coderabbit-ci-integration View full skill →

Design a fail-closed merge policy that combines CodeRabbit review state with provider checks without inventing a CodeRabbit status-check name.

ReadGlobGrepWriteEdit

CodeRabbit CI Integration

Overview

Build a merge policy from observable provider state. CodeRabbit review state, GitHub Checks ingestion, and branch protection are separate contracts.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

reviews.request_changes_workflow controls whether CodeRabbit can submit a changes-requested review.
The GitHub Checks tool reads existing CI results; it does not prove CodeRabbit publishes a stable check name.
Branch rules must use check names observed in the target repository.
Emergency paths must retain independent tests, security checks, and audit evidence.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Inspect current branch rules, recent CodeRabbit reviews, and actual check-run names.

Choose whether review state is advisory or required, and list independent CI authorities.

Pilot the smallest YAML and branch-rule change without enabling enforcement.

Prove clean, failing, and rollback paths before enabling the policy.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require repository-owner approval before changing branch rules, request-changes behavior, or bypass procedures. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A merge-policy record, observed check inventory, reviewed patch, pilot evidence, and rollback procedure. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Han…

coderabbit-common-errors View full skill →

Triage missing, duplicate, noisy, or misconfigured reviews from observed pull-request and configuration evidence.

ReadGlobGrepWriteEdit

CodeRabbit Common Errors

Overview

Diagnose the first failing boundary instead of relying on fixed wait-time tables. Installation, feature-branch configuration, eligibility, limits, and service health require separate evidence.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

The reviewed .coderabbit.yaml comes from the feature branch under review.
The default branch is always included; base_branches adds other targets.
Draft, author, title, and label controls can exclude a pull request.
The YAML validator and @coderabbitai configuration are contract checks.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Capture provider, PR, author, draft state, target branch, labels, and last response.

Read and validate feature-branch YAML plus central or organization overrides.

Classify installation, eligibility, configuration, limit, command-state, or service failure.

Apply one reversible correction and compare the response with baseline.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require owner approval before changing installation scope, organization settings, or pull-request state. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A redacted timeline, resolved-config evidence, fault classification, smallest fix, and verification result. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handli…

coderabbit-core-workflow-a View full skill →

Run the primary CodeRabbit review loop from eligibility through finding disposition and verification.

ReadGlobGrepWriteEdit

CodeRabbit Pull Request Review

Overview

Operate one evidence-backed review cycle. Separate walkthroughs, inline findings, incremental review, full review, CI, and human merge ownership.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

Eligible pull requests are reviewed automatically unless configuration excludes them.
The walkthrough is separate from inline findings.
Incremental and full reviews are distinct commands.
CodeRabbit supplements rather than replaces required CI and human judgment.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Verify installation, eligibility, feature-branch config, and independent CI.

Group walkthrough and inline findings by severity, file, and evidence.

Resolve valid findings in bounded commits and explain declined findings.

Request the appropriate documented review and confirm closure before handoff.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require human approval before pushing fixes, dismissing security findings, requesting approval, or merging. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A finding ledger with evidence, dispositions, commits, residual risk, and merge recommendation. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

Condition	Response
Current contract is unclear…

coderabbit-core-workflow-b View full skill →

Tune review signal with current learnings, detected guideline files, path instructions, and measured feedback.

ReadGlobGrepWriteEdit

CodeRabbit Learnings and Guidelines

Overview

Improve relevance using supported knowledge layers. Avoid invented configuration keys and judge changes against labeled real findings.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

Learnings arise from natural-language interaction with review comments.
Code guidelines can be detected from files such as CLAUDE.md and AGENTS.md.
Path instructions guide review; path filters change scope.
Configuration precedence can change the effective result.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Sample accepted, rejected, and unresolved findings.

Separate organization guidance, repository rules, path instructions, and temporary feedback.

Draft one supported measurable tuning change and validate resolved config.

