Add k8s-review, gitops-review, helm-review and a gitops set

[ywy50]

Adds GitOps/Kubernetes review coverage as three bundled prompts plus a gitops set.

New reviews

• k8s-review — manifests and kustomize structure: cross-resource reference integrity (dangling Service selectors, missing ConfigMap/Secret keys, broken roleRefs), immutable-field traps queued in the repo, API deprecations with the version boundary named, and structural kustomize defects — resources that should be Components and the inverse, components/ directories holding plain resource lists, overlay copy-paste, deprecated fields (commonLabels, patchesStrategicMerge, bases, vars), generator misuse. Schema validation is explicitly scoped to rendered kustomize build output so JSON6902 op lists and strategic-merge fragments never produce false positives, and unknown (CRD-typed) kinds are skipped rather than reported.
• gitops-review — the Argo CD / Flux delivery layer: source pinning (targetRevision: HEAD, semver-matches-tags-only, unpinned remote bases and chart ranges), sync/prune/selfHeal tradeoffs, Flux's prune-off default, ordering and health (waves, hook delete policies, cross-kind dependsOn), ApplicationSet blast radius and goTemplateOptions, tenancy scoping, deprecated *.toolkit.fluxcd.io beta APIs, secrets delivery (SOPS wiring, sealed/external secrets), image automation, and environment promotion. Gates on evidence: when manifests carry no tool markers it states the tool is undetectable and reviews tool-agnostically instead of guessing; repos vendoring the Argo CD/Flux installation itself are in scope.
• helm-review — chart authoring: template correctness (quoting/retyping, nindent, nil guards, $ rebinding, 63-char truncation), rendering-environment honesty (lookup and .Capabilities under helm template, i.e. the GitOps render path), the values contract (values.schema.json, dead/undocumented values, subchart wiring), rollout correctness (checksum annotations, versioned selector labels), hooks (delete policies, weights, phase mismatches), CRD lifecycle (crds/ vs templates/), and chart metadata/dependencies.

Each prompt follows the bundled format (Summary line, applicability gate with skip instruction, surface section, numbered focus areas, shared report structure) and delegates in both directions: pod-spec posture stays with container-review, CI/IaC with infra-review, secret values with sec-review, re-run safety with idempotency-review.

Wiring

• gitops set: the three new reviews plus container-review, infra-review, sec-review, dr-review.
• agent.ReviewTools entries (kubeconform, kustomize, helm, kube-linter, kube-score, pluto, yq) so the composed tooling note works; doctor's exactly-once catalog check passes.
• File-signal suggester rules for kustomize files, GitOps markers (flux-system/argocd/gotk files), and Chart.yaml.
• Contract snapshots (goldenReviewNames, goldenSetNames), README review grid and set list, docs/CLI.md sets line, CHANGELOG entry under Unreleased.

Verification

• gofmt -l clean, go build ./..., full go test ./... green.
• gauntlet -r gitops --dry-run expands to the 7 expected reviews.
• gauntlet --show-prompt k8s|gitops|helm composes with a correct tooling note (installed vs absent helpers reflected).

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: e9954a82-8f8a-4dda-8a73-1c5d6e8ca1b1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}