.coderabbit.yaml

# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
language: en-US
tone_instructions: "Safe Rust wrapper for Windows token privilege/elevation checks. Keep unsafe Win32 FFI confined to ffi.rs with SAFETY comments. Favor Result-based APIs with TokenPrivilegeError and return UnsupportedPlatform on non-Windows."
early_access: true
enable_free_tier: true
reviews:
    profile: assertive
    request_changes_workflow: true
    high_level_summary: true
    high_level_summary_placeholder: "@coderabbitai summary"
    high_level_summary_in_walkthrough: true
    auto_title_placeholder: "@coderabbitai"
    auto_title_instructions: "Generate PR/MR titles following Conventional Commits format: type(scope): description. Use types: feat, fix, docs, style, refactor, perf, test, build, ci, chore. Preferred scopes: lib, api, error, elevation, privilege, privileges, ffi, safety, security, tests, docs, book, ci, deps, release. Keep descriptions concise and action-oriented, focusing on token-privilege behavior."
    review_status: true
    commit_status: true
    fail_commit_status: false
    collapse_walkthrough: true
    changed_files_summary: true
    sequence_diagrams: true
    estimate_code_review_effort: true
    assess_linked_issues: true
    related_issues: true
    related_prs: true
    suggested_labels: true
    auto_apply_labels: true
    suggested_reviewers: true
    auto_assign_reviewers: false
    in_progress_fortune: true
    poem: true
    labeling_instructions:
        - label: "bug"
          instructions: "Apply when changes fix incorrect privilege/elevation behavior, API regressions, or runtime errors."
        - label: "enhancement"
          instructions: "Apply when changes add or expand functionality such as new constants, API capabilities, diagnostics, or tooling improvements."
        - label: "documentation"
          instructions: "Apply when changes are primarily docs-focused (README, rustdoc, mdBook, contribution or security docs)."
        - label: "question"
          instructions: "Apply when the PR primarily clarifies behavior, design choices, or usage guidance."
        - label: "help wanted"
          instructions: "Apply when follow-up work is identified and extra contributor attention would be useful."
        - label: "priority:high"
          instructions: "Apply when changes affect safety boundaries (unsafe FFI invariants), security posture, or release-blocking CI behavior."
        - label: "priority:normal"
          instructions: "Apply for routine maintenance, refactors, and standard feature work not requiring elevated urgency."
    path_filters:
        - "src/**"
        - ".github/**"
        - "!.github/workflows/release.yml"
        - "*.md"
        - "*.toml"
        - "*.yaml"
        - "*.yml"
        - "*.json"
        - "*.sh"
        - "justfile"
        - "!target/**"
        - "!node_modules/**"
    path_instructions:
        - path: "src/lib.rs"
          instructions: "Focus on public API design and re-exports: is_elevated(), is_privilege_enabled(), has_privilege(), enumerate_privileges(), PrivilegeInfo, TokenPrivilegeError, and privilege constants. Ensure rustdoc clearly documents errors and platform behavior."
        - path: "src/error.rs"
          instructions: "Verify TokenPrivilegeError variants are precise, user-facing messages are clear, and UnsupportedPlatform remains available for non-Windows callers."
        - path: "src/elevation.rs"
          instructions: "Review elevation detection logic and token query behavior; ensure robust error propagation and deterministic behavior across repeated calls."
        - path: "src/privilege.rs"
          instructions: "Review named privilege lookup, status checks, and privilege enumeration for correctness, stable behavior, and clear mapping to PrivilegeInfo fields."
        - path: "src/ffi.rs"
          instructions: "All unsafe code must remain confined here. Require explicit SAFETY comments on each unsafe block, correct HANDLE ownership via RAII, and no leaked or invalid handles."
        - path: "src/**"
          instructions: "Prefer safe APIs outside ffi.rs. Validate error handling paths (no panics in library code) and maintain idiomatic Rust with explicit platform gating where needed."
        - path: "Cargo.toml"
          instructions: "Review dependency and lint configuration for this crate. Ensure windows crate usage is target-specific (cfg(windows)), thiserror is used consistently, and clippy/rust lints match project policy."
        - path: "justfile"
          instructions: "Review developer workflow tasks (fmt, clippy, nextest, coverage, security scan) for cross-platform consistency with CI expectations."
        - path: "tests/**"
          instructions: "Ensure integration tests verify Windows behavior where applicable and non-Windows UnsupportedPlatform behavior elsewhere."