Pilot comparable PRs and retain only improvements that preserve risky-path coverage.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require owner approval before changing shared learnings, global overrides, or exclusions. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A labeled sample, hypothesis, supported change, comparison metrics, and rollback decision. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

Condition	Response
Current contract is unc…

coderabbit-cost-tuning View full skill →

Review plan, seat, limit, and pay-as-you-go usage from current billing evidence without hard-coded prices.

ReadGlobGrepWriteEdit

CodeRabbit Cost and Usage Review

Overview

Build an approval-ready cost decision from current dashboard and plan evidence. Prices, allowances, and entitlements are time-sensitive.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

The plans page is authoritative for current prices and hourly allowances.
Seats and administrative roles are separate controls.
The usage-based add-on can extend eligible PR and CLI reviews.
Mid-cycle changes can create prorated charges.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Capture plan, cadence, seats, add-on state, and usage for one period.

Separate unused seats, avoidable overage, repository scope, and capacity needs.

Model keep, right-size, and upgrade scenarios with dated prices.

Present savings, impact, owner, effective date, and rollback constraints.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Never buy credits, change plans, remove seats, or alter access without billing and organization-owner approval. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A dated baseline, scenario table, evidence links, recommendation, and approval record. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

Condition	Response
Current contract is unclear or docs disagree	Stop mutation, cite b…

coderabbit-data-handling View full skill →

Define code, cache, retention, export, and sensitive-path controls for a repository or organization.

ReadGlobGrepWriteEdit

CodeRabbit Data Handling

Overview

Map what CodeRabbit may read, retain, cache, and export before changing controls. Exclusions do not replace source-control secret prevention.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

Cached data is documented as never used for training and expiring within one week.
Cached data is encrypted except for open-source projects.
Organizations can disable cache or data retention.
Path filters change review surfaces, not Git history or provider access.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Classify repositories and paths by sensitivity and contractual requirements.

Record installation scope, filters, cache, retention, exports, and reports.

Design access minimization, secret prevention, exclusions, retention, and custody.

Pilot on synthetic data and confirm coverage and incident ownership.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require security and privacy approval before changing retention, exporting data, or expanding access. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A data-flow register, classification map, control matrix, patch, and residual-risk statement. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

Condition	Response
Current contract is unclear or docs di…

coderabbit-debug-bundle View full skill →

Assemble a minimal redacted diagnostic package for configuration, review, CLI, or provider failures.

ReadGlobGrepWriteEdit

CodeRabbit Debug Bundle

Overview

Collect only evidence needed to reproduce the failing boundary. Preserve timestamps and provenance while excluding code, credentials, private comments, and unrelated users.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

Feature-branch YAML, resolved config, eligibility, commands, and limit state are primary evidence.
CLI failures have separate auth and network contracts.
Provider permission state must be captured without tokens.
Service health is evidence, not a substitute for local checks.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Define symptom, time window, surface, expected behavior, and reproduction boundary.

Collect redacted IDs, config hash, eligibility fields, timestamps, and CI state.

Remove source, secrets, emails, tokens, payloads, and unrelated comments.

Reproduce once safely and list included and excluded evidence.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require owner approval before reading private PR content, audit data, or transmitting a bundle. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A redacted manifest, timeline, config hash, reproduction, classification, and support summary. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

Condition	Response
Curre…

coderabbit-deploy-integration View full skill →

Roll out CodeRabbit with staged installation, central configuration, ownership, evidence, and rollback.

ReadGlobGrepWriteEdit

CodeRabbit Organization Rollout

Overview

Treat rollout as controlled policy deployment. Central configuration, repository config, organization settings, and global overrides have distinct precedence.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

A dedicated coderabbit repository can provide central configuration.
CodeRabbit must be installed on that repository.
Repository files can override central config; global overrides apply last.
Provider permissions and features vary by platform and plan.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Inventory providers, repositories, owners, data classes, and current gates.

