How to Cut CodeAnt AI False Positives with Custom Review Rules

You cut CodeAnt AI false positives by ignoring generated files, raising severity thresholds and letting its dismissal memory suppress repeat findings. Teams that skip this tuning step typically see the bot muted within two sprints, which defeats the point of paying for it.

This is the follow-up for anyone already running CodeAnt AI on a real repo. The default config is tuned for a generic codebase; yours is not generic.

Why does CodeAnt AI comment on files you never touch by hand?

Because it scans every changed file, including bundled output. If a build artifact, lockfile or generated schema lands in a PR, CodeAnt treats it as source. That produces a wall of duplication warnings nobody can act on.

The fix lives in .codeant.yaml at the repo root:

ignore:
  - "dist/**"
  - "**/*.min.js"
  - "package-lock.json"
  - "migrations/**"
severity_threshold: medium

Commit that file and the next PR inherits the rules. Start by ignoring three directories — build output, vendored code, migrations — then add more only when a specific path proves noisy.

Which severity level should you set?

Set the threshold to medium on a codebase that already has a linter, and low only on legacy repos where you want the full sweep once. Here is the practical trade-off:

Threshold	What gets flagged	Best for
low	Style nits, long functions, comments	One-off cleanup of old code
medium	Bugs, security, duplication	Day-to-day CI on active repos
high	Security and crash-level bugs only	Teams that hate any bot noise

Most teams land on medium and stay there. High is tempting but lets duplication slide, and duplication is where the real decay starts.

How does CodeAnt AI remember dismissed findings?

When you dismiss a comment, CodeAnt records the finding fingerprint — rule plus code context — and stops reposting it on future runs. This matters because a reviewer who has to dismiss the same null-check warning five times will stop reading the bot.

Two caveats. First, the memory is per repo, so a monorepo with shared utilities may still repeat across packages. Second, if the code around a dismissed line changes materially, the fingerprint shifts and the finding returns. That is intentional, but it surprises people.

Should you let CodeAnt AI block merges?

Yes, but only for security findings. Wire the CodeAnt check into branch protection as a required status, then keep bugs and smells as advisory comments. Blocking on style kills velocity for no real gain.

The sequence that works: run advisory for two weeks, review every security finding by hand, then flip security to required once the false-positive rate on your code is clearly under ten percent.

Quick Summary

• Ignore build output, lockfiles and migrations via .codeant.yaml before anything else.
• Use medium severity for active repos; reserve low for one-off legacy cleanup.
• Dismissal memory suppresses repeat findings per repo, not per monorepo package.
• Only make the check blocking for security categories, never for style.
• Run advisory for two weeks before enforcing anything.