From 2d5509b9342275e7437837f24ddf642cda8c1a3e Mon Sep 17 00:00:00 2001 From: Felipe Zipitria Date: Tue, 8 Sep 2026 11:53:45 -0300 Subject: [PATCH] Trim linked_repositories to 5, our plan's limit CodeRabbit was warning that 9 linked repositories exceeds the current plan's cap of 5, so only 5 were analyzed and 4 silently skipped. Keep the repos that back checks firing across the whole org (coreruleset, crs-toolchain, crs-linter, go-ftw, documentation) and drop the ones scoped to a narrower slice (ftw-tests-schema, plugin-registry, actions, renovate-config). --- .coderabbit.yaml | 26 -------------------------- AGENTS.md | 29 +++++++++++++++++------------ 2 files changed, 17 insertions(+), 38 deletions(-) diff --git a/.coderabbit.yaml b/.coderabbit.yaml index 9f1dace..81e5fb9 100644 --- a/.coderabbit.yaml +++ b/.coderabbit.yaml @@ -1460,13 +1460,6 @@ knowledge_base: `crs-plugin-test-action`, and by every plugin repo's tests. A change to flags, output format, or exit codes breaks those callers, so treat those as cross-repo breaking changes. - - repository: "coreruleset/ftw-tests-schema" - instructions: > - The authoritative YAML schema for go-ftw test files. Every file under - `tests/regression/tests/` in coreruleset and in the plugin repos must - conform to it. Use it to decide whether a field in a test file is - valid, required, or deprecated, rather than inferring the shape from - neighbouring tests. - repository: "coreruleset/crs-toolchain" instructions: > Compiles `regex-assembly/*.ra` sources into the `@rx` patterns in @@ -1486,25 +1479,6 @@ knowledge_base: before claiming a metadata issue will or will not fail CI, and note that a change to the linter itself can retroactively fail existing rules in coreruleset. - - repository: "coreruleset/plugin-registry" - instructions: > - The registry of official and third-party CRS plugins, including the - rule ID range reserved for each plugin. This is the authority for - whether a plugin rule sits in its own range or is squatting on a core - CRS range or another plugin's. A new plugin, or a plugin claiming a - new range, must be reflected here. - - repository: "coreruleset/actions" - instructions: > - Reusable CRS composite GitHub Actions shared across the org's - workflows. When reviewing a workflow change, check whether an inline - step reimplements something this repo already provides, and whether a - change here affects the workflows that call it. - - repository: "coreruleset/renovate-config" - instructions: > - The shared Renovate preset that every repo's `renovate.json` extends - via `github>coreruleset/renovate-config`. Consult it to see what the - preset already handles before suggesting repo-local `packageRules`, - and treat a change here as affecting dependency updates org-wide. # Renamed from coreruleset/coreruleset-documentation; GitHub redirects the # old name, but use the canonical one here. - repository: "coreruleset/documentation" diff --git a/AGENTS.md b/AGENTS.md index 6261cf7..30cacd9 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -96,15 +96,20 @@ PR conventions). Keep the two in sync when either changes. be reviewed. - `allow_non_org_members: true` and `enable_free_tier: true` are deliberate: CRS takes drive-by community contributions. -- **`linked_repositories` is capped at 20** and is selected by dependency edge, not by - relevance — a repo earns a slot when something can break across the boundary. The nine here: - `coreruleset` (rule IDs, approved tags, PL policy), `go-ftw` + `ftw-tests-schema` (test runner - and its YAML schema), `crs-toolchain` (`.ra` directive semantics), `crs-linter` (what actually - fails CI), `plugin-registry` (reserved plugin ID ranges), `actions`, `renovate-config`, - `documentation`. `documentation` carries the longest entry on purpose: it is the source of - truth for everything operators are told (configuration, PL guidance, exclusion recipes, - upgrade notes), so it outranks anything inferred from the rules when the question is what a - user is supposed to do — and it is the counterpart obligation for any user-visible change. - Note it was renamed from `coreruleset-documentation`; GitHub redirects, but the config uses - the canonical name. Deliberately excluded: `template-plugin` and `modsecurity-crs-docker` — - they consume the rule set but nothing breaks across the edge. +- **`linked_repositories` is capped at 5 by our CodeRabbit plan** (the schema itself allows up + to 20). The five kept, chosen for the checks that fire across the whole org rather than one + repo: `coreruleset` (rule IDs, approved tags, PL policy — everything else is downstream of + it), `crs-toolchain` (`.ra` directive semantics, backing the regex-assembly source-of-truth + check), `crs-linter` (what actually fails CI), `go-ftw` (the test runner every repo's tests + depend on), and `documentation` (the counterpart-obligation check: flag a PR that changes + documented behavior without a matching docs change). `documentation` carries the longest + entry on purpose: it is the source of truth for everything operators are told (configuration, + PL guidance, exclusion recipes, upgrade notes), so it outranks anything inferred from the + rules when the question is what a user is supposed to do. Note it was renamed from + `coreruleset-documentation`; GitHub redirects, but the config uses the canonical name. + Dropped to fit the cap: `ftw-tests-schema` (overlaps `go-ftw`), `plugin-registry` (only backs + the plugin ID-range check, scoped to plugin repos), `actions` and `renovate-config` (only + relevant to workflow/dependency-policy discussions). Revisit if plugin repos start seeing + frequent drive-by PRs — `plugin-registry` backs the one blocker-severity check among the four + that were cut. Deliberately excluded regardless of the cap: `template-plugin` and + `modsecurity-crs-docker` — they consume the rule set but nothing breaks across the edge.