Choose a representative pilot with success, failure, and rollback criteria.

Install least scope and deploy defaults without hard enforcement.

Measure, train maintainers, and expand in reversible cohorts.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require organization-admin approval for installation, overrides, central config, and enforcement cohorts. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A rollout inventory, precedence map, pilot plan, owners, cohort schedule, and rollback runbook. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

Condition	Response
Current contract is unclear or …

coderabbit-enterprise-rbac View full skill →

Design and audit roles, seats, API access, and administrative separation for an enterprise organization.

ReadGlobGrepWriteEdit

CodeRabbit Enterprise RBAC

Overview

Use CodeRabbit native administrative roles instead of inferring all access from the Git provider. Map developer seats and administrative authority separately.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

Built-in roles are Admin, Member, and Billing Admin.
CodeRabbit roles are independent of Git roles after initial assignment.
Billing Admin does not consume a seat and cannot edit role matrices.
Enterprise custom roles expose granular permissions.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Inventory users, provider roles, CodeRabbit roles, seats, keys, and repo access.

Map job functions to least privilege across settings, billing, reports, API, and logs.

Find toxic combinations, stale admins, unused seats, and unmanaged keys.

Draft changes with partial-success handling, rollback, and recertification.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require an authorized CodeRabbit Admin and security owner before role, seat, default-role, or key changes. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

An access matrix, least-privilege target, exceptions, approved change set, and recertification schedule. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

Condition	Response
Current c…

coderabbit-hello-world View full skill →

Run a bounded first pull-request review with minimal supported configuration and explicit cleanup.

ReadGlobGrepWriteEdit

CodeRabbit First Review

Overview

Prove installation and review behavior with a synthetic reversible PR. Avoid production secrets, branch-rule changes, and timing promises.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

CodeRabbit works with defaults; YAML is optional customization.
Repository YAML belongs at root and is read from the feature branch.
Draft reviews are disabled by default.
Configuration and review commands expose or control review state.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Choose an approved test repository and verify installation scope.

Create one harmless feature-branch change and optional minimal schema-linked YAML.

Open a non-draft PR and observe walkthrough, findings, and CI.

Respond once, then close or merge under normal policy and clean up.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require owner approval before installation, a production-repository test PR, or merge. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A receipt with repository, branch, PR, config hash, review surfaces, CI, and cleanup. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

…

Condition	Response
Current contract is unclear or docs disagree	Stop mutation, cite both sources, and request owner resolution.

coderabbit-incident-runbook View full skill →

Coordinate a review outage, harmful-output wave, access incident, or merge-policy failure without silently bypassing safeguards.

ReadGlobGrepWriteEdit

CodeRabbit Incident Runbook

Overview

Contain impact while preserving independent security and CI. Separate provider health, service health, config, permissions, limits, and harmful output.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

CodeRabbit can fail independently from repository CI.
Limits and exclusions can resemble an outage.
Bypass authority belongs to repository governance.
Status evidence needs timestamps and local corroboration.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Declare scope, severity, owner, repositories, and exposure risk.

Freeze risky rollout changes and preserve independent controls.

Classify using health, installation, eligibility, config, limit, and provider evidence.

Restore, use an approved manual-review continuity path, or remain fail-closed.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Only documented repository authority may relax a CodeRabbit-related gate; unrelated controls remain required. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A timeline, impact, containment, continuity control, recovery proof, and follow-up actions. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

Condition	Response
Current contract is unclear or docs disagree	Stop mutation, cite both sourc…

coderabbit-install-auth View full skill →

Analyze and implement platform installation plus interactive or headless CLI authentication with least privilege.

ReadGlobGrepWriteEdit

CodeRabbit Installation and Authentication

Overview

Route setup through the provider-specific flow and separate web-app installation from CLI auth. Never solicit or print credentials.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

GitHub, GitLab, Azure DevOps, and Bitbucket use different authorization contracts.
Organization access may require admin approval and explicit repo scope.
Interactive and headless Agentic-key CLI auth are separate.
Headless keys belong in a secret store, not repository config.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Identify provider, hosting, owner, repositories, data class, plan, and surface.

