fix: Move CodeRabbit tools config under reviews so linters run

[VedantMadane]

Summary

Move CodeRabbit tools config under reviews so linters run

Changes

• Nest tools (golangci-lint, gitleaks) under reviews — top-level tools key is unrecognized

Fixes #1298

Summary by CodeRabbit

• Chores
  • Enabled automated linting and secret-detection checks during code reviews.
  • Updated review tool configuration for improved code quality and security validation.

[openshift-ci]

Hi @VedantMadane. Thanks for your PR.

I'm waiting for a quay member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Warning

This pull request changes a CodeRabbit configuration file. Because it comes from a fork or its author is not a repository collaborator, reviews use only the configuration from the target branch. The proposed configuration will take effect after it is merged.

Note

.coderabbit.yaml has unrecognized properties

CodeRabbit is using all valid settings from your configuration. Unrecognized properties (listed below) have been ignored and may indicate typos or deprecated fields that can be removed.

⚠️ Parsing warnings (1)

Validation error: Unrecognized key: "tools"

⚙️ Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2c3622dc-ae3f-414f-ba8a-3803025bdb8f

📥 Commits

Reviewing files that changed from the base of the PR and between 691a3b4 and bcddb67.

📒 Files selected for processing (1)

• .coderabbit.yaml

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The CodeRabbit configuration now places golangci-lint and gitleaks under reviews.tools. The unrecognized top-level tools block is removed.

Changes

CodeRabbit tool configuration

Layer / File(s)	Summary
Configure recognized review tools .coderabbit.yaml	Enables golangci-lint and gitleaks under reviews.tools and removes the former top-level tools block.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to bcddb

This is a localized configuration change that moves linter settings under the recognized reviews section; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 8 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title describes the configuration change, but it does not start with a PROJQUAY Jira ticket reference or NO-ISSUE:.	Rename the title to start with the relevant ticket, for example "PROJQUAY-1298: move CodeRabbit tools config under reviews", or use "NO-ISSUE:" only if this is a non-functional change.

✅ Passed checks (8 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	The change moves the tools configuration under reviews, re-enables golangci-lint and gitleaks, and removes the unrecognized top-level tools key. These changes address the coding objectives in issue #1…
Out of Scope Changes check	✅ Passed	The changes are limited to .coderabbit.yaml and directly support the configuration correction described in issue #1298. No unrelated changes are present.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Crd Backward Compatibility	✅ Passed	PASS — The pull request changes only .coderabbit.yaml. The exact commit diff contains no files under apis/quay/v1/, so it introduces no CRD field, type, or ComponentKind enum changes. Regenerati…
No Weak Cryptographic Algorithms	✅ Passed	PASS: The pull request changes only .coderabbit.yaml. The added lines move golangci-lint and gitleaks under reviews.tools; they do not add MD5, SHA-1, DES, 3DES, RC4, `InsecureSkipVerify: true…
No Privileged Containers	✅ Passed	PASS: The pull request changes only .coderabbit.yaml. The diff adds and removes CodeRabbit tool configuration and introduces no privileged: true, hostPID: true, hostNetwork: true, `hostIPC: tr…
No Sensitive Data In Logs	✅ Passed	PASS: The pull request changes only .coderabbit.yaml. The diff moves existing golangci-lint and gitleaks configuration under reviews.tools; it adds no log.Info, log.Error, klog.*, or `fm…

Full details: Linked Issues check

Explanation

The change moves the tools configuration under reviews, re-enables golangci-lint and gitleaks, and removes the unrecognized top-level tools key. These changes address the coding objectives in issue #1298.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Crd Backward Compatibility

Explanation

PASS — The pull request changes only .coderabbit.yaml. The exact commit diff contains no files under apis/quay/v1/, so it introduces no CRD field, type, or ComponentKind enum changes. Regeneration is not required.

Full details: No Weak Cryptographic Algorithms

Explanation

PASS: The pull request changes only .coderabbit.yaml. The added lines move golangci-lint and gitleaks under reviews.tools; they do not add MD5, SHA-1, DES, 3DES, RC4, InsecureSkipVerify: true, or encryption code. The weak-crypto guidance already present elsewhere in the file is unchanged.

Full details: No Privileged Containers

Explanation

PASS: The pull request changes only .coderabbit.yaml. The diff adds and removes CodeRabbit tool configuration and introduces no privileged: true, hostPID: true, hostNetwork: true, hostIPC: true, or SYS_ADMIN setting in a container or Kubernetes manifest. The privilege terms in the file are unchanged review instructions, not manifest configuration.

Full details: No Sensitive Data In Logs

Explanation

PASS: The pull request changes only .coderabbit.yaml. The diff moves existing golangci-lint and gitleaks configuration under reviews.tools; it adds no log.Info, log.Error, klog.*, or fmt.Print* statements and exposes no sensitive values. The words secrets and credentials occur only in configuration comments.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 8:12 AM UTC · Completed 8:25 AM UTC

Commit: bcddb67 · View workflow run →

Runtime: claude · Model: sonnet → claude-sonnet-4-5@20250929 · Cost: $2.44

[fullsend-ai-retro]

Retrospective: PR #1315

PR: #1315 - "fix: Move CodeRabbit tools config under reviews so linters run"

Outcome: Closed without merge by maintainer jbpratt on 2026-08-25. The fix was superseded by PR #1316 which has proper title formatting.

What Happened

1. Manual contribution from fork: External contributor VedantMadane opened PR fix: Move CodeRabbit tools config under reviews so linters run #1315 from fork VedantMadane/quay-quay-operator to fix issue #1298 (a retro agent finding about misconfigured .coderabbit.yaml).

2. No review agent triggered: The fullsend dispatch run skipped review agent dispatch because the PR author lacked triage permissions. Fork PRs from external contributors without write access do not auto-trigger review agents—this is intentional security gating.

3. Title format violation: CodeRabbit flagged that the PR title violated project conventions requiring a PROJQUAY-####: or NO-ISSUE: prefix (documented in AGENTS.md and enforced by gitlint).

4. Superseded by duplicate: A second contributor (Ryntak94) opened PR #1316 ~1.5 hours later with the proper title format. Maintainer chose to close fix: Move CodeRabbit tools config under reviews so linters run #1315 in favor of the compliant PR.

Evidence for Existing Open Issues

This retro corroborates three existing issues in fullsend-ai/fullsend:

• #4374: Review agent doesn't trigger on fork PRs after ok-to-test approval. PR fix: Move CodeRabbit tools config under reviews so linters run #1315 received the needs-ok-to-test label but no review agent ran even after manual approval would be given. This retro confirms the gap persists.

• #3391 and #5364: Code/post-script should validate PR titles against repo gitlint regex. While fix: Move CodeRabbit tools config under reviews so linters run #1315 was a manual contribution (not code agent), this is the third attempt to fix issue fix .coderabbit.yaml: tools key is unrecognized, golangci-lint and gitleaks are silently disabled #1298, and previous attempts also violated title format rules—indicating recurring contributor confusion about the PROJQUAY/NO-ISSUE requirement.

Workflow Quality

• Security gating worked as intended: Fork PR from untrusted contributor correctly did not auto-trigger privileged workflows.
• Title validation gap visible: CodeRabbit flagged the title violation post-hoc, but the contributor had no pre-flight validation. Issue #3391/#5364 proposals would prevent this for agent-created PRs.
• No token waste: The retro agent is the only agent that ran—appropriate for a manually closed fork PR.

No New Proposals

All improvement opportunities identified in this retro are already tracked by open issues. No new proposals warranted.