From aa31594acf81a23b7549df27af179fd77a5d2edb Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 7 Aug 2026 21:15:10 +0000 Subject: [PATCH 1/2] fix(review): make the label-gate override actually bind (inheritance: false) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #1425 set `reviews.auto_review.labels: []` to clear an inherited required-labels gate that was deadlocking CodeRabbit auto-review against `auto_apply_labels: true`. The gate is still active. Evidence: PRs opened after #1425 landed on main still receive the CodeRabbit commit status "Review skipped: excluded by label configuration" — #1483 (21:02Z) and #1494 (21:10Z), both non-draft, both based on a main that already carried the empty list. That message can only be emitted by a label gate that is still evaluating, so the override was not taking effect. Cause: with `inheritance: true` the org/dashboard config layers underneath this file, and a key set to an empty collection reads as unset rather than as "override with nothing" — so the inherited list survived. `inheritance` is the only in-file lever over that, hence flipping it off. Note the failure mode this restores protection against: auto-label.yml labels a PR by changed path, but it is an Actions job and queues behind whatever else is running. CodeRabbit evaluates the gate on PR open. When the Actions queue is saturated the PR is still unlabelled at that moment, the gate skips it, and — per the comment already in this file — labelling afterwards does not retro-trigger a review. The PR is then silently never reviewed. Trade-off: settings this file leaves unset now fall back to the CodeRabbit schema default instead of the dashboard. The file already sets the review, tooling, labeling, chat, knowledge-base and issue-enrichment blocks explicitly, which is what its header claims it does. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_017yTj3erqg8xRb79v2djrmH --- .coderabbit.yaml | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/.coderabbit.yaml b/.coderabbit.yaml index 78e263ab8..ef7547059 100644 --- a/.coderabbit.yaml +++ b/.coderabbit.yaml @@ -4,17 +4,30 @@ # the CodeRabbit dashboard (inheritance, auto_assign_reviewers, finishing # touches, knowledge base, issue enrichment, presidio, auto-review label # gating) are version-controlled here so every change is reviewable in a PR. -# `inheritance: true` still lets the org-level config layer underneath this -# file — so any setting this file leaves unset can be silently overridden from -# the dashboard. Prefer setting a value explicitly, even at its default, when -# the default is the behaviour you actually want. +# +# Inheritance is OFF so that claim is actually true. With `inheritance: true` +# the org/dashboard config layers *underneath* this file, and a key set to an +# empty collection here does not read as "override the inherited value with +# nothing" — it reads as unset, and the inherited value survives. That is not +# hypothetical: #1425 set `reviews.auto_review.labels: []` to clear an +# inherited required-labels gate, and afterwards PRs were still landing +# "Review skipped: excluded by label configuration" (e.g. #1483, #1494) — a +# message that can only come from a label gate that is still active. Turning +# inheritance off is the only in-file lever that makes the empty list bind. +# +# Consequence: anything this file leaves unset now falls back to the CodeRabbit +# *schema* default, not to the dashboard. Set values explicitly — even at their +# default — when the default is the behaviour you actually want. language: en-US tone_instructions: >- Be assertive and direct. Focus on real bugs, security issues, and performance problems — not style nitpicks. Flag anything that could break in production. When you find an issue, explain why it matters and suggest a concrete fix. early_access: true -inheritance: true +# See the header: `true` lets the dashboard's required-labels gate outlive the +# `reviews.auto_review.labels: []` override below. Do not flip this back without +# first confirming the gate has been removed dashboard-side. +inheritance: false reviews: profile: assertive request_changes_workflow: true @@ -32,6 +45,8 @@ reviews: # No label gate. This is the schema default, set explicitly to override an # inherited required-labels list from the dashboard/org config, which was # deadlocking auto-review against `auto_apply_labels: true` below. + # This only takes effect because `inheritance: false` above — on its own + # (as shipped in #1425) the empty list read as unset and the gate survived. # # The inherited gate required at least one of ~26 labels before a review # would start — a set that includes `architecture-gap`, `ci-cd`, From 5b1739409d01dcc73192c962efd70fc456ed6658 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 7 Aug 2026 21:40:39 +0000 Subject: [PATCH 2/2] test(review): pin inheritance to false, with the reason MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI caught this: `test_inheritance_enabled` asserts `.coderabbit.yaml`'s `inheritance is True`, which aa31594 changed to false. 1 failed, 8069 passed — a real assertion, not a flake. The test was a snapshot of the values chosen when the CodeRabbit config was version-controlled; its docstring restated the setting rather than defending it. Changing the setting deliberately means the test changes with it, so this flips the assertion and renames it to match. The docstring now carries the reason instead of the restatement. The failure mode is invisible — flipping inheritance back to true does not fail anything, it just silently stops auto-review from ever starting — so the test is the only place that will tell someone why the value is what it is. Verified by replicating the file's config assertions directly; pytest is not installed in this sandbox, so CI is the real check. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_017yTj3erqg8xRb79v2djrmH --- tests/unit/test_coderabbit_config.py | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/tests/unit/test_coderabbit_config.py b/tests/unit/test_coderabbit_config.py index 6175e0c61..72e584f73 100644 --- a/tests/unit/test_coderabbit_config.py +++ b/tests/unit/test_coderabbit_config.py @@ -67,14 +67,27 @@ def test_config_parses_as_valid_yaml(): # --------------------------------------------------------------------------- -# inheritance (new field) +# inheritance # --------------------------------------------------------------------------- @pytest.mark.unit -def test_inheritance_enabled(config): - """inheritance: true lets the org-level config layer underneath this file.""" - assert config.get("inheritance") is True +def test_inheritance_disabled(config): + """inheritance must stay false, or the label gate silently comes back. + + This asserted ``is True`` until the setting was found to be the reason + auto-review never started. With inheritance on, the org/dashboard config + layers *underneath* this file, and a key set to an empty collection here + reads as unset rather than as an override — so #1425's + ``reviews.auto_review.labels: []`` did not clear the inherited + required-labels gate, and PRs kept landing "Review skipped: excluded by + label configuration". + + Flipping this back to true re-breaks auto-review repo-wide, and does it + silently: nothing fails, PRs simply stop being reviewed. Pair any change + here with the label-gate comment in ``.coderabbit.yaml``. + """ + assert config.get("inheritance") is False # ---------------------------------------------------------------------------