Skip to content

Commit 142d290

Browse files
skulidropekskulidropek
committed
chore: configure hosted OSS review agents
1 parent 31594d8 commit 142d290

13 files changed

Lines changed: 156 additions & 31 deletions

File tree

‎.coderabbit.yaml‎

Lines changed: 17 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -41,43 +41,33 @@ reviews:
4141
path_instructions:
4242
- path: "**/*"
4343
instructions: |
44-
Review every PR against its source of truth, not only against the diff.
44+
Ты строгий ревьюер SPEC DRIVEN DEVELOPMENT.
4545
46-
Requirement sources, in priority order:
47-
1. Linked GitHub issues in the PR body (`Fixes #123`, `Closes #123`, full issue URLs).
48-
2. Explicit issue/TZ references in the PR title, PR description, branch name (`issue-123`), and PR discussion.
49-
3. Changed-code markers such as `QUOTE(ТЗ): ...`, `REF: issue-...`, and nearby tests.
50-
4. If final decisions only exist in issue comments and are not available in review context, ask the author to copy the final TZ/acceptance criteria into the issue body or PR description.
46+
Перед выводами изучи README.md, другие *.md файлы, linked issues,
47+
PR description, PR comments/discussion и релевантную кодовую базу.
5148
52-
Always include a "Соответствие ТЗ" section when the PR has an issue/TZ reference:
53-
- list the concrete issue/TZ requirements that the diff implements;
54-
- flag any requirement from the issue, PR body, or PR discussion that is missing or contradicted by the code;
55-
- flag scope creep when the diff changes behavior not requested by the issue/TZ;
56-
- verify that tests cover the observable behavior promised by the issue/TZ.
49+
Сверь изменения с исходным ТЗ/спекой и обсуждением. Флагай любой уход
50+
от спеки, недокументированное изменение поведения, отсутствие тестов
51+
для заявленного поведения и security-риск. Если спека не видна,
52+
попроси автора добавить ее в issue или PR description.
5753
58-
Security review priorities:
59-
- command injection, shell argument escaping, unsafe `docker`, `git`, `ssh`, `gh`, `sudo`, or process spawning;
60-
- path traversal, unsafe filesystem access, and accidental writes outside `.docker-git` or the project workspace;
61-
- SSRF/open redirects/network access introduced by user-controlled input;
62-
- leaked secrets, tokens, private keys, and sensitive data in logs;
63-
- GitHub Actions permission escalation, unpinned risky actions, unsafe `pull_request_target`, and supply-chain risks;
64-
- Docker socket exposure, privileged containers, host mounts, GPU/resource flags, and cross-container isolation breaks.
54+
Проверь решение с точки зрения формальной верификации: какие инварианты,
55+
предусловия и постусловия можно доказать математически, а где доказуемость
56+
слабая. Оцени решение с точки зрения теории игр: устойчивы ли стимулы,
57+
нет ли выгодного обхода правил, и какое решение было бы сильнее.
6558
6659
pre_merge_checks:
6760
issue_assessment:
6861
mode: "warning"
6962
custom_checks:
7063
- name: "Requirements alignment"
71-
mode: "warning"
64+
mode: "error"
7265
instructions: |
73-
Fail if any of these are true:
74-
- The PR has no discoverable source requirement: no linked issue, no issue/TZ reference in the PR title/body/branch/discussion, and no changed-code `QUOTE(ТЗ)` or `REF` marker.
75-
- The changed code contradicts a linked issue title/body, PR description, PR discussion decision, or changed-code `QUOTE(ТЗ)`/`REF` marker.
76-
- A concrete acceptance criterion from the linked issue or PR description is not implemented and not explicitly marked out of scope in the PR description.
77-
- Observable behavior promised by the issue/TZ is changed without matching tests or a clear explanation in the PR description.
78-
79-
Pass when the source requirement is traceable and every explicit requirement is implemented, tested, or explicitly documented as out of scope.
80-
Return Inconclusive only when the relevant issue/TZ discussion is referenced but not available in the review context; ask the author to copy the final TZ into the issue body or PR description.
66+
Fail if the diff contradicts the visible spec/TZ, linked issue, PR
67+
discussion, README/docs, or changes behavior without documenting it.
68+
Fail if promised behavior has no relevant tests. Return Inconclusive
69+
when the spec is missing and ask the author to add it. Also flag weak
70+
formal invariants or game-theory incentives when they undermine the spec.
8171
- name: "Security regression"
8272
mode: "warning"
8373
instructions: |

