From 41a416c770251843df58c44d4132c7651b17f068 Mon Sep 17 00:00:00 2001
From: Ivan Moroz <menvil.menvil@gmail.com>
Date: Thu, 28 May 2026 20:27:44 +0300
Subject: [PATCH 1/2] =?UTF-8?q?INFRA-001:=20Restrict=20AI=20reviews=20to?=
 =?UTF-8?q?=20release/*=20=E2=86=92=20main=20PRs?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- .coderabbit.yaml: auto_review disabled globally; re-enabled by 'release' label
- cubic.yaml: ignore.base_branches + ignore.head_branches block every PR that
  is not release/* → main
- .github/workflows/label-release-prs.yml: auto-applies 'release' label when
  a PR has head=release/* and base=main
- Created the 'release' GitHub label out-of-band so the workflow can apply it

Net effect: feature/* → develop PRs no longer trigger CodeRabbit or Cubic.
Only release PRs into main get reviewed. Manual @coderabbitai review still works.
---
 .coderabbit.yaml                        | 21 +++++++++++++++++++++
 .github/workflows/label-release-prs.yml | 24 ++++++++++++++++++++++++
 cubic.yaml                              | 23 +++++++++++++++++++++++
 3 files changed, 68 insertions(+)
 create mode 100644 .coderabbit.yaml
 create mode 100644 .github/workflows/label-release-prs.yml
 create mode 100644 cubic.yaml

diff --git a/.coderabbit.yaml b/.coderabbit.yaml
new file mode 100644
index 0000000..d9deaba
--- /dev/null
+++ b/.coderabbit.yaml
@@ -0,0 +1,21 @@
+# CodeRabbit — only auto-review release/* → main PRs.
+# Strategy: auto-review is disabled globally and re-enabled by the "release" label.
+# The label is applied automatically by .github/workflows/label-release-prs.yml.
+# Manual trigger is still available via @coderabbitai review.
+
+language: en
+
+reviews:
+  profile: chill
+  auto_review:
+    enabled: false
+    labels:
+      - "release"
+    drafts: false
+  request_changes_workflow: false
+  high_level_summary: true
+  poem: false
+  review_status: true
+
+chat:
+  auto_reply: true
diff --git a/.github/workflows/label-release-prs.yml b/.github/workflows/label-release-prs.yml
new file mode 100644
index 0000000..be1a339
--- /dev/null
+++ b/.github/workflows/label-release-prs.yml
@@ -0,0 +1,24 @@
+name: Label release PRs
+
+on:
+  pull_request_target:
+    types: [opened, reopened, edited, synchronize]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  add-release-label:
+    if: startsWith(github.event.pull_request.head.ref, 'release/') && github.event.pull_request.base.ref == 'main'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Add "release" label
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              labels: ['release'],
+            });
diff --git a/cubic.yaml b/cubic.yaml
new file mode 100644
index 0000000..181ba78
--- /dev/null
+++ b/cubic.yaml
@@ -0,0 +1,23 @@
+# Cubic.dev — only review release/* → main PRs.
+# Cubic only supports ignore filters; we list every base/head pattern that
+# is NOT release/* → main, so the remaining traffic is exactly that.
+version: 1
+
+reviews:
+  ignore:
+    # Skip any PR that does not target main.
+    base_branches:
+      - "develop"
+      - "feature/*"
+      - "chore/*"
+      - "fix/*"
+      - "hotfix/*"
+      - "release/*"
+    # Belt-and-braces: skip any PR sourced from a non-release branch
+    # even if it somehow targets main.
+    head_branches:
+      - "feature/*"
+      - "chore/*"
+      - "fix/*"
+      - "hotfix/*"
+      - "develop"

From aca9677ab3dab768df1250b1b7cb0a59c49ccd81 Mon Sep 17 00:00:00 2001
From: Ivan Moroz <menvil.menvil@gmail.com>
Date: Thu, 28 May 2026 20:47:40 +0300
Subject: [PATCH 2/2] INFRA-001: Pin actions/github-script to commit SHA

Replace floating @v7 tag with the immutable commit SHA
f28e40c7f34bde8b3046d885e986cb6290c5673b (v7.0.1) to prevent supply-chain
tampering via tag moves. The version comment keeps the tag readable for
future upgrades.
---
 .github/workflows/label-release-prs.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/label-release-prs.yml b/.github/workflows/label-release-prs.yml
index be1a339..d809a65 100644
--- a/.github/workflows/label-release-prs.yml
+++ b/.github/workflows/label-release-prs.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Add "release" label
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.0.1
         with:
           script: |
             await github.rest.issues.addLabels({