Review permissions and choose the smallest installation scope.

Complete user-driven authorization or approved secret-store headless auth.

Verify one bounded review and record permissions and rotation owner.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require organization-admin approval for installation and security approval for headless keys. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

An installation decision, scope, permission inventory, auth method, verification, and rotation owner. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

Condition	Response
Current contract is unclear or docs…

coderabbit-local-dev-loop View full skill →

Operate CLI reviews inside an agentic coding loop with bounded diffs, current authentication, and fix verification.

ReadGlobGrepWriteEdit

CodeRabbit Local Review Loop

Overview

Use the native CLI before push and feed findings back into coding. Keep auth, scope, and spend visible.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

The CLI reviews local changes before commit.
coderabbit review --plain is the agent-friendly command.
Interactive and Agentic-key login are distinct.
CLI allowances and billing follow current plan contracts.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Confirm repo state, diff scope, auth mode, allowance, and excluded files.

Run a bounded plain review and capture findings without secrets.

Classify findings, fix approved items, and rerun changed scope.

Stop on repeats, scope expansion, auth errors, or usage limits.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require approval before credits, headless keys, wider review scope, or pushing. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A receipt with scope, mode, dispositions, changed files, rerun result, and risks. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

Condition	Response
Current contract is unclear or docs disagree	Stop mutation, cite both sources, and request owner resolution.
Required access or approval is missing	Pr…

coderabbit-migration-deep-dive View full skill →

Migrate from another review process through measured coexistence, control mapping, and reversible cohorts.

ReadGlobGrepWriteEdit

CodeRabbit Adoption Migration

Overview

Preserve every existing control until its replacement is proven. Translate outcomes and ownership instead of assuming one-to-one fields.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

CodeRabbit spans PR, CLI or IDE, tools, knowledge, and optional actions.
Configuration can be centralized and inherited.
Plan and provider support differ.
Existing human, CI, security, and compliance controls remain authoritative.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Inventory current tools, rules, checks, data controls, costs, metrics, and owners.

Map each control to supported capability, retained control, or gap.

Run coexistence in a representative pilot.

Approve cohorts only when coverage and rollback evidence pass.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require security, repository, and business owners before replacing a required control. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A control inventory, capability map, gaps, pilot comparison, cohorts, and decommission approvals. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

…

Condition	Response
Current contract is unclear or docs disagree	Stop mutation, cite both sources, and request owner resolution.

coderabbit-multi-env-setup View full skill →

Design behavior for default, development, release, and hotfix targets using supported auto-review controls.

ReadGlobGrepWriteEdit

CodeRabbit Branch and Environment Policy

Overview

Model environments as policy inputs, not separate deployments. Feature-branch YAML supplies config; auto-review controls target eligibility.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

Repository YAML is read from the feature branch.
The default target is always included when auto-review is enabled.
base_branches adds target branches with regex patterns.
Central, repo, organization, and global authorities have precedence.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Inventory branch patterns, risk, merge rules, and config authorities.

Define targets, drafts, labels, ignored authors, and path guidance.

Validate regexes and resolved feature-branch config on synthetic PRs.

Promote only after default, release, exclusion, and rollback cases pass.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require owner approval before auto-review scope, global override, or release enforcement changes. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A branch matrix, precedence map, patch, synthetic evidence, and rollback commit. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

Condition	Response
Current contract is unclear or docs disagree	Stop mutation, cite b…

coderabbit-observability View full skill →

Measure review adoption, latency, findings, usage, and outcomes from documented dashboards, exports, reports, or API data.

