.coderabbit.yaml

# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
# https://docs.coderabbit.ai/getting-started/configure-coderabbit

# CodeRabbit Configuration
# Optimized for Java 25 (LTS) / Spring Boot 4 RESTful Web Service project

language: en-US
early_access: true

reviews:
  profile: chill
  request_changes_workflow: false
  high_level_summary: true
  high_level_summary_placeholder: "@coderabbitai summary"
  review_status: true
  commit_status: true
  fail_commit_status: false
  collapse_walkthrough: false
  changed_files_summary: true
  sequence_diagrams: true
  estimate_code_review_effort: true
  assess_linked_issues: true
  related_issues: true
  related_prs: true
  suggested_labels: true
  auto_apply_labels: false
  suggested_reviewers: false
  poem: false
  abort_on_close: true

  path_instructions:
    - path: "src/main/java/**/*.java"
      instructions: |
        - Follow Java naming conventions (PascalCase for classes, camelCase for methods/variables)
        - Use Lombok annotations to reduce boilerplate (@Data, @RequiredArgsConstructor, etc.)
        - Verify modern Java 25 features are used where beneficial
        - Check proper dependency injection (constructor injection preferred)
        - Ensure async operations use proper Spring async patterns
        - Validate proper exception handling

    - path: "src/main/java/**/controllers/**/*.java"
      instructions: |
        - Controllers should be thin - delegate to services
        - Verify @RestController and proper mapping annotations
        - Check OpenAPI annotations (@Operation, @ApiResponses)
        - Ensure proper HTTP status codes (200, 201, 204, 400, 404, 409)
        - Validate request/response use DTOs, not entities
        - Check that @Valid is used for request validation

    - path: "src/main/java/**/services/**/*.java"
      instructions: |
        - Services should contain business logic
        - Verify @Service annotation and proper DI
        - Check Spring Cache annotations (@Cacheable, @CachePut, @CacheEvict)
        - Ensure proper use of ModelMapper for entity-DTO conversion
        - Validate proper error handling and logging
        - Check async operations if used

    - path: "src/main/java/**/repositories/**/*.java"
      instructions: |
        - Repositories should extend CrudRepository or JpaRepository
        - Verify @Repository annotation is present
        - Check custom query methods follow Spring Data naming conventions
        - Ensure proper return types (Optional, List, etc.)
        - Validate that queries are optimized

    - path: "src/main/java/**/models/**/*.java"
      instructions: |
        - Separate entities (@Entity) from DTOs
        - Verify proper Lombok annotations
        - Check JPA annotations for entities (@Table, @Column, @Id, etc.)
        - Ensure validation annotations on DTOs (@NotBlank, @Past, @Positive, @URL)
        - Validate proper use of IsoDateConverter for SQLite (ISO-8601 TEXT format)

    - path: "src/main/java/**/Application.java"
      instructions: |
        - Verify @SpringBootApplication annotation
        - Check main method follows standard Spring Boot pattern
        - Ensure proper component scanning configuration

    - path: "src/test/java/**/*Tests.java"
      instructions: |
        - Test classes should use JUnit 5 (Jupiter)
        - Verify proper Spring test annotations (@WebMvcTest, @DataJpaTest, etc.)
        - Check use of @MockitoBean (Spring Boot 4.0 style)
        - Ensure test naming follows givenX_whenY_thenZ BDD pattern
        - Validate BDD semantics in JavaDoc comments (Given/When/Then)
        - Validate use of AssertJ for fluent assertions
        - Check @DisplayName for readable test descriptions
        - Ensure @AutoConfigureCache when testing cached operations
        - Verify test data uses fake factories (PlayerFakes, PlayerDTOFakes)

    - path: "src/test/java/**/PlayerFakes.java"
      instructions: |
        - Verify test data factory pattern
        - Check consistency of test data generation
        - Ensure variety of test data for edge cases

