From cfcd591ee0605353c2aef1e09d3413545ff48f84 Mon Sep 17 00:00:00 2001 From: Diego Cotelo Date: Fri, 18 Sep 2026 15:40:30 -0300 Subject: [PATCH 1/2] chore(review): assertive profile, and instructions for the untouched trees Closes #37. At `chill`, the incremental review of #33 missed a classifier that ignored `statusLine.type` and so reported a configuration Claude Code would never run as correctly wired. Only an explicitly requested full review found it. The profile goes to `assertive`, with that reason written beside it. Path instructions covered `scripts/**` and `tests/**` only. Four trees had none, and each has conventions a reviewer cannot infer from the diff: - `statusline/**` runs every few seconds inside a live session and must never block, exit non-zero, call the network, or consume stdin unasked. - `hooks/**` degrades to silence and cannot assume cprof is on PATH. - `docs/**` must name only commands and keys that exist, keep anchors resolving across the topic-doc split, and never name another statusline tool; versions are written by automation. - `.github/**` holds write-capable tokens: actions pinned to full SHAs, and no workflow executing a script from the pull request's own revision. The `tests/**` instruction gains the failure mode this repository keeps producing: an assertion that would pass whether or not the code works, with the specific shapes to look for. No linter changes: actionlint, yamllint, markdownlint and gitleaks already default to enabled, and listing only shellcheck under `tools:` never disabled them. Signed-off-by: Diego Cotelo --- .coderabbit.yaml | 46 ++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 44 insertions(+), 2 deletions(-) diff --git a/.coderabbit.yaml b/.coderabbit.yaml index d146f87..454523f 100644 --- a/.coderabbit.yaml +++ b/.coderabbit.yaml @@ -1,7 +1,10 @@ # CodeRabbit configuration — https://docs.coderabbit.ai/reference/yaml-template language: en-US reviews: - profile: chill + # assertive, not chill: at chill an incremental review of #33 missed a + # classifier that ignored statusLine.type and so called a broken + # configuration correct. Only an explicitly requested full review caught it. + profile: assertive high_level_summary: true poem: false auto_review: @@ -23,7 +26,46 @@ reviews: instructions: >- Tests use the harness in tests/lib.sh (assert_eq, assert_ok, assert_fail). Every behavior change in scripts/ should carry a - matching assertion. + matching assertion. An assertion that would pass whether or not the + code works is the failure mode here: flag any new assertion whose + expectation is not derived from, or distinct from, the code under + test. Watch for a guard that cannot fail because the condition it + checks is unreachable in the fixture -- colour disabled while + asserting on colour, a command whose exit status is ignored, an + assert_fail on a function that does not exist yet. + - path: "statusline/**" + instructions: >- + Renders inside a live Claude Code session, which re-runs it every few + seconds. It must never fail the session and never add latency: a + missing jq, an unreadable config, an absent git, a missing CLI or an + empty payload prints nothing, or as much of the line as it can, and + exits 0. No network calls, ever. Claude Code pipes one JSON payload on + stdin and the first reader starves the rest, so stdin is read only + when a flag asks for it. Flag anything that could block, exit + non-zero, or consume stdin unasked. + - path: "hooks/**" + instructions: >- + Plugin hooks run on session events and must degrade to silence rather + than failing the session. Same constraints as statusline/: no + blocking, no non-zero exit, no assumption that cprof is on PATH -- + resolve the CLI relative to the plugin root. + - path: "docs/**" + instructions: >- + Every command, flag, config key and path shown must exist in the code + as written; check them rather than assuming. Relative links and + anchors must resolve -- the README was split into topic docs, so a + moved section's anchors live in a different file now. Do not name any + other statusline tool. Version numbers are written by release + automation, never by hand. + - path: ".github/**" + instructions: >- + Release automation with write-capable tokens. Every third-party action + is pinned to a full commit SHA with the version as a trailing comment; + flag a tag or branch ref. A workflow holding a write-capable token + must not execute a script from the pull request's own revision -- + release-bump deliberately runs the base revision's copy. Conventional + Commit subjects decide whether a merge publishes a release, so flag + changes to that mapping that tests do not pin. tools: shellcheck: enabled: true From 781045bb34fced7c56389ab6dad16cdfa97be285 Mon Sep 17 00:00:00 2001 From: Diego Cotelo Date: Fri, 18 Sep 2026 15:40:30 -0300 Subject: [PATCH 2/2] chore(review): let CodeRabbit approve, so a clean PR needs no admin bypass MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes #36. `main` requires one approving review, and as the sole maintainer every pull request has landed with `--admin` — the rule bypassed rather than met. CodeRabbit reviews every pull request and has found real defects, but submits `COMMENTED` reviews, so its verdict could never satisfy the rule. `request_changes_workflow: true` makes it approve once its comments are resolved and the head has been reviewed. Two things this does not yet know, recorded in the config beside the setting rather than left for someone to rediscover: Whether the approval counts at all. GitHub treats bots inconsistently — Actions reviews count subject to an org toggle, Copilot's explicitly do not. CodeRabbit is a GitHub App with write access, which ordinarily does count, but that is an assumption until a pull request reaches `CLEAN` without `--admin`. This pull request is the first test. Whether an approval survives the release. `dismiss_stale_reviews` is on and `release-bump` pushes `chore(release):` after review, dismissing the approval it just gave. It does re-review a new head; whether it re-approves is unverified. `auto_assign_reviewers` was considered and left off: it assigns suggested reviewers, which on a single-maintainer repository means noise rather than the visibility it sounds like. Signed-off-by: Diego Cotelo --- .coderabbit.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.coderabbit.yaml b/.coderabbit.yaml index 454523f..83f6bee 100644 --- a/.coderabbit.yaml +++ b/.coderabbit.yaml @@ -10,6 +10,15 @@ reviews: auto_review: enabled: true drafts: false + # Submits an approval once its comments are resolved and the latest commit + # has been reviewed, so a clean pull request can merge without --admin. + # Unverified until the next release exercises it: whether a GitHub App's + # approval counts toward the one-approval rule is not documented either way + # (Copilot's explicitly does not), and dismiss_stale_reviews is on, so the + # release-bump commit pushed after review will dismiss an approval already + # given. If that leaves a pull request stuck, the choice is between turning + # off stale dismissal and accepting a second review cycle per release. + request_changes_workflow: true path_instructions: - path: "scripts/**" instructions: >-