*node_modules/**' -g'!*dist/**' -g'!*build/**' . 2>/dev/null || echo "No Swift files found"
echo -e "\n=== Checking for Kotlin files ==="
rg -c '\.kt$' --hidden -g'!*node_modules/**' -g'!*dist/**' -g'!*build/**' . 2>/dev/null || echo "No Kotlin files found"
echo -e "\n=== Checking for Java files ==="
rg -c '\.java$' --hidden -g'!*node_modules/**' -g'!*dist/**' -g'!*build/**' . 2>/dev/null || echo "No Java files found"
echo -e "\n=== Checking for C/C++ files ==="
rg -c '\.(c|cpp|cc|cxx|h|hpp)$' --hidden -g'!*node_modules/**' -g'!*dist/**' -g'!*build/**' . 2>/dev/null || echo "No C/C++ files found"
echo -e "\n=== Checking for Rust files ==="
rg -c '\.rs$' --hidden -g'!*node_modules/**' -g'!*dist/**' -g'!*build/**' . 2>/dev/null || echo "No Rust files found"
# 2) Check for commonly-required config files
echo -e "\n=== Checking for required linter configs ==="
for f in phpstan.neon phpstan.neon.dist .rubocop.yml .rubocop.yaml .swiftlint.yml .swiftlint.yaml detekt.yml detekt.yaml pmd.xml .eslintrc .eslintrc.json .eslintrc.js .yamllint .golangci.yml .golangci.yaml .golangci.json .cppcheck.cfg; do
if [ -f "$f" ]; then
echo "FOUND: $f"
fi
done
# 3) Check main language usage in repo
echo -e "\n=== Primary languages detected ==="
rg -c '\.(go|ts|tsx|js|jsx|py|sh|java|rs|swift)$' --hidden -g'!*node_modules/**' -g'!*dist/**' -g'!*build/**' . 2>/dev/null | head -20 || trueRepository: SpecterOps/BloodHound
Length of output: 2031
Disable unused linters that don't match the repository's tech stack
The repository uses Go, TypeScript/JavaScript, Python, and shell scripts. However, the config enables PHPStan, RuboCop, SwiftLint, Detekt, PMD, and Cppcheck—none of which are applicable. This will waste resources and risk errors if tools expect repository-specific configs (e.g., .rubocop.yml, .swiftlint.yml, phpstan.neon) that don't exist.
Keep only: golangci-lint, eslint, ruff, shellcheck, biome, and language-agnostic tools like gitleaks and checkov. Remove or conditionally enable the rest.
Also remove inline version numbers (vX.Y.Z comments)—they will drift over time.
🤖 Prompt for AI Agents
In @.coderabbit.yaml around lines 125 - 365, The config enables many linters
irrelevant to this repo (phpstan, rubocop, swiftlint, detekt, pmd, cppcheck)
which wastes CI resources; update the YAML to disable or remove those keys (set
enabled: false for phpstan, rubocop, swiftlint, detekt, pmd, cppcheck) and keep
only golangci-lint, eslint, ruff, shellcheck, biome, gitleaks and checkov as
active tools (ensure their enabled: true remains); also remove the inline
version comments (the "vX.Y.Z" annotations) throughout the tools section so
versions don't drift.
| knowledge_base: | ||
| # Opt Out | Disable all knowledge base features that require data retention. If you opt out after opting in, all of your existing knowledge base data will be removed from the system. | ||
| # default: false | ||
| opt_out: false | ||
|
|
||
| web_search: | ||
| # Web Search | Enable the web search integration. | ||
| # default: true | ||
| enabled: true | ||
|
|
||
| learnings: | ||
| # Learnings | Specify the scope of learnings to use for the knowledge base. 'local' uses the repository's learnings, 'global' uses the organization's learnings, and 'auto' uses repository's learnings for public repositories and organization's learnings for private repositories. | ||
| # default: auto | ||
| scope: auto | ||
|
|
||
| issues: | ||
| # Issues | Specify the scope of git platform (GitHub/GitLab) issues to use for the knowledge base. 'local' uses the repository's issues, 'global' uses the organization's issues, and 'auto' uses repository's issues for public repositories and organization's issues for private repositories. | ||
| # default: auto | ||
| scope: auto | ||
|
|
||
| jira: | ||
| # Jira | Enable the Jira knowledge base integration. 'auto' disables the integration for public repositories. `auto`, `enabled`, `disabled` | ||
| # default: auto | ||
| usage: auto | ||
| # Jira Project Keys | Specify the Jira project keys to use for the knowledge base. | ||
| # default: [] | ||
| project_keys: [] | ||
|
|
||
| linear: | ||
| # Linear | Enable the Linear knowledge base integration. 'auto' disables the integration for public repositories. `auto`, `enabled`, `disabled` | ||
| # default: auto | ||
| usage: auto | ||
| # Linear Team Keys | Specify the Linear team keys (identifiers) to use for the knowledge base. E.g. 'ENG' | ||
| # default: [] | ||
| team_keys: [] | ||
|
|
||
| pull_requests: | ||