    - path: "src/main/resources/application.properties"
      instructions: |
        - Verify no sensitive data is committed
        - Check SQLite database configuration
        - Ensure proper JPA/Hibernate settings (ddl-auto=none for seeded DB)
        - Validate server port configuration (9000, 9001 for actuator)
        - Check logging configuration references logback-spring.xml

    - path: "src/test/resources/application.properties"
      instructions: |
        - Verify H2 in-memory database for tests
        - Check test-specific configurations
        - Ensure proper test isolation settings

    - path: "src/main/resources/logback-spring.xml"
      instructions: |
        - Verify proper logging configuration
        - Check file and console appenders
        - Ensure appropriate log levels

    - path: "pom.xml"
      instructions: |
        - Verify Spring Boot version is 4.0.0
        - Check Java version is 25 in maven.compiler properties
        - Ensure dependencies are up to date
        - Validate JaCoCo plugin configuration excludes appropriate paths
        - Check that Lombok is configured with annotation processor path
        - Verify SQLite and Hibernate Community Dialects are present

    - path: "**/Dockerfile"
      instructions: |
        - Verify multi-stage build with Eclipse Temurin Alpine images
        - Check Java 25 runtime is used
        - Ensure non-root user for security
        - Validate HEALTHCHECK instruction using Actuator endpoint
        - Check database seed copy pattern (hold → storage)

    - path: "scripts/entrypoint.sh"
      instructions: |
        - Verify database seed copy logic on first run
        - Check proper file existence checks
        - Ensure proper error handling

    - path: "**/*.sh"
      instructions: |
        - Verify shell script best practices
        - Check proper shebang and error handling
        - Ensure proper permissions handling

  path_filters:
    - "!**/target/**"
    - "!**/storage/**"
    - "!**/*.db"
    - "!**/*.db-shm"
    - "!**/*.db-wal"
    - "!**/.mvn/**"
    - "!**/mvnw"
    - "!**/mvnw.cmd"

  auto_review:
    enabled: true
    auto_incremental_review: true
    ignore_title_keywords:
      - "WIP"
      - "DO NOT REVIEW"
    drafts: false
    base_branches:
      - master
      - main

  finishing_touches:
    docstrings:
      enabled: true
    unit_tests:
      enabled: true
    custom:
      - name: "sync documentation"
        instructions: |
          This is a PoC/learning project targeting developers unfamiliar with the stack.
          Documentation is a first-class concern. Review the PR changes and perform the
          following three checks:

          ## 1. Method/function docstrings
          For every public function, method, or handler touched in the PR:
          - If it lacks a docstring/doc comment, add one using the idiomatic format
            for the language and framework in use.
          - If it has one but no longer matches the current signature, parameters,
            or behavior, update it.
          - Docstrings should explain *why* and *what*, not just restate the signature.
            Assume the reader is learning the language.

          ## 2. README.md
          Check whether the PR introduces or removes endpoints, changes behavior,
          adds dependencies, or modifies how to run the project.
          If so, update the relevant sections of README.md to reflect the current state.
          Do not rewrite sections unrelated to the changes.

          ## 3. .github/copilot-instructions.md
          If the PR introduces patterns, conventions, or architectural decisions that
          should guide future AI-assisted contributions, add or update the relevant
          instructions in .github/copilot-instructions.md.
          Focus on things a developer (or AI assistant) unfamiliar with this specific
          stack implementation should know before writing code here.

      - name: "enforce http error handling"
        instructions: |
          Audit all HTTP handler functions in the changed files.
          Ensure errors return appropriate HTTP status codes (400 for bad input,
          404 for not found, 500 for unexpected errors) and a consistent JSON error
          body with at least a "message" field.
          Flag handlers that return 200 on error or swallow errors silently.
          Use idiomatic error handling patterns for the language and framework in use.

      - name: "idiomatic review"
        instructions: |
          Review the changed files for non-idiomatic patterns given the language and
          framework in use. Flag code that looks like it was translated from another
          language rather than written naturally for this stack. Suggest idiomatic
          alternatives with brief explanations. This is a PoC comparison project,
          so idiomatic usage is a first-class concern.

