.coderabbit.yaml

# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

language: en-US

# Keep feedback concise — style is already enforced by Biome.
tone_instructions: >
  Be concise and direct. Focus on correctness, security, and maintainability.
  Skip style issues enforced by Biome (indentation, quotes, import order).
  When something is wrong, be clear about why and suggest a fix.

early_access: false

reviews:
  profile: assertive
  request_changes_workflow: false
  high_level_summary: true
  high_level_summary_placeholder: "@coderabbitai summary"
  auto_title_placeholder: "@coderabbitai"
  poem: false
  review_status: true
  collapse_walkthrough: false

  # Run reviews on PRs targeting any branch.
  base_branches:
    - ".*"

  auto_review:
    enabled: true
    drafts: false
    # Also auto-review PRs targeting any branch.
    base_branches:
      - ".*"

  # Skip generated files, build output, and lock files.
  path_filters:
    - "!node_modules/**"
    - "!**/dist/**"
    - "!**/build/**"
    - "!**/.next/**"
    - "!**/.wrangler/**"
    - "!**/ios/**"
    - "!**/android/**"
    - "!**/public/**"
    - "!**/*.gen.ts"
    - "!**/src/codegen/**"
    - "!bun.lock"

  path_instructions:
    # ── API (Elysia / Drizzle / Cloudflare Workers) ─────────────────────────
    - path: "packages/api/src/**"
      instructions: |
        - The API is built with **Elysia** (not Hono) on Cloudflare Workers,
          using the `CloudflareAdapter`. OpenAPI docs are generated by
          `@elysiajs/openapi`; the typed client uses Eden Treaty
          (`@elysiajs/eden`).
        - Routes are composed with `new Elysia({ prefix: '...' }).use(plugin)`
          and must be registered in `src/routes/index.ts`.
        - Validation schemas live in `src/schemas/` (Zod). Business logic
          belongs in `src/services/`, not in route handlers.
        - Protected routes must use the `authPlugin` macro
          (`isAuthenticated: true`). Verify that role/ownership checks are
          present where needed.
        - Flag N+1 query patterns and missing database indexes on foreign keys
          or frequently filtered columns.
        - All user-generated content must use soft deletes (never hard DELETE).
        - Prefer async/await over raw Promise chains.
        - Drizzle ORM: prefer the query-builder API over raw SQL strings.
        - Workers AI / Vercel AI SDK calls should handle rate-limit and
          upstream errors gracefully.

    # ── Database migrations ─────────────────────────────────────────────────
    - path: "packages/api/src/db/**"
      instructions: |
        - Migrations must be backward-compatible (old code must still run
          against the new schema during a rolling deploy).
        - New non-nullable columns must supply a DEFAULT or be added as
          nullable first.
        - Check for missing indexes on foreign key columns and on columns
          used in WHERE / ORDER BY clauses.
        - pgvector columns must declare 1536 dimensions (OpenAI embedding
          size).
        - Every table should have `created_at` and `updated_at` timestamps.

    # ── Mobile app (React Native / Expo) ────────────────────────────────────
    - path: "apps/expo/**"
      instructions: |
        - Follow the feature module structure:
          `features/{name}/{components,hooks,screens,types.ts,index.ts}`.
        - Use NativeWind (Tailwind) classes for styling — avoid `StyleSheet`
          objects for layout/color.
        - New feature flags must be added to `apps/expo/config.ts` and
          default to `false`.
        - Server state → TanStack React Query.
          Local/reactive state → Jotai or Legend State.
          Forms → TanStack React Form.
        - Animations must use React Native Reanimated 4 (not the Animated API).
        - Never call `fetch()` directly — use the typed API client.
        - Check for missing `useCallback`/`useMemo` on props passed to
          list-item components (FlatList / FlashList perf).

    # ── Guides web app (Next.js / Shadcn) ───────────────────────────────────
    - path: "apps/guides/**"
      instructions: |
        - Use Radix UI / Shadcn components for all new UI.
        - Data fetching via TanStack React Query; validate forms with Zod.
        - Prefer React Server Components for data-fetching pages; use Client
          Components only when interactivity is needed.
        - Check for missing `loading.tsx` / `error.tsx` in new route segments.

    # ── Landing site (Next.js / Framer Motion) ──────────────────────────────
    - path: "apps/landing/**"
      instructions: |
        - Animations must use Framer Motion.
        - Keep the bundle lean — avoid adding heavyweight dependencies.
        - Prefer static generation (`generateStaticParams`, `revalidate`) over
          SSR for marketing pages.

    # ── Tests ────────────────────────────────────────────────────────────────
    - path: "**/*.{test,spec}.{ts,tsx}"
      instructions: |
        - API unit tests must use the `@cloudflare/vitest-pool-workers` pool.
        - Tests must be deterministic — mock all external services and clocks.
        - Every new service or route handler should have corresponding tests.
        - Avoid testing implementation details; test observable behaviour.

    # ── GitHub Actions ────────────────────────────────────────────────────────
    - path: ".github/workflows/**"
      instructions: |
        - Pin third-party actions to a full commit SHA (not a mutable tag)
          to prevent supply-chain attacks.
        - Ensure no secrets are echoed or logged.
        - Use `concurrency` groups with `cancel-in-progress: true` to avoid
          redundant runs.
        - Prefer `bun install --frozen-lockfile` over bare `bun install` in CI.

    # ── Shared UI package ─────────────────────────────────────────────────────
    - path: "packages/ui/**"
      instructions: |
        - Exports must be compatible with both iOS and Android.
        - Avoid platform-specific code without a corresponding platform file
          (`.ios.ts` / `.android.ts`).

chat:
  auto_reply: true

knowledge_base:
  opt_out: false
  learnings:
    scope: auto
  issues:
    scope: auto
  pull_requests:
    scope: auto