language: en-US

reviews:
  profile: chill
  request_changes_workflow: false
  high_level_summary: false
  poem: false
  review_status: false
  commit_status: false
  collapse_walkthrough: true
  changed_files_summary: false
  sequence_diagrams: false
  estimate_code_review_effort: false
  assess_linked_issues: false
  related_issues: false
  related_prs: false
  suggested_labels: false
  auto_apply_labels: false
  suggested_reviewers: false
  auto_assign_reviewers: false

  auto_review:
    enabled: true
    auto_incremental_review: true
    drafts: false

  finishing_touches:
    docstrings:
      enabled: false

  path_filters:
    - "!**/*.lock"
    - "!**/node_modules/**"
    - "!**/dist/**"
    - "!**/build/**"
    - "!**/*.pb.go"
    - "!**/*_gen.go"
    - "!backend/docs/**"

  path_instructions:
    - path: ".github/workflows/**"
      instructions: |
        Security-critical workflow review:
        - All third-party actions must be pinned to a full commit SHA, with a "# vX.Y.Z" tag comment. Flag floating tags (@v4, @main, @master).
        - Top-level "permissions:" must exist and default to least privilege (contents: read). Flag missing or overly broad top-level permissions.
        - Jobs that don't write should not have write scope. Flag contents: write, packages: write, id-token: write that aren't justified by the job's purpose.
        - Untrusted PR input (github.event.pull_request.title, body, head.ref) must not be substituted directly into "run:" scripts (workflow injection). Flag and recommend env-var indirection.
        - "pull_request_target" with secrets exposed to fork PRs is a serious risk. Flag and require justification.

    - path: "**/Dockerfile*"
      instructions: |
        Docker security:
        - Pin base images to a specific version tag and ideally a digest. Flag floating tags like ":latest" or bare ":alpine" without a version.
        - Avoid running as root in the final image; flag missing USER directive in production stages.
        - Don't embed secrets in build args or COPY. Flag suspicious literal-looking secrets, keys, or tokens.

  tools:
    gitleaks:
      enabled: true
    semgrep:
      enabled: true
    ast-grep:
      essential_rules: false
    actionlint:
      enabled: false
    hadolint:
      enabled: false
    shellcheck:
      enabled: false
    languagetool:
      enabled: false
    markdownlint:
      enabled: false

chat:
  auto_reply: true