From c9b21b28e2cebc4c9cbd80726e757df36309dea8 Mon Sep 17 00:00:00 2001
From: Erik Thorelli <ethorelli@gmail.com>
Date: Tue, 6 Oct 2026 14:32:03 -0700
Subject: [PATCH] chore(review): CodeRabbit gates outside contributors' pull
 requests (#16332)

---
 .coderabbit.config.ts | 35 ++++++++++++++++++++++++++++++++---
 1 file changed, 32 insertions(+), 3 deletions(-)

diff --git a/.coderabbit.config.ts b/.coderabbit.config.ts
index 9f7291f479cfdaa0c30c1d60dd722d97fce3d8e2..5a9505c702765b308116722f3e4ee4930836dd3c 100644
--- a/.coderabbit.config.ts
+++ b/.coderabbit.config.ts
@@ -1,14 +1,43 @@
-import { defineConfig } from "@coderabbitai/config";
+import { defineConfig, type CodeRabbitContext } from "@coderabbitai/config";
 
-export default defineConfig({
+const approvability = `Fail when a maintainer should read this pull request before CodeRabbit approves it, and name the rule and file. Fail if it:
+
+- Changes a product default: a setting's default value, or what users get without opting in. Making a feature do what it already promises is a bug fix, not a default change.
+- Adds or broadens a directive that disables or suppresses a lint, type-checker, LSP, or other static-analysis diagnostic, including file-level, line-level, and configuration-level overrides.
+- Adds a subsystem or user workflow, or is a large refactor across apps or packages.
+- Changes packages/contracts or persisted data in a way that existing clients or stored data might not accept.
+- Changes authentication, pairing, credentials, secrets, or remote connection trust.
+- Adds or changes an external side effect, such as acting on GitHub, publishing a release, or calling a webhook.
+- Adds, upgrades, or patches a dependency.
+- Changes CI or release configuration, agent or contributor instructions, or any review tool's configuration, including .github/, AGENTS.md, CONTRIBUTING.md, .agents/, and .coderabbit.config.ts.
+
+Otherwise pass. A focused bug fix, copy or layout fix, revert, or docs-only or test-only change passes unless a rule above applies. If you cannot decide, fail rather than report inconclusive. When failing, say that the pull request needs a maintainer's review.
+`;
+
+// Org members and collaborators merge their own pull requests. On anyone else's, CodeRabbit
+// requests changes until its comments are resolved and its checks pass, then approves.
+const UNGATED_AUTHORS = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
+const isGated = ({ pr }: CodeRabbitContext) => !UNGATED_AUTHORS.has(pr?.authorAssociation ?? "");
+
+export default defineConfig((ctx) => ({
   reviews: {
     high_level_summary: false,
     review_status: false,
+    request_changes_workflow: isGated(ctx),
+    allow_author_approval: !isGated(ctx),
     auto_review: {
       enabled: true,
     },
     pre_merge_checks: {
       docstrings: { mode: "off" },
+      override_requested_reviewers_only: isGated(ctx),
+      custom_checks: [
+        {
+          name: "Approvability",
+          mode: isGated(ctx) ? "error" : "off",
+          instructions: approvability,
+        },
+      ],
     },
     path_filters: [
       // Vendored read-only reference checkouts of upstream Effect and Alchemy
@@ -34,4 +63,4 @@ export default defineConfig({
       ],
     },
   },
-});
+}));
-- 
2.54.0