Merge pull request #1 from coreruleset/fix/linked-repos-plan-limit

Trim linked_repositories to 5, our plan's limit

Author: fzipi

.coderabbit.yaml

@@ -1460,13 +1460,6 @@ knowledge_base:
         `crs-plugin-test-action`, and by every plugin repo's tests. A change to
         flags, output format, or exit codes breaks those callers, so treat
         those as cross-repo breaking changes.
-    - repository: "coreruleset/ftw-tests-schema"
-      instructions: >
-        The authoritative YAML schema for go-ftw test files. Every file under
-        `tests/regression/tests/` in coreruleset and in the plugin repos must
-        conform to it. Use it to decide whether a field in a test file is
-        valid, required, or deprecated, rather than inferring the shape from
-        neighbouring tests.
     - repository: "coreruleset/crs-toolchain"
       instructions: >
         Compiles `regex-assembly/*.ra` sources into the `@rx` patterns in
@@ -1486,25 +1479,6 @@ knowledge_base:
         before claiming a metadata issue will or will not fail CI, and note
         that a change to the linter itself can retroactively fail existing
         rules in coreruleset.
-    - repository: "coreruleset/plugin-registry"
-      instructions: >
-        The registry of official and third-party CRS plugins, including the
-        rule ID range reserved for each plugin. This is the authority for
-        whether a plugin rule sits in its own range or is squatting on a core
-        CRS range or another plugin's. A new plugin, or a plugin claiming a
-        new range, must be reflected here.
-    - repository: "coreruleset/actions"
-      instructions: >
-        Reusable CRS composite GitHub Actions shared across the org's
-        workflows. When reviewing a workflow change, check whether an inline
-        step reimplements something this repo already provides, and whether a
-        change here affects the workflows that call it.
-    - repository: "coreruleset/renovate-config"
-      instructions: >
-        The shared Renovate preset that every repo's `renovate.json` extends
-        via `github>coreruleset/renovate-config`. Consult it to see what the
-        preset already handles before suggesting repo-local `packageRules`,
-        and treat a change here as affecting dependency updates org-wide.
     # Renamed from coreruleset/coreruleset-documentation; GitHub redirects the
     # old name, but use the canonical one here.
     - repository: "coreruleset/documentation"

AGENTS.md

@@ -96,15 +96,20 @@ PR conventions). Keep the two in sync when either changes.
   be reviewed.
 - `allow_non_org_members: true` and `enable_free_tier: true` are deliberate: CRS takes drive-by
   community contributions.
-- **`linked_repositories` is capped at 20** and is selected by dependency edge, not by
-  relevance — a repo earns a slot when something can break across the boundary. The nine here:
-  `coreruleset` (rule IDs, approved tags, PL policy), `go-ftw` + `ftw-tests-schema` (test runner
-  and its YAML schema), `crs-toolchain` (`.ra` directive semantics), `crs-linter` (what actually
-  fails CI), `plugin-registry` (reserved plugin ID ranges), `actions`, `renovate-config`,
-  `documentation`. `documentation` carries the longest entry on purpose: it is the source of
-  truth for everything operators are told (configuration, PL guidance, exclusion recipes,
-  upgrade notes), so it outranks anything inferred from the rules when the question is what a
-  user is supposed to do — and it is the counterpart obligation for any user-visible change.
-  Note it was renamed from `coreruleset-documentation`; GitHub redirects, but the config uses
-  the canonical name. Deliberately excluded: `template-plugin` and `modsecurity-crs-docker` —
-  they consume the rule set but nothing breaks across the edge.
+- **`linked_repositories` is capped at 5 by our CodeRabbit plan** (the schema itself allows up
+  to 20). The five kept, chosen for the checks that fire across the whole org rather than one
+  repo: `coreruleset` (rule IDs, approved tags, PL policy — everything else is downstream of
+  it), `crs-toolchain` (`.ra` directive semantics, backing the regex-assembly source-of-truth
+  check), `crs-linter` (what actually fails CI), `go-ftw` (the test runner every repo's tests
+  depend on), and `documentation` (the counterpart-obligation check: flag a PR that changes
+  documented behavior without a matching docs change). `documentation` carries the longest
+  entry on purpose: it is the source of truth for everything operators are told (configuration,
+  PL guidance, exclusion recipes, upgrade notes), so it outranks anything inferred from the
+  rules when the question is what a user is supposed to do. Note it was renamed from
+  `coreruleset-documentation`; GitHub redirects, but the config uses the canonical name.
+  Dropped to fit the cap: `ftw-tests-schema` (overlaps `go-ftw`), `plugin-registry` (only backs
+  the plugin ID-range check, scoped to plugin repos), `actions` and `renovate-config` (only
+  relevant to workflow/dependency-policy discussions). Revisit if plugin repos start seeing
+  frequent drive-by PRs — `plugin-registry` backs the one blocker-severity check among the four
+  that were cut. Deliberately excluded regardless of the cap: `template-plugin` and
+  `modsecurity-crs-docker` — they consume the rule set but nothing breaks across the edge.