| # Pull Requests | Specify the scope of pull requests to use for the knowledge base. 'local' uses the repository's pull requests, 'global' uses the organization's pull requests, and 'auto' uses repository's pull requests for public repositories and organization's pull requests for private repositories. | ||
| # default: auto | ||
| scope: auto | ||
|
|
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
find . -name ".coderabbit.yaml" -o -name "coderabbit.yaml" | head -5Repository: SpecterOps/BloodHound
Length of output: 83
🏁 Script executed:
# Check if the file exists and examine the content around lines 379-419
if [ -f ".coderabbit.yaml" ]; then
wc -l ".coderabbit.yaml"
sed -n '379,419p' ".coderabbit.yaml"
fiRepository: SpecterOps/BloodHound
Length of output: 2121
Confirm knowledge base and web search configuration aligns with organizational policies
knowledge_base.opt_out: false combined with web_search.enabled: true enables features that involve data retention and outbound web queries. Before merging, verify with your organization that these behaviors are acceptable under your data handling and compliance policies. Reference: docs.coderabbit.ai
🤖 Prompt for AI Agents
In @.coderabbit.yaml around lines 379 - 419, The config currently enables the
knowledge base and web search (knowledge_base.opt_out: false and
knowledge_base.web_search.enabled: true), which may violate organizational data
retention or outbound query policies; confirm with security/compliance whether
these features are permitted, and if not, change knowledge_base.opt_out to true
or set knowledge_base.web_search.enabled to false accordingly. Locate and update
the settings for the knowledge_base block (symbols: knowledge_base.opt_out and
knowledge_base.web_search.enabled) to match the approved policy, and add a short
inline comment documenting the decision and reference to the organization
approval or the docs.coderabbit.ai policy link.
| ## Code review instructions | ||
| - The user should have run `just prepare-for-codereview` before creating a PR. This command runs tests locally, does code generation, adds license headers, and generates OpenAPI docs. | ||
| - There is no 100% positive way to identify that a user has run `just prepare-for-codereview`, but there are some smells to look for which indicate that a user might not have run it: | ||
| - Code files must have a license header at the top of the file using a code comment block. The file `LICENSE.header` file has an up-to-date version of the header. | ||
| - The file located at `cmd/api/src/database/db.go` contains a Database interface type. This interface must be implemented by the `MockDatabase` struct in `cmd/api/src/database/mocks/db.go` and is generated by `go.uber.org/mock/mockgen`. | ||
| - If the code adds a new API endpoint, or it changes something about an existing API endpoint (url, models that get marshaled to JSON, query params, etc), there should probably be changes to the OpenAPI yaml files. | ||
| - If OpenAPI yaml files have been changed, `openapi.json` should also have corresponding changes. |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify the referenced paths exist
for p in cmd/api/src/database/db.go cmd/api/src/database/mocks/db.go; do
if [ -f "$p" ]; then
echo "OK: found $p"
else
echo "MISSING: $p"
fi
done
# Search for Database interface definition
echo ""
echo "=== Searching for Database interface ==="
rg -n 'type\s+Database\s+interface' -g'*.go' -C2
# Search for MockDatabase struct
echo ""
echo "=== Searching for MockDatabase struct ==="
rg -n 'type\s+MockDatabase\b' -g'*.go' -C2
# Search for mockgen usage
echo ""
echo "=== Searching for mockgen ==="
rg -n 'mockgen' -g'*.go' -C2Repository: SpecterOps/BloodHound
Length of output: 14718
Minor wording polish needed
Lines 29–30: "models that get marshaled" → "models that are marshaled" and "url" → "URL" for consistency.
The paths referenced in lines 28–29 are accurate and stable; they correctly identify the Database interface in cmd/api/src/database/db.go and the generated MockDatabase in cmd/api/src/database/mocks/db.go.
🧰 Tools
🪛 LanguageTool
[style] ~29-~29: The verb “get” can be informal. Consider replacing it with a form of “to be”.
Context: ...existing API endpoint (url, models that get marshaled to JSON, query params, etc), there shou...
(GET_USED_ARE_USED)
Description
Adds a code rabbit config file and agents.md file to help better instruction LLMs that interact with our code.
Motivation and Context
Resolves BED-7115
Types of changes
Checklist:
Summary by CodeRabbit
Chores
Documentation
✏️ Tip: You can customize this high-level summary in your review settings.