CodeRabbit Multi-Environment Setup
Overview
Configure CodeRabbit review behavior based on branch targets and environments. CodeRabbit reads .coderabbit.yaml from the PR's base branch, allowing different review configurations per branch. This enables stricter reviews for production branches, relaxed reviews for development, and custom instructions per environment.
Prerequisites
- CodeRabbit GitHub App installed on repository
- Branch strategy defined (e.g., GitFlow, trunk-based, GitHub Flow)
.coderabbit.yaml committed to each relevant branch
How Branch-Based Config Works
Developer opens PR: feature/auth → develop
CodeRabbit reads: .coderabbit.yaml from develop branch
Profile: "chill" (development, quick iteration)
Developer opens PR: develop → main
CodeRabbit reads: .coderabbit.yaml from main branch
Profile: "assertive" (production, thorough review)
Developer opens PR: hotfix/fix → release/v2.1
CodeRabbit reads: .coderabbit.yaml from release/v2.1 branch
Profile: "assertive" + security-focused instructions
Instructions
Step 1: Configure Development Branch (Relaxed)
language: "en-US"
reviews:
profile: "chill"
request_changes_workflow: false
high_level_summary: true
sequence_diagrams: false
auto_review:
enabled: true
drafts: false
base_branches:
- develop
ignore_title_keywords:
- "WIP"
- "DO NOT MERGE"
- "experiment"
path_filters:
- "!**/*.lock"
- "!**/*.snap"
- "!dist/**"
- "!**/*.generated.*"
path_instructions:
- path: "**"
instructions: |
Development branch review:
- Only flag bugs, security issues, and obvious errors
- Do NOT comment on code style, naming, or formatting
- Do NOT suggest refactoring unless it fixes a bug
chat:
auto_reply: true
Step 2: Configure Production Branch (Strict)
language: "en-US"
reviews:
profile: "assertive"
request_changes_workflow: true
high_level_summary: true
high_level_summary_in_walkthrough: true
sequence_diagrams: true
review_status: true
auto_review:
enabled: true
drafts: false
base_branches:
- main
path_filters:
- "!**/*.lock"
- "!**/*.snap"
- "!dist/**"
- "!vendor/**"
path_instructions:
- path: "**"
instructions: |
Production review checklist:
1. Flag any hardcoded secrets, API keys, or credentials
2. Check error handling: no empty catch blocks, proper error propagation
3. Verify input validation on all API endpoints
4. Check for proper logging (structured, no PII)
- path: "src/api/**"
instructions: |
API review (production):
- Verify proper HTTP status codes
- Check auth middleware is applied to protected routes
- Validate request bodies with schema validation
- Ensure error responses follow RFC 7807 format
- Flag missing rate limiting
Step 3: Configure Release Branch (Security-Focused)
language: "en-US"
reviews:
profile: "assertive"
request_changes_workflow: true
auto_review:
enabled: true
drafts: false
base_branches:
- "release/*"
path_instructions:
- path: "**"
instructions: |
RELEASE BRANCH - Security and stability focus:
1. Flag ANY security vulnerability (priority over all other feedback)
2. Check for backward compatibility
3. Verify no debug code (console.log, debugger statements)
4. Ensure proper error messages (no stack traces exposed to users)
5. Check for feature flags guarding unreleased features
Only provide feedback on bugs and security. Skip style comments entirely.
- path: "src/auth/**"
instructions: |
CRITICAL PATH for release. Check:
- Token validation and expiry
- Session management security
- CSRF protection
- No auth bypass vulnerabilities
chat:
auto_reply: true
Step 4: Maintain Branch Configs with a Script
#!/bin/bash
set -euo pipefail
CURRENT_BRANCH=$(git branch --show-current)
git checkout develop 2>/dev/null || git checkout -b develop
cp configs/coderabbit-develop.yaml .coderabbit.yaml
git add .coderabbit.yaml
git diff --cached --quiet || git commit -m "chore: update CodeRabbit config for develop"
git checkout main
cp configs/coderabbit-main.yaml .coderabbit.yaml
git add .coderabbit.yaml
git diff --cached --quiet || git commit -m "chore: update CodeRabbit config for main"
git checkout "$CURRENT_BRANCH"
echo "CodeRabbit configs updated on develop and main"
echo "Push both branches to apply: git push origin develop main"
Step 5: Verify Per-Branch Configuration
# On a PR targeting develop:
@coderabbitai configuration
# Should show: profile: "chill", request_changes_workflow: false
# On a PR targeting main:
@coderabbitai configuration
# Should show: profile: "assertive", request_changes_workflow: true
# If both show the same config, the branch-specific .coderabbit.yaml
# is not committed to the base branch. Verify with:
# git show main:.coderabbit.yaml
# git show develop:.coderabbit.yaml
Step 6: Branch Protection per Environment
set -euo pipefail
OWNER="your-org"
REPO="your-repo"
gh api "repos/$OWNER/$REPO/branches/main/protection" \
--method PUT \
--field 'required_status_checks={"strict":true,"contexts":["coderabbitai"]}' \
--field 'required_pull_request_reviews={"required_approving_review_count":1}' \
--field 'enforce_admins=true' \
--field 'restrictions=null'
gh api "repos/$OWNER/$REPO/branches/develop/protection" \
--method PUT \
--field 'required_status_checks={"strict":false,"contexts":[]}' \
--field 'required_pull_request_reviews={"required_approving_review_count":0}' \
--field 'enforce_admins=false' \
--field 'restrictions=null'
echo "Branch protection configured"
echo " main: CodeRabbit required"
echo " develop: CodeRabbit optional"
Output
- Branch-specific
.coderabbit.yaml configs committed
- Development branch with relaxed review profile
- Production branch with strict review and security instructions
- Release branches with security-focused review
- Branch protection rules aligned with review policies
Error Handling
| Issue | Cause | Solution |
|---|
| Same review profile on all branches | Config only on one branch | Commit different .coderabbit.yaml to each base branch |
| Config changes not applied | YAML not on the base branch | Merge config changes to the target branch first |
| PR to main gets "chill" review | .coderabbit.yaml on main has wrong profile | Check config with git show main:.coderabbit.yaml |
| Release branch not reviewed | base_branches doesn't include release/* | Add glob pattern release/* to base_branches |
Resources
Next Steps
For deployment and org-wide rollout, see coderabbit-deploy-integration.
