[mikepitre]

What & why

• This repo had no CI, and CodeRabbit only commented. A ruleset requiring a passing check and an approval needs both.
• .github/workflows/ci.yml runs npm ci (which builds the package), npm run typecheck, and npm test on Node 24 for every PR and every push to main. The job's check is Test.
• .coderabbit.yaml turns on CodeRabbit's approvals with the same settings as clerk-ios: it approves a PR it rates moderate risk or lower once its comments are resolved. It also skips package-lock.json.

Testing

• actionlint is clean. This PR's own run of Test shows whether the suite passes on a Linux runner.

Risk

• Low. CI reads code only, with contents: read and no secrets. Requiring the check and an approval is a separate ruleset change, made once Test has passed here.

How to revert

• A plain revert. Remove the ruleset first, or every PR waits on a check that no longer runs.

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The .coderabbit.yaml file adds schema metadata, inheritance, a package-lock.json exclusion, and auto-approval settings. The new GitHub Actions workflow runs on pull requests and pushes to main. Its test job uses Node.js 24 and runs dependency installation, type checking, and tests.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: Moderate · up to 1beca

The change adds CI and enables CodeRabbit approvals. Once the planned ruleset exists, dependency lockfile changes could be approved without review, which weakens supply-chain controls. Resolve or explicitly accept that before merging. Setting persist-credentials to false and silencing the test annotations are small cleanups.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts ### CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.