python-backend.yaml

# Example .forge/policy.yaml — Python backend REST API service.
#
# Drop this at `.forge/policy.yaml` in a Python service repo. It is parsed by
# `forge_policy.load_policy` and enforced by `RepoPolicyEvaluator.evaluate`
# (deny-by-default; deny globs beat allow globs; restricted actions are blocked).
repo_id: github.com/acme/payments-api
name: Payments API
purpose: Backend REST API for customer payment operations.
languages: [python]
entrypoints:
  - app/main.py
commands:
  install: uv sync
  lint: ruff check . && ruff format --check .
  type_check: mypy app/
  test: pytest -q
  test_coverage: pytest --cov=app --cov-report=term-missing -q
  build: docker build -t payments-api .
write_rules:
  allow: [app/**, tests/**, docs/**, alembic/versions/**]
  deny: [infra/prod/**, .env*, secrets/**, "*.pem", "*.key"]
review_rules:
  required_reviewers: [team-backend]
  approval_required_for_merge: true
  min_approvals: 1
deploy_rules:
  allow_agent_deploy: false
  environments: [dev]
  restricted_environments: [staging, production]
knowledge_rules:
  index_paths: [app/**, docs/**, specs/**]
  exclude_paths: [.venv/**, __pycache__/**, "*.pyc"]
  freshness_sla_hours: 24
skill_profiles:
  default: backend-tdd
  allowed: [backend-tdd, backend-fast, security-review, spec-analyst]
subagent_rules:
  allow_subagents: true
  allowed_roles: [reviewer, tester]
  max_parallel: 2
allowed_actions: [read_repo, write_code, run_tests, open_pr, read_knowledge, query_mcp]
restricted_actions: [deploy_prod, delete_files, push_to_main, modify_access_controls]