ReadGlobGrepWriteEdit

CodeRabbit Observability

Overview

Use documented metric definitions and preserve denominators. Avoid scraping bot comments as a substitute for authoritative reporting.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

Git-platform and IDE or CLI metrics have separate definitions.
The Usage dashboard explains events, limits, and the Review Log.
Data export supports offline analysis.
Authenticated metrics APIs depend on plan and permissions.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Define decision, population, provider, repositories, UTC window, and metrics.

Export with timestamps, filters, pagination, and exclusions.

Compute coverage, response, resolution, and usage with denominators.

Compare cohorts and publish thresholds only after baseline evidence.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require data-owner approval before user-level exports, scheduled reports, or API credentials. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A reproducible metric spec, source receipt, dataset summary, dashboard, anomalies, and actions. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

…

Condition	Response
Current contract is unclear or docs disagree	Stop mutation, cite both sources, and request owner resolution.

coderabbit-performance-tuning View full skill →

Improve review speed and signal using measured scope, config, cache, and review behavior without timing bands.

ReadGlobGrepWriteEdit

CodeRabbit Review Performance Tuning

Overview

Optimize operator-controlled inputs and measure effects. Separate service latency, provider delay, limits, diff size, paths, tools, and guidance.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

Path filters change scope; path instructions change guidance.
Incremental reviews can pause after configured reviewed commits.
Caching normally accelerates review but can be disabled.
Plan limits belong to the live plans contract.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Capture events, files, diff size, tools, cache, limits, findings, and timing.

Classify delay or noise by boundary.

Pilot one scope, filter, instruction, profile, or incremental-review change.

Compare equivalent samples and roll back hidden-risk regressions.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require security or code-owner approval before exclusions, tool disablement, or shared changes. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A baseline, hypothesis, patch, comparison, risk check, and keep-or-rollback decision. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

…

Condition	Response
Current contract is unclear or docs disagree	Stop mutation, cite both sources, and request owner resolution.

coderabbit-prod-checklist View full skill →

Make an evidence-backed go-live decision for installation, configuration, governance, security, continuity, and operations.

ReadGlobGrepWriteEdit

CodeRabbit Production Readiness

Overview

Turn a pilot into an explicit production decision. Each gate needs an owner, evidence, failure criterion, and rollback.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

Configuration may resolve from multiple authorities.
Provider permissions, roles, seats, and plans are distinct.
Review state must coexist with independent CI and security.
Retention, exports, keys, and support need owners.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Verify scope, ownership, permissions, config, plan, seats, roles, and data.

Exercise happy, skipped, invalid-config, limit, provider-failure, and rollback paths.

Confirm dashboards, incident ownership, continuity, and recertification.

Record GO, CONDITIONAL GO, or NO-GO with evidence.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Named repository, security, privacy, billing, and operations owners approve their own gates. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A readiness matrix, receipts, risks, continuity plan, rollback, and decision. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

Condition	Response
Current contract is unclear or docs disagree	Stop mutation, cite both sources, and request owner resolution.
…

coderabbit-rate-limits View full skill →

Analyze PR, IDE, and CLI limits using the current per-developer hourly contract and usage evidence.

ReadGlobGrepWriteEdit

CodeRabbit Review Rate Limits

Overview

Use current dashboard and responses instead of stale concurrency tables. Separate CodeRabbit allowances, file limits, credits, and provider API limits.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

The current plan table defines reviews per developer per hour and files per review.
Allowances refill under the documented model.
@coderabbitai rate limit reports PR quota without a review.
The usage-based add-on can continue eligible reviews with credits.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Capture user, org, plan, surface, time, response, Review Log, files, and allowance.

Classify allowance, file limit, credit state, provider limit, or service failure.

Reduce avoidable events or present a dated capacity decision.

Retry only after documented refill or approved change.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require billing approval before enabling usage billing or buying credits; never spam retries. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A limit record, classification, current contract, mitigation, spend impact, and verification. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

…

Condition	Response
Current contract is unclear or docs disagree

coderabbit-reference-architecture View full skill →

Design a governed deployment across provider, configuration, review, knowledge, tools, data, identity, and observability.