‎.greptile/config.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{
2+
"strictness": 1,
3+
"commentTypes": ["logic", "syntax", "style", "info"],
4+
"triggerOnUpdates": true,
5+
"triggerOnDrafts": true,
6+
"ignorePatterns": "node_modules/**\ndist/**\ncoverage/**\nthird_party/**",
7+
"statusCheck": true,
8+
"statusCommentsEnabled": true,
9+
"updateExistingSummaryComment": true,
10+
"summarySection": {
11+
"included": true,
12+
"collapsible": true,
13+
"defaultOpen": false
14+
},
15+
"instructions": "This is a public MIT open-source TypeScript/Bun monorepo. Review every PR as SPEC DRIVEN DEVELOPMENT: compare the diff with README.md, repository Markdown docs, linked issues, PR description, PR comments and the relevant codebase. Flag spec drift, undocumented behavior changes, missing tests for promised behavior, high-confidence security risks, weak formal invariants, and game-theory incentive problems.",
16+
"rules": [
17+
{
18+
"id": "spec-source-required",
19+
"rule": "Every behavioral change must be traceable to a visible source of truth: linked issue, PR description, PR discussion, README/docs, or changed-code reference. If the spec is missing, ask the author to add it before approval.",
20+
"severity": "high"
21+
},
22+
{
23+
"id": "spec-alignment",
24+
"rule": "Flag any change that contradicts the visible issue/TZ/spec, PR discussion, README/docs, or changes behavior without documentation.",
25+
"severity": "high"
26+
},
27+
{
28+
"id": "security-review",
29+
"rule": "Look for injection, path traversal, secret leaks, unsafe Docker/GitHub Actions settings, supply-chain risk, and cross-container isolation regressions.",
30+
"severity": "high"
31+
},
32+
{
33+
"id": "formal-verification",
34+
"rule": "Assess which invariants, preconditions, and postconditions are mathematically defensible. Flag weak or unstated invariants when they affect correctness.",
35+
"severity": "medium"
36+
},
37+
{
38+
"id": "game-theory",
39+
"rule": "Assess whether the implementation creates incentives to bypass intended rules or safety controls. Suggest a stronger mechanism when incentives are misaligned.",
40+
"severity": "medium"
41+
}
42+
]
43+
}

‎.greptile/files.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"files": [
3+
{
4+
"path": "README.md",
5+
"description": "Main project behavior, CLI usage, runtime contracts, and architecture notes."
6+
},
7+
{
8+
"path": "AGENTS.md",
9+
"description": "Repository engineering rules, formal verification expectations, and review constraints."
10+
},
11+
{
12+
"path": "LICENSE",
13+
"description": "Project license text, legal terms, and copyright."
14+
}
15+
]
16+
}

‎.greptile/rules.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# SPEC-DRIVEN DEVELOPMENT Review Rules
2+
3+
Review every PR against its source of truth, not only against the diff.
4+
5+
Use README.md, repository Markdown docs, linked issues, PR description, PR comments/discussion, and the relevant codebase as review context.
6+
7+
Flag:
8+
- Spec drift or contradiction with the issue/TZ/spec.
9+
- Undocumented behavior changes.
10+
- Missing tests for promised behavior.
11+
- Security regressions.
12+
- Weak formal invariants, preconditions, or postconditions.
13+
- Game-theory incentive problems where users can profitably bypass intended rules.
14+
15+
If the spec is not visible, ask the author to copy the final requirements into the issue or PR description.

‎.pr_agent.toml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
[github_app]
2+
pr_commands = [
3+
"/agentic_describe",
4+
"/agentic_review"
5+
]
6+
handle_push_trigger = true
7+
push_commands = [
8+
"/agentic_review"
9+
]
10+
11+
[review_agent]
12+
comments_location_policy = "both"
13+
inline_comments_severity_threshold = 2
14+
issues_user_guidelines = """
15+
Review as SPEC DRIVEN DEVELOPMENT.
16+
Read README.md, repository Markdown docs, linked issues, PR description, PR comments/discussion, and relevant code.
17+
Flag spec drift, undocumented behavior changes, missing tests for promised behavior, and security risks.
18+
"""
19+
compliance_user_guidelines = """
20+
Check whether the code matches the visible issue/TZ/spec and discussion.
21+
Check formal-verification quality: invariants, preconditions, postconditions, and what can be proved mathematically.
22+
Check game-theory quality: whether incentives let users bypass intended rules, and suggest stronger mechanisms.
23+
If the spec is missing, ask the author to add it to the issue or PR description.
24+
"""

‎.sourcery.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
ignore:
2+
- .git
3+
- node_modules
4+
- dist
5+
- coverage
6+
- third_party
7+
8+
github:
9+
labels: []
10+
ignore_labels:
11+
- sourcery-ignore
12+
- do-not-review
13+
- skip-review

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2026 ProverCoderAI Contributors
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
`docker-git` создаёт отдельную Docker-среду для каждого репозитория, issue или PR.
44
По умолчанию проекты лежат в `~/.docker-git`.
55

6+
License: MIT. See [LICENSE](LICENSE).
7+
68
## Установка
79

810
```bash

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,5 +68,5 @@
6868
"url": "https://github.com/ProverCoderAI/docker-git/issues"
6969
},
7070
"homepage": "https://github.com/ProverCoderAI/docker-git#readme",
71-
"license": "ISC"
71+
"license": "MIT"
7272
}

‎packages/api/package.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
"type": "git",
3232
"url": "git+https://github.com/ProverCoderAI/docker-git.git"
3333
},
34+
"license": "MIT",
3435
"bugs": {
3536
"url": "https://github.com/ProverCoderAI/docker-git/issues"
3637
},

0 commit comments

Comments
 (0)