# werkrevisor rules for werkprobe; werkrevisor reads this file at the head of the default branch, never from a PR,
# and every change of it needs a human review.
# The host config on the review machine holds all other rules; see https://git.javagil.de/mi/werkrevisor.

[path_judge]
# Jev asks each changed file the categories of this template, without the ones switched off below;
# the host config sets scope = "all", which a repository cannot set.
# This choice replaces a risk_template of the host config.
risk_template = "jvm-spring-backend"

# werkprobe runs no web server and has no users, logins or request input.
[[risk.categories]]
name = "authentication"
action = "off"

[[risk.categories]]
name = "authorization"
action = "off"

[[risk.categories]]
name = "object_level_authorization"
action = "off"

[[risk.categories]]
name = "input_validation"
action = "off"

[[risk.categories]]
name = "api_compatibility"
action = "off"

# Its databases live in throwaway containers: no data of an installation can be lost or need a correction.
[[risk.categories]]
name = "schema_migration"
action = "off"

[[risk.categories]]
name = "data_correction"
action = "off"

# It has no business rules: the application only reports which server it reached and that the init script ran.
[[risk.categories]]
name = "business_invariants"
action = "off"