gram/cubic.yaml at main · speakeasy-api/gram · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
# yaml-language-server: $schema=https://cubic.dev/schema/cubic-repository-config.schema.json

# cubic.yaml
# This file configures AI review behavior, ignore patterns, PR descriptions, and custom rules.
# Place this file in your repository root to version-control your AI review settings.
# Settings defined here take precedence over UI-configured settings.
# See https://docs.cubic.dev/configure/cubic-yaml for documentation.

version: 1
reviews:
  enabled: true
  sensitivity: high
  incremental_commits: true
  check_drafts: false
  architecture_diagrams: false
  external_contributors_require_manual_review: true
  resolve_threads_when_addressed: true
  merge_confidence_summary: false
  auto_approve_behavior: disabled
  auto_approve: disabled
  ignore:
    files:
      - client/dashboard/src/sdk/**/*
      - client/sdk/**/*
      - hooks/sdk/**/*
      - server/gen/**/*
      - dev-idp/gen/**/*
      - infra/gen/**/*
      - "**/repo/*.go"
      - "**/chrepo/*.go"
      - "**/testrepo/*.go"
      - server/internal/database/*.go
      - .changeset/*
      - .speakeasy/**/*
      - "**/.speakeasy/**/*"
      - "**/pnpm-lock.yaml"
      - "**/go.sum"
      - "**/uv.lock"
      - "**/Cargo.lock"
      - "**/mise.lock"
      - "**/atlas.sum"
      - "**/__snapshots__/**/*"
      - "**/*.svg"
      - "**/*_gen.go"
      - "**/*_gen.yaml"
      - "**/*_gen.yml"
      - "**/*.pb"
      - "**/*.pb.go"
      - "**/*_pb2.py"
      - "**/*_pb2.pyi"
    head_branches:
      - changeset-release/main
      - dependabot/*
    pr_titles:
      - "chore: version packages"
  custom_rules:
    - name: Flag Security Vulnerabilities
      description: |-
        Scan for security flaws: hardcoded secrets, SQL injection, XSS, weak auth, exposed data, poor crypto, unsafe deserialization, insecure HTTP calls in production, and more. Ensure all network requests use HTTPS/TLS. Identify attack vectors and security violations to maintain robust defenses.
        Insecure Direct Object Reference (IDOR) vulnerabilities are mitigated by explicitly scoping all queries to organization or project ids. Ensure this is the case whenever SQLc queries are added or updated.
pr_descriptions:
  generate: true
  cubic_review_link: true
issues:
  fix_with_cubic_buttons: true
  pr_comment_fixes: true
  fix_commits_to_pr: true