n8n/cubic.yaml

# yaml-language-server: $schema=https://cubic.dev/schema/cubic-repository-config.schema.json

# cubic.yaml
# This file configures AI review behavior, ignore patterns, PR descriptions, and custom rules.
# Place this file in your repository root to version-control your AI review settings.
# Settings defined here take precedence over UI-configured settings.
# See https://docs.cubic.dev/configure/cubic-yaml for documentation.
#
# Only the first 5 custom_rules take effect, and each one is truncated at 10,000
# characters (description + linked file_paths). `pnpm check:cubic-config` enforces both.
# Scope every rule with include/exclude so it is not evaluated against the whole monorepo.

version: 1
reviews:
  enabled: true
  sensitivity: medium
  incremental_commits: true
  check_drafts: true
  ignore:
    # Mechanical PRs: content was already reviewed on master, or there is nothing
    # to review. Backports stay reviewed — their conflicts are resolved by hand.
    pr_labels:
      - automation:v3-sync
      - automation:release
      - automation:scheduled-update
    # Above this, cubic skips the automatic review; `@cubic-dev-ai review this`
    # still works. CI already caps PRs at 1000 lines, so crossing this is always
    # a deliberate exception. Makes explicit a limit cubic otherwise applies on
    # its own terms.
    max_changed_lines: 10000
    files:
      - CHANGELOG.md
      - pnpm-lock.yaml
      - '**/dist/**'
      - '**/__snapshots__/**'
      - '**/*.snap'
      - '**/*.generated.yml'
      - '**/*.generated.ts'
  custom_instructions: |-
    ## Scope

    Review only the lines this PR adds or modifies. Each PR is meant to have a
    limited scope — do not report problems in surrounding code that already
    existed.

    ## Don't repeat the linter

    `pnpm lint` and `pnpm typecheck` run on every PR and already fail the build
    for a large set of n8n-specific rules (`@n8n/eslint-config`). Do not spend a
    comment on anything ESLint reports as an error — notably `ApplicationError`
    usage, `sleep`/`sleepWithAbort` helpers, `sleep` imported from
    `n8n-workflow`, `@n8n/typeorm` imports in `packages/cli` business logic,
    uncaught `JSON.parse`, `JSON.parse(JSON.stringify())`, skipped tests, and
    CSS custom-property naming. Report what static analysis cannot see.

    ## Test coverage

    BE REASONABLE when evaluating test coverage.

    **PASS if:**

    - Core functionality has tests
    - Critical paths are tested
    - Coverage is reasonable (not necessarily 100%)

    **DO NOT require tests for:**

    - Exports, types, configs
    - Metadata files
    - Version files

    Approve if reasonably tested. Let humans handle edge cases.

    ## Community contributions

    For PRs from outside the n8n organisation, the bar is set by the "Community
    PR Guidelines" section of `CONTRIBUTING.md`. The golden rule there: a
    contribution should be worth more to the project than the time it takes to
    review it.
  custom_rules:
    - name: Security
      file_paths:
        - .agents/review-rules/security/code-execution-and-sandboxing.md
        - .agents/review-rules/security/credentials-and-secrets.md
        - .agents/review-rules/security/auth-and-access-control.md
        - .agents/review-rules/security/data-and-infrastructure.md
        - .agents/review-rules/security/node-input-safety.md
      include:
        - packages/cli/**
        - packages/@n8n/db/**
        - packages/core/**
        - packages/workflow/**
        - packages/nodes-base/**
        - packages/@n8n/nodes-langchain/**
      exclude:
        - '**/__tests__/**'
        - '**/*.test.ts'
        - '**/*.spec.ts'
        - '**/test/**'
      description: |-
        Flag security defects introduced by this PR, using the linked rules.
        Each rule file opens with the packages it applies to — skip a file when
        the changed code is out of its scope.

        Higher scrutiny for the expression engine, credential handling, code
        execution nodes, license enforcement, and SSO integrations. Community
        and custom nodes carry a higher risk profile than official ones.
    - name: Backend
      file_paths:
        - .agents/review-rules/backend/controller-request-validation.md
        - .agents/review-rules/backend/error-classes.md
        - .agents/review-rules/backend/explicit-any.md
        - .agents/review-rules/backend/lazy-load-heavy-modules.md
        - .agents/review-rules/backend/hand-rolled-delays.md
      include:
        - packages/cli/**
        - packages/@n8n/db/**
        - packages/core/**
        - packages/workflow/**
        - packages/nodes-base/**
        - packages/@n8n/nodes-langchain/**
      exclude:
        - '**/__tests__/**'
        - '**/*.test.ts'
        - '**/*.spec.ts'
        - '**/test/**'
      description: |-
        Review n8n's backend and node packages against the linked rules. Think in
        terms of blast radius, resource cost, and failure modes. Be pragmatic,
        not pedantic.

        The rules are drawn from real incidents and the conventions the team
        enforces. Each file opens with the packages it applies to — skip one when
        the changed code is out of its scope. If none match, say nothing.
    - name: Frontend
      file_paths:
        - .agents/skills/design-system/SKILL.md
        - .agents/review-rules/frontend/design-system.md
        - .agents/review-rules/frontend/workflow-document-store.md
      include:
        - packages/frontend/**
      exclude:
        - '**/__tests__/**'
        - '**/*.stories.ts'
        - '**/*.spec.ts'
      description: |-
        Enforce n8n's frontend conventions using the linked rules. The design
        system skill is the source of truth for which token to reach for; the
        rule files that follow set the enforcement level.
    - name: QA & DX
      file_paths:
        - .agents/review-rules/qa-dx/docker-native-modules.md
        - .agents/review-rules/qa-dx/docker-image-pinning.md
        - .agents/review-rules/qa-dx/workflow-safety.md
        - .agents/review-rules/qa-dx/ratchets-and-allowlists.md
      include:
        - .github/**
        - docker/**
        - scripts/**
        - patches/**
        - packages/testing/**
        - packages/@n8n/eslint-config/**
        - packages/@n8n/stylelint-config/**
        - packages/@n8n/vitest-config/**
        - packages/@n8n/typescript-config/**
        - '**/eslint.config.mjs'
        - '**/vitest.config.*'
        - '**/turbo.json'
        - .poutine.yml
        - codecov.yml
        - .code-health-baseline.json
        - .boundaries-baseline.json
        - '**/.janitor-baseline.json'
      description: |-
        Review the build, test, and CI surface against the linked rules. These
        are lessons from builds that actually broke and from checks that turned
        out to be bypassable, not general Docker or Actions advice.

        Most of this surface is already scanned — Poutine, Zizmor, and
        `@n8n/code-health` fail CI for the well-known hazards. Report what those
        cannot see: a documented invariant being undone, a guard being widened,
        a gate that stops being able to fail.

  # cubic silently drops any rule past the fifth, so the last slot is a decision,
  # not somewhere to append. Merge into an existing agent instead.
pr_descriptions:
  generate: false
issues:
  fix_with_cubic_buttons: true