INFRA-001: Restrict AI reviews to release/* → main PRs

.coderabbit.yaml

@@ -0,0 +1,21 @@
+# CodeRabbit — only auto-review release/* → main PRs.
+# Strategy: auto-review is disabled globally and re-enabled by the "release" label.
+# The label is applied automatically by .github/workflows/label-release-prs.yml.
+# Manual trigger is still available via @coderabbitai review.
+
+language: en
+
+reviews:
+  profile: chill
+  auto_review:
+    enabled: false
+    labels:
+      - "release"
+    drafts: false
+  request_changes_workflow: false
+  high_level_summary: true
+  poem: false
+  review_status: true
+
+chat:
+  auto_reply: true

.github/workflows/label-release-prs.yml

@@ -0,0 +1,24 @@
+name: Label release PRs
+
+on:
+  pull_request_target:
+    types: [opened, reopened, edited, synchronize]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  add-release-label:
+    if: startsWith(github.event.pull_request.head.ref, 'release/') && github.event.pull_request.base.ref == 'main'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Add "release" label
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.0.1
+        with:
+          script: |
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              labels: ['release'],
+            });

cubic.yaml

@@ -0,0 +1,23 @@
+# Cubic.dev — only review release/* → main PRs.
+# Cubic only supports ignore filters; we list every base/head pattern that
+# is NOT release/* → main, so the remaining traffic is exactly that.
+version: 1
+
+reviews:
+  ignore:
+    # Skip any PR that does not target main.
+    base_branches:
+      - "develop"
+      - "feature/*"
+      - "chore/*"
+      - "fix/*"
+      - "hotfix/*"
+      - "release/*"
+    # Belt-and-braces: skip any PR sourced from a non-release branch
+    # even if it somehow targets main.
+    head_branches:
+      - "feature/*"
+      - "chore/*"
+      - "fix/*"
+      - "hotfix/*"
+      - "develop"