fix: correct inert CodeRabbit keys (osv-scanner -> osvScanner, github_checks -> github-checks)

[yakimoto]

The config read as an enabled security scanner and gated nothing

.coderabbit.yaml has carried this since the file was written:

reviews:
  tools:
    osv-scanner:
      enabled: true

osv-scanner is not a key in CodeRabbit's v2 schema. The schema's tools object does not set additionalProperties: false, so the misspelling was accepted silently — no warning, no error, and no OSV dependency scanning has ever run in this repo.

Grounded against the live schema rather than from memory (storage.googleapis.com/coderabbit_public_assets/schema.v2.json, fetched 2026-08-06):

	in schema
osvScanner	✅ present
osv-scanner	❌ absent
tools.additionalProperties	unset → unknown keys silently accepted

Before / after

• Before: OSV scanning off. 0 OSV findings, because the tool never ran.
• After: OSV scanning on. CodeRabbit's review of this PR is the receipt — whatever it reports is a pre-existing exposure that was simply never being surfaced.

This turns a security scanner on. New dependency-vulnerability findings are the expected outcome, not a regression.

Second rename in this diff: github_checks -> github-checks

Same inert-key class, same file. The schema key is hyphenated github-checks; the underscore spelling was silently accepted and ignored, so the GitHub Checks integration ran on its 90 s default timeout_ms, not the 900000 ms configured here. With the key now parsed, CodeRabbit will wait up to 15 minutes for checks to conclude, which is a real change in review latency and the intended behavior of the original config.

Confirmed against the live v2 schema (fetched 2026-08-07): reviews.tools.github-checks.timeout_ms has maximum: 900000, so the configured value sits exactly at the allowed max and is not rejected once the key is parsed.

How it was found

The RF.P6 fleet census (wave-av/claude-workstation#1995) classifies a vendor surface as inert when it carries a key the vendor's schema silently drops — the difference between config that reads like a control and config that is one. 12 live repos carry this same misspelling. Each ships as its own PR so the before/after count is attributable per repo rather than averaged across a fleet-wide sweep.

Refs wave-av/claude-workstation#1083

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

---

---

Note

Medium Risk
Turns on OSV scanning and changes GitHub Checks wait behavior during CodeRabbit reviews; may add new security findings and longer review waits, but does not alter runtime application code.

Overview
Fixes silent no-op CodeRabbit reviews.tools entries in .coderabbit.yaml by renaming keys to match the live v2 schema.

osv-scanner → osvScanner — dependency OSV scanning was never running despite enabled: true. After merge, reviews should surface dependency vulnerabilities that were previously invisible.

github_checks → github-checks — the configured 900000ms wait for GitHub Checks was ignored; integration fell back to the 90s default.

Inline comments document the schema verification (#1083). No application code changes — only review-time scanner behavior changes.

^{Reviewed by Cursor Bugbot for commit 2daab70. Configure here.}

Note

Fix tool key names in .coderabbit.yaml to activate OSV scanning and GitHub Checks

• Renames osv-scanner to osvScanner in .coderabbit.yaml so the OSV scanner tool key matches the schema and scanning actually runs.
• Renames github_checks to github-checks so the 900000ms timeout and enabled state are correctly applied.
• Behavioral Change: both tools were previously inert due to incorrect key names; they will now execute on each scan.

^{Macroscope summarized 2daab70.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_4a1b7f4c-54d1-4164-a15f-0c31f16a9eb0)

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 46 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9dcc6c8a-4f42-4a04-8872-215079d486f9

📥 Commits

Reviewing files that changed from the base of the PR and between de76f4e and 2daab70.

📒 Files selected for processing (1)

• .coderabbit.yaml

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Fix CodeRabbit OSV scanner config key to enable dependency scanning

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Fix CodeRabbit tool key from osv-scanner to schema-valid osvScanner.
• Turn on OSV dependency vulnerability scanning that was previously inert.
• Document why the prior config was silently ignored by the v2 schema.

Diagram

graph TD
  A[".coderabbit.yaml"] --> B[CodeRabbit Review]
  B --> C[OSV Scanner]
  C --> D[(OSV Advisory DB)]
  subgraph Legend
    direction LR
    _cfg["Config"] ~~~ _svc([Service]) ~~~ _db[(Database)]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Add CI/schema validation for .coderabbit.yaml

• ➕ Prevents future silent no-ops due to misspelled keys
• ➕ Fails fast on schema drift or invalid config
• ➖ Requires maintaining a validation step and fetching/pinning the schema
• ➖ May introduce CI noise if schema changes upstream

2. Pin and periodically refresh CodeRabbit schema version

• ➕ Reduces surprise behavior changes from live schema updates
• ➕ Makes config expectations reproducible across time
• ➖ Extra maintenance process to update the pin
• ➖ Doesn't help if the pinned schema still allows unknown keys

Recommendation: Merge as-is to restore the intended security control (OSV scanning). As a follow-up, consider adding a lightweight schema validation check in CI (or pinning the schema) to avoid future inert config due to silently-accepted unknown keys.

Files changed (1) +6 / -1

Other (1) +6 / -1

.coderabbit.yamlCorrect OSV tool key to schema-valid 'osvScanner' +6/-1

Correct OSV tool key to schema-valid 'osvScanner'

• Renames the CodeRabbit tool configuration key from 'osv-scanner' to 'osvScanner' so OSV dependency scanning actually runs. Adds inline comments documenting the schema mismatch and why the prior key was silently ignored.

.coderabbit.yaml

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Enabling OSV scanning may surface new blocking findings

This flips OSV dependency scanning from silently disabled to actually running on every review. Since auto_approve.conditions.allowed_severities is limited to low/medium (.coderabbit.yaml:34-36), any high-severity OSV advisory in existing lockfiles will now block auto-approval and hence automerge. Worth confirming the current dependency set is clean before merging, otherwise the automerge pipeline may stall unexpectedly.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[blacksmith-sh]

Surfacing previously hidden OSV findings is the intended outcome of this PR, as stated in its description; any auto-approval blocks from high-severity advisories reflect real pre-existing exposure, not a config problem to fix here.

[macroscopeapp]

Approvability

Verdict: Needs human review

Unable to check for correctness in 32ec516. This PR enables OSV security scanning and GitHub Checks that were previously silently disabled due to schema key typos. While the diff is small, it changes CI/CD pipeline behavior - PRs may now be blocked by high-severity vulnerability findings that were previously not detected. The unresolved review comment raises a valid concern about verifying existing dependencies before enabling this scanning.

No code changes detected at 2daab70. Prior analysis still applies.

^{You can customize Macroscope's approvability policy. Learn more.}

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[qodo-code-review]

Qodo Fixer

No findings are available for this PR yet. Findings appear here once Qodo has reviewed the PR.

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.

Re-trigger cubic</sub>

[devin-ai-integration]

Devin Review found 1 new potential issue.

[devin-ai-integration]

🔍 Second rename (github_checks -> github-checks) is outside the stated PR scope

The PR title and primary description only cover the osv-scanner -> osvScanner rename, but this diff also renames github_checks -> github-checks (.coderabbit.yaml:98-105). That second rename activates a previously-inert 900000 ms GitHub Checks timeout, meaning CodeRabbit will now wait up to 15 minutes for checks instead of the 90 s default — a real change in review latency worth acknowledging explicitly. Worth confirming against the live schema that timeout_ms max is indeed 900000 so the value is not rejected once the key is actually parsed.

---

Was this helpful? React with 👍 or 👎 to provide feedback.