ReadGlobGrepWriteEdit

CodeRabbit Reference Architecture

Overview

Make authority and data flow explicit. Separate source, control planes, provider events, knowledge sources, and reporting.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

Repository YAML, central config, settings, and global overrides form precedence.
CodeRabbit can use guidelines, learnings, linked repos, MCP, and tools.
Provider support and auth differ.
Dashboards, exports, reports, and APIs are distinct.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Map organizations, providers, repos, trust zones, data, identities, plans, and gates.

Draw configuration resolution and review-event flows with ownership.

Select knowledge, tools, cache, retention, reporting, and continuity controls.

Validate happy, exclusion, provider-failure, secret, and rollback paths.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require architecture, security, privacy, repository, and platform owners before scope expansion. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A boundary diagram, authority matrix, data flows, controls, failure modes, and phased plan. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

Condition	Response
Current contract is unclear or docs disagree	Stop mutation, cite both…

coderabbit-sdk-patterns View full skill →

Build a least-privilege adapter for documented REST API operations without inventing endpoints or treating PR comments as an SDK.

ReadGlobGrepWriteEdit

CodeRabbit API Adapter Patterns

Overview

CodeRabbit documents REST APIs for organizations, metrics, learnings, users, roles, logs, and security. Implement only referenced operations.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

API auth uses the documented x-coderabbitai-api-key header.
Many endpoints require Enterprise, roles, permissions, and a suitable key.
Pagination, partial success, exports, and feature flags vary.
Reviewed docs do not identify a general official language SDK.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Select one operation and record plan, permission, key type, request, pagination, and response.

Build a thin typed adapter with injected URL and secret reference.

Implement only documented errors and preserve partial success.

Test fixtures, then one approved read-only request.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require Admin and security approval for keys; require separate approval for writes, roles, seats, or exports. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A contract record, adapter, redacted fixtures, pagination handling, live-read receipt, and rotation owner. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

Condition	Response
Current contract is unclear or…

coderabbit-security-basics View full skill →

Configure and audit security review capabilities as one layer in a defense-in-depth pull-request program.

ReadGlobGrepWriteEdit

CodeRabbit Security Controls

Overview

Use documented CodeRabbit Security and tools while retaining independent scanners and human review. AI findings cannot prove absence of vulnerabilities.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

CodeRabbit documents repo security scanning and security Change Stack views.
The tool catalog includes static, secret, dependency, and infrastructure analyzers.
CodeRabbit can ingest GitHub Checks.
SkillSpector scans agent skills and MCP configuration.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Classify threat model, sensitive paths, languages, builds, checks, and requirements.

Map risks to supported tools, guidance, external gates, or manual controls.

Configure supported layers and retain provider security checks.

Test safe seeded fixtures, record gaps, and define escalation.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require security approval before disabling tools, excluding sensitive paths, or accepting high-risk findings. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A threat-control matrix, patch, independent-gate inventory, fixture evidence, gaps, and escalation. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

Condition	Response
Current contract is unclear or docs di…

coderabbit-upgrade-migration View full skill →

Analyze and upgrade configuration, plan-enabled features, tools, or platform integration through schema validation and reversible rollout.

ReadGlobGrepWriteEdit

CodeRabbit Configuration Upgrade

Overview

Treat managed-SaaS upgrades as configuration and entitlement changes, not SDK versions. Revalidate docs because contracts evolve.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

The current schema URL is https://coderabbit.ai/integrations/schema.v2.json.
The configuration reference is generated from that schema.
The YAML validator checks proposed configuration.
Plan, provider, early-access, and self-hosted changes are separate.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Capture resolved config, schema validity, plan, provider, features, metrics, and rollback.

Identify added, removed, renamed, defaulted, or gated behavior.

Apply the smallest feature-branch change and test eligible and excluded cases.

