general: T8765: add central CodeRabbit baseline

3 files changed, 124 insertions, 0 deletions

diff --git a/.coderabbit.yaml b/.coderabbit.yaml
new file mode 100644
index 0000000..381046e
--- /dev/null
+++ b/.coderabbit.yaml
@@ -0,0 +1,90 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+inheritance: true
+language: en-US
+early_access: false
+tone_instructions: >
+  Concise, technical, no filler. Focus on correctness, security, performance,
+  maintainability. Cite file paths and line numbers.
+
+reviews:
+  profile: chill
+  request_changes_workflow: false
+  high_level_summary: true
+  high_level_summary_placeholder: "@coderabbitai summary"
+  auto_title_placeholder: "@coderabbitai"
+  review_status: true
+  poem: false
+  collapse_walkthrough: true
+  changed_files_summary: true
+  sequence_diagrams: false
+  assess_linked_issues: true
+  related_issues: true
+  related_prs: true
+  suggested_labels: false
+  auto_apply_labels: false
+  suggested_reviewers: false
+
+  auto_review:
+    enabled: true
+    auto_incremental_review: true
+    drafts: false
+    base_branches:
+      - current
+      - sagitta
+      - circinus
+      - equuleus
+      - crux
+    ignore_title_keywords:
+      - WIP
+      - DO NOT MERGE
+      - Bump
+
+  path_filters:
+    - "!**/*.lock"
+    - "!**/package-lock.json"
+    - "!**/yarn.lock"
+    - "!**/pnpm-lock.yaml"
+    - "!**/poetry.lock"
+    - "!**/uv.lock"
+    - "!**/Cargo.lock"
+    - "!**/dist/**"
+    - "!**/build/**"
+    - "!**/node_modules/**"
+    - "!**/__pycache__/**"
+    - "!**/*.pyc"
+    - "!**/*.egg-info/**"
+    - "!**/.venv/**"
+    - "!**/.tox/**"
+    - "!**/.pytest_cache/**"
+    - "!**/htmlcov/**"
+    - "!**/coverage/**"
+    - "!**/.worktrees/**"
+    - "!**/*.snap"
+    - "!**/.terraform/**"
+    - "!**/*.tfstate*"
+    - "!**/.terragrunt-cache/**"
+
+  finishing_touches:
+    docstrings:
+      enabled: true
+    unit_tests:
+      enabled: true
+
+  tools:
+    github-checks: { enabled: true, timeout_ms: 90000 }
+    gitleaks: { enabled: true }
+    semgrep: { enabled: true }
+    languagetool: { enabled: true, level: default, enabled_only: false }
+    markdownlint: { enabled: true }
+    yamllint: { enabled: true }
+    actionlint: { enabled: true }
+    ast-grep: { essential_rules: true }
+
+chat:
+  auto_reply: true
+
+knowledge_base:
+  opt_out: false
+  learnings: { scope: auto }
+  issues: { scope: auto }
+  pull_requests: { scope: auto }
diff --git a/CODEOWNERS b/CODEOWNERS
new file mode 100644
index 0000000..a423844
--- /dev/null
+++ b/CODEOWNERS
@@ -0,0 +1 @@
+* @vyos/maintainers
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..b91068b
--- /dev/null
+++ b/README.md
@@ -0,0 +1,33 @@
+# `vyos/coderabbit` — central CodeRabbit baseline
+
+This repository hosts the org-wide [CodeRabbit](https://www.coderabbit.ai/) configuration applied by default to every repository in `vyos/*` that does **not** carry its own `.coderabbit.yaml`.
+
+CodeRabbit's [central-configuration](https://docs.coderabbit.ai/configuration/central-configuration) feature looks up a repo named exactly `coderabbit` in each org and applies its `.coderabbit.yaml` as the default. This is that repo for `vyos/*`.
+
+## Inheritance (load-bearing)
+
+Both this baseline and every per-repo override pin `inheritance: true`. Without it, per-repo files **fully replace** the central. With it, CodeRabbit deep-merges per the [configuration-inheritance docs](https://docs.coderabbit.ai/configuration/configuration-inheritance):
+
+- objects: deep-merged
+- arrays: unioned
+- scalars: child wins
+
+## Per-repo override
+
+Add a `.coderabbit.yaml` at the root of the consuming repo. The file MUST start with:
+
+```yaml
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+inheritance: true
+```
+
+Restate only the keys you need to deviate; everything else inherits from this baseline.
+
+## Authority
+
+- Spec: [T8764](https://vyos.dev/T8764) (parent), [T8765](https://vyos.dev/T8765) (provisioning).
+- Source-of-truth content: parent spec doc referenced from T8764.
+
+## Rollback
+
+`git revert` the offending commit, or set the `.coderabbit.yaml` body to `{}`. Every inheriting repo falls back to CodeRabbit's hardcoded defaults on the next PR webhook.