      - name: "verify api contract"
        instructions: |
          Review the changed files and verify that all HTTP endpoints (method, path,
          request body shape, and response shape) match the project's intended REST API
          contract. Check the README or any spec/contract file in the repo for reference.
          Flag any deviations — missing fields, wrong status codes, inconsistent naming.
          Do not make changes; only report findings as a comment.

  pre_merge_checks:
    docstrings:
      mode: warning
      threshold: 80
    title:
      mode: warning
      requirements: |
        - Use Conventional Commits format (feat:, fix:, chore:, docs:, test:, refactor:)
        - Keep under 80 characters
        - Be descriptive and specific
    description:
      mode: off
    issue_assessment:
      mode: off

  tools:
    # Secret scanners
    gitleaks:
      enabled: true
    trufflehog:
      enabled: true

    # IaC / infrastructure
    checkov:
      enabled: true
    trivy:
      enabled: true
    hadolint:
      enabled: true

    # General static analysis
    semgrep:
      enabled: true
    opengrep:
      enabled: true
    pmd:
      enabled: true
    shellcheck:
      enabled: true

    # File-type linters
    yamllint:
      enabled: true
    actionlint:
      enabled: true
    markdownlint:
      enabled: true
    dotenvLint:
      enabled: true
    checkmake:
      enabled: true
    osvScanner:
      enabled: true
    github-checks:
      enabled: true
      timeout_ms: 120000

    # Disable irrelevant tools for this Java project
    ruff:
      enabled: false
    biome:
      enabled: false
    swiftlint:
      enabled: false
    phpstan:
      enabled: false
    phpmd:
      enabled: false
    phpcs:
      enabled: false
    golangci-lint:
      enabled: false
    detekt:
      enabled: false
    eslint:
      enabled: false
    flake8:
      enabled: false
    rubocop:
      enabled: false
    buf:
      enabled: false
    regal:
      enabled: false
    clang:
      enabled: false
    cppcheck:
      enabled: false
    clippy:
      enabled: false
    sqlfluff:
      enabled: false
    prismaLint:
      enabled: false
    pylint:
      enabled: false
    oxc:
      enabled: false
    shopifyThemeCheck:
      enabled: false
    luacheck:
      enabled: false
    brakeman:
      enabled: false
    htmlhint:
      enabled: false
    languagetool:
      enabled: false
    circleci:
      enabled: false
    fortitudeLint:
      enabled: false
    stylelint:
      enabled: false
    blinter:
      enabled: false
    psscriptanalyzer:
      enabled: false

chat:
  art: true
  auto_reply: true

knowledge_base:
  opt_out: false
  web_search:
    enabled: true
  code_guidelines:
    enabled: true
    filePatterns:
      - ".github/copilot-instructions.md"
  learnings:
    scope: auto
  issues:
    scope: auto
  pull_requests:
    scope: auto
  mcp:
    usage: auto

code_generation:
  docstrings:
    language: en-US
    path_instructions:
      - path: "src/main/java/**/*.java"
        instructions: |
          - Use Javadoc comments for public APIs
          - Include @param, @return, @throws tags
          - Add OpenAPI annotations for controllers (@Operation, @ApiResponses)
          - Keep documentation concise and meaningful
          - Document Lombok-reduced boilerplate when needed for clarity
  unit_tests:
    path_instructions:
      - path: "src/test/java/**/*Tests.java"
        instructions: |
          - Use JUnit 5 (Jupiter) framework
          - Follow given_when_then naming for test methods
          - Use @DisplayName for readable descriptions
          - Use @MockitoBean for Spring beans (Spring Boot 4.0 style)
          - Use AssertJ for fluent assertions
          - Include @AutoConfigureCache for slice tests with caching
          - Use test data factories for consistent test data
          - Target 85% coverage (exclude Application.java and models)

issue_enrichment:
  auto_enrich:
    enabled: true
  planning:
    enabled: true
    auto_planning:
      enabled: true
      labels:
        - planning
  labeling:
    labeling_instructions: []
    auto_apply_labels: false