Canary, compare evidence, then promote or revert.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require owners before plan, early-access, self-hosted, override, or production changes. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

A contract diff, validated patch, entitlement check, canary evidence, rollback, and record. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

Condition	Response
Current contract is unclear or docs disagree	Stop mutation, cite bot…

coderabbit-webhooks-events View full skill →

Build customer-owned automation around Git-provider events containing CodeRabbit reviews without claiming a separate CodeRabbit webhook contract.

ReadGlobGrepWriteEdit

CodeRabbit Review Event Automation

Overview

Use the Git provider as event authority for normal PR review automation. Reviewed CodeRabbit docs do not establish a general outgoing CodeRabbit webhook and secret.

Prerequisites

Identify the CodeRabbit organization, Git provider, repository, plan, and accountable owner.
Read references/official-docs.md and re-check any time-sensitive contract before execution.
Use synthetic or read-only evidence until the approval boundary is satisfied.
Preserve the repository's independent CI, security, and human-review requirements.

Current Contract

CodeRabbit uses walkthrough comments, inline comments, reviews, and commands.
Customer receivers validate the Git provider signature and delivery.
Bot identity, repo, PR, action, and event type require allowlists.
Slack or Discord automations are separate product surfaces.

Authentication

Treat Git-provider sessions, CodeRabbit web sessions, CLI credentials, and CodeRabbit API keys as separate credentials. Use only an already-approved session or secret-manager reference, never print a secret, and do not place credentials in .coderabbit.yaml, source files, logs, or deliverables.

Instructions

Define provider event, identity evidence, repositories, action, idempotency, and replay window.

Verify provider signature over raw body before parsing.

Normalize required fields and queue an idempotent event behind a policy gate.

Test valid, invalid, replay, wrong-identity, duplicate, and out-of-order fixtures.

Tool Discipline

Use Glob to locate candidate configuration and evidence files without widening scope.
Use Grep to find relevant fields, commands, identifiers, and stale claims.
Use Read to inspect the smallest required files and authoritative evidence.
Use Write only for a new approved local draft or evidence artifact.
Use Edit only for a bounded approved change whose rollback is known.
Do not use these file tools as a substitute for authenticated CodeRabbit or provider operations.

Approval Boundaries

Require security approval for webhook secrets and owner approval before any live mutation. Keep analysis and drafts local until approval is explicit, and record who approved the action and its scope.

Output

An event contract, trust boundary, validation, fixtures, dead-letter policy, and mutation gate. Include source dates, unknowns, and the exact boundary between observed fact and recommendation.

Error Handling

…

Condition	Response

coderabbit-pack

Installation

What It Does

Skills (24) plugin-local skills

CodeRabbit CI Integration

Overview

Prerequisites

Current Contract

Authentication

Instructions

Tool Discipline

Approval Boundaries

Output

Error Han…

CodeRabbit Common Errors

Overview

Prerequisites

Current Contract

Authentication

Instructions

Tool Discipline

Approval Boundaries

Output

Error Handli…

CodeRabbit Pull Request Review

Overview

Prerequisites

Current Contract

Authentication

Instructions

Tool Discipline

Approval Boundaries

Output

Error Handling

CodeRabbit Learnings and Guidelines

Overview

Prerequisites

Current Contract

Authentication

Instructions

Tool Discipline

Approval Boundaries

Output

Error Handling

CodeRabbit Cost and Usage Review

Overview

Prerequisites

Current Contract

Authentication

Instructions

Tool Discipline

Approval Boundaries

Output

Error Handling

CodeRabbit Data Handling

Overview

Prerequisites

Current Contract

Authentication

Instructions

Tool Discipline

Approval Boundaries

Output

Error Handling

CodeRabbit Debug Bundle

Overview

Prerequisites

Current Contract

Authentication

Instructions

Tool Discipline

Approval Boundaries

Output

Error Handling

CodeRabbit Organization Rollout

Overview

Prerequisites

Current Contract

Authentication

Instructions