config.yml

# Temper Configuration

# Organization to monitor
organization: pulseengine

# Bot mention name (without [bot] suffix)
bot_name: temper-pulseengine

# Users authorized to trigger commands
allowed_command_users:
  - avrabe

# Target settings for repositories
settings:
  merge:
    allow_merge_commit: true
    allow_squash_merge: true
    allow_rebase_merge: false
    delete_branch_on_merge: true
    allow_auto_merge: true

forks:
  merge:
    allow_merge_commit: true
    allow_squash_merge: true
    allow_rebase_merge: true
    delete_branch_on_merge: true

branch_protection:
  default:
    required_status_checks:
      strict: true
      # Empty intentionally — see the smithy-migration audit on
      # 2026-05-10. Several pulseengine repos (rules_lean,
      # pulseengine.eu, .github, rules_rocq_rust, wasm-component-
      # examples, moonbit_checksum_updater, …) don't define jobs
      # called Format / Clippy / Test under those exact names. Adding
      # them as required contexts here would leave those repos
      # permanently un-mergeable.
      #
      # The protections below (signed commits, no force pushes, no
      # deletions, enforce_admins, strict-up-to-date) still apply
      # org-wide and are the bulk of the value. Per-repo can ADD
      # specific gating checks via direct API (smithy already does
      # this on spar's main branch, requiring the full 13-context
      # smithy migration set).
      #
      # If we ever want a real org floor, the right vehicle is
      # ensuring every repo first ships a stub workflow that emits
      # the contexts (e.g. via a starter workflow in pulseengine/.github).
      contexts: []
    enforce_admins: true
    required_pull_request_reviews:
      required_approving_review_count: 0
    required_linear_history: false
    required_conversation_resolution: false
    restrictions: null
    allow_force_pushes: false
    allow_deletions: false
    require_signed_commits: true

# Repository Rulesets (modern replacement for legacy branch protection).
# When enabled, Temper applies a Repository Ruleset derived from
# branch_protection.default. Rulesets target ~DEFAULT_BRANCH so they apply on
# empty repos — no more 5x retry race on repository.created.
rulesets:
  enabled: true
  # Set to false to keep using the legacy branch-protection API only.
  fall_back_to_legacy: true
  # Optional: name of the managed ruleset (allows multiple managed rulesets later).
  name: temper-default-branch-protection

# Issue-driven repo provisioning. Users open an issue in the controller repo,
# Temper validates the issue form and creates the new repo with full config.
controller_repo:
  enabled: false
  # owner/repo of the controller. Issues here drive new-repo creation.
  repo: pulseengine/repo-requests
  # Label that marks an issue as a repo-provision request.
  label: repo-request
  # Reaction approvers must add to authorise provisioning.
  approval_reaction: "+1"

# ChatOps surface restriction. When enabled, ALL slash commands
# (/configure-repo, /sync-all-repos, /review-pr, etc.) are silently ignored
# from any repo other than the designated `repo`. Combined with making
# `repo` private, the entire command-and-control conversation stays out of
# public view. Bot-initiated configuration PRs in public repos are still
# public — this only hides the *triggers*.
chatops_repo:
  enabled: false
  repo: pulseengine/temper-ops

# Configuration changes (dependabot.yml, templates, CODEOWNERS) are applied via
# pull request rather than direct push. Required because branch protection
# (PR #19) blocks direct commits to default branches.
change_strategy:
  use_pull_requests: true
  pr_title: "[temper] Configuration update"
  pr_body: |
    Automated configuration update from the Temper bot.

    Review the changes and merge if they match the org standard.
  pr_labels:
    - automation
    - dependencies

auto_merge:
  enabled: true
  on_dependabot: true
  on_bot_users:
    - thrum
  merge_method: squash

self_update:
  enabled: true
  repo: temper
  branch: main

dependabot_generation:
  enabled: true
  ai_enhance: false
  default_schedule: "weekly"
  default_labels: ["dependencies"]
  max_directories_per_ecosystem: 5

ai_review:
  enabled: true
  endpoint: "http://localhost:11434/v1/chat/completions"
  model: "qwen2.5-coder:3b"
  max_diff_size: 12000
  max_tokens: 2000
  temperature: 0.3
  timeout: 300000
  allow_remote_endpoint: false

# Mechanical oracle: when the target repo ships rivet.yaml and the rivet
# binary is installed, run `rivet validate` and `rivet impact --since=<base>`
# against a fresh tarball of the PR head. Findings from the oracle are
# mechanically validated and bypass the model entirely. Errors from the
# oracle promote the verdict to request_changes.
rivet_oracle:
  enabled: true
  binary_path: "data/rivet/rivet"
  timeout_ms: 60000

scheduler:
  interval_minutes: 5
  max_tasks_per_tick: 5
  rate_limit_threshold: 100

# How `synchronizeIssueLabels` reconciles a repo's labels with `issue_labels`:
#   - `merge` (default, non-destructive): create or update labels listed below,
#     but never delete labels that are not in this list. Safe for repos where
#     users have created their own custom labels (per-issue tags, milestones,
#     etc.).
#   - `replace` (destructive, opt-in): also delete any label that is not in
#     this list. This was the behaviour prior to fixing Bug #1
#     (`docs/agent-fleet/bugs.md`); set this only if you explicitly want every
#     repo's labels reduced to exactly `issue_labels`.
issue_labels_sync_mode: merge

issue_labels:
  - name: "bug"
    color: "d73a4a"
    description: "Something isn't working"
  - name: "enhancement"
    color: "a2eeef"
    description: "New feature or request"
  - name: "documentation"
    color: "0075ca"
    description: "Improvements or additions to documentation"
  - name: "good first issue"
    color: "7057ff"
    description: "Good for newcomers"
  - name: "help wanted"
    color: "008672"
    description: "Extra attention is needed"
  - name: "question"
    color: "d876e3"
    description: "Further information is requested"
  - name: "dependencies"
    color: "0366d6"
    description: "Dependency updates"
  - name: "automation"
    color: "0e8a16"
    description: "Automation updates"