        - path: "docs/**"
          instructions: "Ensure docs reflect token-privilege architecture, safety contract, and read-only security model for privilege/elevation querying."
    abort_on_close: true
    disable_cache: false
    auto_review:
        enabled: true
        auto_incremental_review: true
        ignore_title_keywords: ["WIP", "draft", "do not merge"]
        labels: []
        drafts: false
        base_branches: ["main"]
        ignore_usernames: []
    finishing_touches:
        docstrings:
            enabled: true
        unit_tests:
            enabled: true
    pre_merge_checks:
        docstrings:
            mode: warning
            threshold: 85
        title:
            mode: warning
            requirements: "Must follow Conventional Commits specification: type(scope): description. Types: feat, fix, docs, style, refactor, perf, test, build, ci, chore. Breaking changes indicated with ! in header or BREAKING CHANGE: in footer."
        description:
            mode: warning
        issue_assessment:
            mode: warning
        custom_checks:
            - name: "unsafe-audit"
              instructions: "Verify unsafe code is confined to src/ffi.rs (or platform-gated FFI modules only), each unsafe block has a clear SAFETY comment, and handle/pointer invariants are explicitly maintained."
            - name: "error-handling-check"
              instructions: "Verify public APIs return Result<_, TokenPrivilegeError>, preserve concrete source errors where relevant, and avoid panic-oriented patterns (unwrap/expect/panic) in library code."
            - name: "test-coverage-check"
              instructions: "Verify coverage for Windows and non-Windows paths, including UnsupportedPlatform stubs, invalid privilege names, and privilege enumeration/elevation consistency checks."
    tools:
        ast-grep:
            rule_dirs: []
            util_dirs: []
            essential_rules: true
            packages: []
        shellcheck:
            enabled: false
        ruff:
            enabled: false
        markdownlint:
            enabled: true
        github-checks:
            enabled: true
            timeout_ms: 120000
        languagetool:
            enabled: false
            enabled_rules: []
            disabled_rules: []
            enabled_categories: []
            disabled_categories: []
            enabled_only: false
            level: default
        biome:
            enabled: false
        hadolint:
            enabled: false
        swiftlint:
            enabled: false
        phpstan:
            enabled: false
            level: default
        phpmd:
            enabled: false
        phpcs:
            enabled: false
        golangci-lint:
            enabled: false
        yamllint:
            enabled: true
        gitleaks:
            enabled: true
        checkov:
            enabled: false
        detekt:
            enabled: false
        eslint:
            enabled: false
        flake8:
            enabled: false
        rubocop:
            enabled: false
        buf:
            enabled: false
        regal:
            enabled: false
        actionlint:
            enabled: true
        pmd:
            enabled: false
        cppcheck:
            enabled: false
        semgrep:
            enabled: false
        circleci:
            enabled: false
        clippy:
            enabled: true
        sqlfluff:
            enabled: false
        prismaLint:
            enabled: false
        pylint:
            enabled: false
        oxc:
            enabled: false
        shopifyThemeCheck:
            enabled: false
        luacheck:
            enabled: false
        brakeman:
            enabled: false
        dotenvLint:
            enabled: false
        htmlhint:
            enabled: false
        checkmake:
            enabled: false
        osvScanner:
            enabled: true
chat:
    art: false
    auto_reply: true
    integrations:
        jira:
            usage: auto
        linear:
            usage: auto
knowledge_base:
    opt_out: false
    web_search:
        enabled: true
    code_guidelines:
        enabled: true
        filePatterns: []
    learnings:
        scope: auto
    issues:
        scope: local
    jira:
        usage: auto
        project_keys: []
    linear:
        usage: auto
        team_keys: []
    pull_requests:
        scope: local
    mcp:
        usage: enabled
        disabled_servers: []
code_generation:
    docstrings:
        language: en-US
        path_instructions:
            - path: "src/lib.rs"
              instructions: "Generate comprehensive rustdoc for the public API with examples for is_elevated() and privilege checks, explicit error semantics, and platform behavior notes."
            - path: "src/**/*.rs"
              instructions: "Document all public items with rustdoc and include Windows/non-Windows behavior expectations. For internal FFI docs, include safety invariants without exposing unsafe details in public API docs."
    unit_tests:
        path_instructions:
            - path: "src/lib.rs"
              instructions: "Generate tests for top-level API behavior, especially UnsupportedPlatform stubs on non-Windows and stable Result semantics."
            - path: "src/**/*.rs"
              instructions: "Test error handling paths, invalid privilege-name behavior, Windows-gated privilege/elevation checks, and enumeration output expectations. Ensure no panics in library behavior."
issue_enrichment:
    auto_enrich:
        enabled: true
    planning:
        enabled: false
    labeling:
        labeling_instructions:
            - label: "bug"
              instructions: "Apply when the issue reports incorrect privilege/elevation behavior, unexpected errors, panics, or API contract regressions"
            - label: "enhancement"
              instructions: "Apply when the issue requests new privilege constants, API additions, improved diagnostics, or workflow/tooling improvements"
            - label: "documentation"
              instructions: "Apply when the issue is about rustdoc, README, mdBook pages, AGENTS.md, or other documentation"
            - label: "priority:high"
              instructions: "Apply when the issue involves unsafe FFI soundness, handle lifetimes, pointer/ABI assumptions, security risk, or release-blocking failures"
            - label: "question"
              instructions: "Apply when the issue asks about usage, Windows token semantics, platform support, or integration in downstream crates with forbid(unsafe_code)"
        auto_apply_labels: true