chore: CodeRabbit triage for v0.2.3

[github-actions]

CodeRabbit Triage: v0.2.3

Metric	Value	Δ vs Previous
PRs analyzed	8	-22 ↓
Critical issues	18	-5 ↓
Major issues	58	-62 ↓
Issues per PR	9.5	+4.7 ↑
Coverage gaps	67	-58 ↓

Trend

Release	Date	PRs	Critical	Major	Per PR	Gaps
v0.2.0	2026-04-10	30	23	120	4.8	125
v0.2.3	2026-04-22	8	18	58	9.5	67

Top Uncovered Patterns

1. Critical: InboxMessageAPI endpoints use /projects routes instead of inbox-message-specific paths. (3 occurrences, impact: 12) — sdk
2. Add resource limits and pin DB image to immutable digest. (3 occurrences, impact: 10) — manifests
3. Paginate both project and per-project session fetches. (2 occurrences, impact: 7) — cli, other
4. Reject all mixed auth-field combinations, not just httpToken + gitcookiesContent. (2 occurrences, impact: 6) — backend
5. Thread the request-scoped K8s client into these Secret helpers. (2 occurrences, impact: 6) — backend
6. Add NOT NULL constraint to owner_user_id column in migration. (1 occurrences, impact: 4) — api-server
7. Add explicit timeout to all Gerrit proxy fetch calls (1 occurrences, impact: 4) — frontend
8. Fix Gerrit response-shape parsing (currently breaks instance extraction) (1 occurrences, impact: 4) — runner
9. Do not keep stale Gerrit config after fetch failures (1 occurrences, impact: 4) — runner
10. Serialize credential refresh/cleanup across concurrent runs. (1 occurrences, impact: 4) — runner

Recommended Guardrails

CLAUDE.md Conventions

• Critical: InboxMessageAPI endpoints use /projects routes instead of inbox-message-specific paths.: Enforce via convention (needs specific rule)
• Add resource limits and pin DB image to immutable digest.: Enforce via convention (needs specific rule)
• Paginate both project and per-project session fetches.: Enforce via convention (needs specific rule)
• Reject all mixed auth-field combinations, not just httpToken + gitcookiesContent.: Enforce via convention (needs specific rule)
• Thread the request-scoped K8s client into these Secret helpers.: Enforce via convention (needs specific rule)
• Add NOT NULL constraint to owner_user_id column in migration.: Enforce via convention (needs specific rule)
• Add explicit timeout to all Gerrit proxy fetch calls: Enforce via convention (needs specific rule)
• Fix Gerrit response-shape parsing (currently breaks instance extraction): Enforce via convention (needs specific rule)
• Do not keep stale Gerrit config after fetch failures: Enforce via convention (needs specific rule)
• Serialize credential refresh/cleanup across concurrent runs.: Enforce via convention (needs specific rule)

Hookify Rules

• PreToolUse hook for critical: inboxmessageapi endpoints use /projects routes instead of inbox-message-specific paths. enforcement in TypeScript code
• PreToolUse hook for add resource limits and pin db image to immutable digest. enforcement in TypeScript code
• PreToolUse hook for paginate both project and per-project session fetches. enforcement in TypeScript code
• PreToolUse hook for reject all mixed auth-field combinations, not just httptoken + gitcookiescontent. enforcement in Go code
• PreToolUse hook for thread the request-scoped k8s client into these secret helpers. enforcement in Go code
• PreToolUse hook for add not null constraint to owner_user_id column in migration. enforcement in TypeScript code
• PreToolUse hook for add explicit timeout to all gerrit proxy fetch calls enforcement in TypeScript code
• PreToolUse hook for fix gerrit response-shape parsing (currently breaks instance extraction) enforcement in Python code
• PreToolUse hook for do not keep stale gerrit config after fetch failures enforcement in Python code
• PreToolUse hook for serialize credential refresh/cleanup across concurrent runs. enforcement in Python code

[netlify]

✅ Deploy Preview for cheerful-kitten-f556a0 canceled.

Name	Link
🔨 Latest commit	bdadeb0
🔍 Latest deploy log	https://app.netlify.com/projects/cheerful-kitten-f556a0/deploys/69e97701baaae70008d1a191