ci: harden CodeRabbit review coverage

[Luqueee]

Summary

• add actionlint, zizmor, and OSV Scanner coverage to CodeRabbit
• restrict automatic reviews to main and disable agentic conflict resolution
• add Mole-specific review contracts for SSH tunnels, discovery, configuration, CLI lifecycle, and deployment

Validation

• pnpm --dir landing exec prettier --check ../.coderabbit.yaml ../CODE_REVIEW.md
• git diff --check

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 743e67c8-24e3-4172-b282-672334a551de

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: aba0a3bb-0028-4de8-b634-f01a31f8b319

📥 Commits

Reviewing files that changed from the base of the PR and between 21322ab and e36d8d0.

📒 Files selected for processing (1)

• .coderabbit.yaml

Included review availability: Your plan provides up to 8 included reviews per hour; 1 remains after this review.

---

📝 Summary

Summary by CodeRabbit

• Documentation

  • Added guidance for SSH tunnel lifecycle, authentication, remote listener discovery, CLI and configuration compatibility, and production deployment using Tailscale and SSH.

• Chores

  • Improved automated code review configuration with Go-specific guidance and additional checks for workflow security, dependency vulnerabilities, and shell scripts.
  • Updated review settings to support main-branch automation and exclude generated dependency checksum files.

Walkthrough

Changes

The pull request configures review automation and adds subsystem-specific review contracts for tunnel, discovery, configuration, CLI, and deployment changes.

Review policy and contracts

Layer / File(s)	Summary
Review automation configuration .coderabbit.yaml	Disables early access and selected optional automation. Restricts automatic reviews to main, ignores go.sum, and enables Actionlint, Zizmor, and OSV-Scanner.
Subsystem review contracts .coderabbit.yaml, CODE_REVIEW.md	Adds review guidance for SSH tunnel lifecycle, listener discovery, configuration precedence and secrecy, CLI compatibility, and production deployment credentials.

Merge Risk: ⚪ Minimal · up to e36d8

This updates review automation scope, security checks, and subsystem review guidance without an identified current merge-readiness risk.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title uses the required ci: Conventional Commit prefix, uses the imperative verb "harden," and accurately summarizes the CodeRabbit review configuration changes.
Description check	✅ Passed	The description directly explains the changes to CodeRabbit checks, review restrictions, conflict resolution, and Mole-specific review contracts. It also lists validation steps.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/harden-coderabbit

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 3788668c-1d4c-4865-927e-603a628217fd

📥 Commits

Reviewing files that changed from the base of the PR and between 3927bad and 21322ab.

📒 Files selected for processing (2)

• .coderabbit.yaml
• CODE_REVIEW.md

Included review availability: Your plan provides up to 8 included reviews per hour; 2 remain after this review.

[Luqueee]

CodeRabbit feedback addressed

Documented that auto_pause_after_reviewed_commits: 2 is intentional to avoid redundant incremental reviews on small fixup pushes while preserving the option to request a fresh review manually.

Commit: e36d8d0

[Luqueee]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Already reviewed the last commit. Use @coderabbitai full review to rerun a review of the entire changeset.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.