mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-11 22:53:00 +00:00
109 lines
4 KiB
TOML
109 lines
4 KiB
TOML
_version = 1
|
|
|
|
[workflow]
|
|
graph = "code-review.fabro"
|
|
|
|
[run.inputs]
|
|
mode = "changes"
|
|
effort = "medium"
|
|
scope = ""
|
|
base = ""
|
|
commit = ""
|
|
range = ""
|
|
model = "kimi-k3"
|
|
guidance = ""
|
|
expected_min_findings = ""
|
|
expected_file = ""
|
|
expected_min_rule_findings = ""
|
|
# Opt-in PR publishing (the publish_pr node). post_pr = "true" posts the
|
|
# findings to the named pull request; everything else leaves the node a
|
|
# no-op. pr_repo is the owner/name slug, pr_number the PR number.
|
|
post_pr = ""
|
|
pr_repo = ""
|
|
pr_number = ""
|
|
# Routing policy: findings at or below the severity (high|medium|low), or
|
|
# in the listed categories (comma-separated), go to the summary comment
|
|
# instead of inline. Empty disables that dimension; a malformed value
|
|
# fails the plan (fail-closed).
|
|
route_severity_below = ""
|
|
route_categories = ""
|
|
# Optional run-report URL included in the sticky summary.
|
|
run_url = ""
|
|
|
|
# Full history, for arbitrary base and range inputs.
|
|
[run.clone]
|
|
depth = 0
|
|
|
|
# A review is read-only and publishes nothing back to the repository; a
|
|
# host project's defaults (for example .fabro/project.toml enabling pull
|
|
# requests) must not turn a review run into a branch or PR.
|
|
[run.run_branch]
|
|
enabled = false
|
|
|
|
[run.pull_request]
|
|
enabled = false
|
|
|
|
[run.model.fallbacks]
|
|
"kimi-k3" = ["moonshot:kimi-k3", "modal:kimi-k3", "claude-opus-5"]
|
|
|
|
[run.environment]
|
|
id = "code-review"
|
|
|
|
# The publish_pr node posts review comments, so the run needs a GitHub
|
|
# token. Declaring these permissions makes Fabro mint a scoped
|
|
# installation token and inject it as GITHUB_TOKEN into sandbox command
|
|
# and agent execution; the grant is the minimum the publisher needs
|
|
# (inline review comments and the sticky summary on the reviewed PR).
|
|
# If the server has no GitHub integration, the run continues without a
|
|
# token and publish_pr fails only when post_pr actually asks it to post.
|
|
# Operating requirement (publisher spec R14): the launcher must not run
|
|
# two publishing reviews of the same PR concurrently -- serialize runs
|
|
# per repository+PR.
|
|
[run.integrations.github.permissions]
|
|
pull_requests = "write"
|
|
|
|
[run.checkpoint]
|
|
exclude_globs = [
|
|
"CODE-REVIEW-*/**",
|
|
".fabro/blobs/**",
|
|
".fabro/workflows/code-review/runtime",
|
|
]
|
|
|
|
[run.artifacts]
|
|
include = [
|
|
"CODE-REVIEW-*/.gitignore",
|
|
"CODE-REVIEW-*/CODE-REVIEW-RESULTS.md",
|
|
"CODE-REVIEW-*/CODE-REVIEW-RESULTS.html",
|
|
"CODE-REVIEW-*/CODE-REVIEW-RESULTS.jsonl",
|
|
"CODE-REVIEW-*/CODE-REVIEW-RESULTS.sarif",
|
|
"CODE-REVIEW-*/evidence/review-manifest.json",
|
|
"CODE-REVIEW-*/evidence/candidate-ledger.jsonl",
|
|
"CODE-REVIEW-*/evidence/findings.json",
|
|
"CODE-REVIEW-*/evidence/coverage.json",
|
|
"CODE-REVIEW-*/evidence/votes.jsonl",
|
|
"CODE-REVIEW-*/metadata/revision.json",
|
|
"CODE-REVIEW-*/metadata/state.json",
|
|
"CODE-REVIEW-*/metadata/review-meta.json",
|
|
"CODE-REVIEW-*/pr-publish-plan.json",
|
|
"CODE-REVIEW-*/pr-publish-outcome.json",
|
|
]
|
|
|
|
[environments.code-review]
|
|
provider = "daytona"
|
|
|
|
# The review's agents search the tree constantly. The mirrored buildpack-deps
|
|
# noble image is the Daytona default base. It ships grep but not ripgrep,
|
|
# which respects .gitignore and is far faster on a large repository.
|
|
# Every tier above low uses the rule loader and needs PyYAML; the pin and
|
|
# hashes below must stay in lockstep with requirements-rules.txt (cp312
|
|
# manylinux wheels + sdist).
|
|
[environments.code-review.image]
|
|
dockerfile = """
|
|
FROM ghcr.io/lithoscomputer/docker-mirror/buildpack-deps:noble@sha256:1fdce57bbb1105e0e515f6523bd0c3eb1df8b601847cfea140483672f6484afa
|
|
RUN apt-get update && apt-get install -y --no-install-recommends ripgrep python3-pip && rm -rf /var/lib/apt/lists/*
|
|
RUN echo 'PyYAML==6.0.3 --hash=sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f --hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc --hash=sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28' > /tmp/requirements-rules.txt && python3 -m pip install --break-system-packages --no-cache-dir --require-hashes -r /tmp/requirements-rules.txt && rm /tmp/requirements-rules.txt
|
|
"""
|
|
|
|
[environments.code-review.resources]
|
|
cpu = 2
|
|
memory = "4GB"
|