Merge Preflight

Require pull request label

Passes when the pull request has at least one configured label. Matching is case-insensitive.

labels

Required non-empty list of accepted labels. Singular label remains accepted by repository YAML.

mode

block or warn.

schema_version: 1
rules:
  - id: require_pull_request_label
    configuration:
      labels: [release-ready, production-approved]

Require issue reference

Searches the pull request title and body for any configured regular expression. This is provider-neutral and does not call Jira or Linear.

patterns

Required list of regular expressions. Singular pattern is also accepted.

mode

block or warn.

schema_version: 1
rules:
  - id: require_issue_reference
    configuration:
      patterns:
        - '[A-Z]+-\d+'
        - 'INC-\d+'

Pull request title pattern

Requires the entire pull request title to match at least one configured regular expression.

patterns

Required list of title regular expressions, provided directly or through pull_request_title_policy.patterns.

mode

block or warn.

schema_version: 1
pull_request_title_policy:
  patterns:
    - '^[A-Z]+-\d+: .+$'
    - '^NOISSUE: .+$'
rules:
  - id: pull_request_title_pattern

Maximum pull request size

Enforces any combination of changed-line, changed-file, and commit-count limits. At least one positive limit is required; unavailable required SCM data fails closed.

max_changed_lines

Maximum additions plus deletions.

max_changed_files

Maximum changed files.

max_commits

Maximum pull request commits.

mode

block or warn.

schema_version: 1
pull_request_size_policy:
  max_changed_lines: 1200
  max_changed_files: 30
  max_commits: 20
rules:
  - id: maximum_pull_request_size
    configuration:
      mode: warn

Branch name pattern

Requires the entire source branch name to match at least one configured regular expression.

patterns

Required list of branch regular expressions, provided directly or through branch_name_policy.patterns.

mode

block or warn.

schema_version: 1
branch_name_policy:
  patterns:
    - '^feature/[A-Z]+-\d+-.*$'
    - '^hotfix/INC-\d+-.*$'
rules:
  - id: branch_name_pattern

Commit message pattern

Requires selected pull request commit messages to match at least one regular expression and reports the first offending commit.

patterns

Required list of commit-message regular expressions.

scope

all_commits (default) or latest_commit. Legacy merge_range_commits remains parseable for existing YAML.

mode

block or warn.

schema_version: 1
commit_message_policy:
  patterns:
    - '^[A-Z]+-\d+ .+$'
  scope: all_commits
rules:
  - id: commit_message_pattern

Freeze windows

Blocks during scheduled local-time release freezes. The application clock is evaluated in the configured IANA timezone; overnight windows carry into the next day and equal start/end times mean a full-day freeze.

freeze_windows.timezone

Required IANA timezone.

freeze_windows.periods

Day-name lists with local HH:mm start and end times.

mode

block or warn.

schema_version: 1
freeze_windows:
  timezone: Europe/Berlin
  periods:
    - days: [MONDAY, TUESDAY, WEDNESDAY, THURSDAY, FRIDAY]
      start: '19:00'
      end: '09:00'
    - days: [SATURDAY, SUNDAY]
      start: '00:00'
      end: '00:00'
rules:
  - id: freeze_window

Require changelog

Runs only when the source branch matches a configured regular expression, then requires at least one changed file to match an exact path or glob. Non-matching branches pass without a changelog requirement.

branches

Required source-branch regular expressions.

required_files

Required exact paths or glob patterns.

mode

block or warn.

schema_version: 1
changelog_policy:
  branches:
    - '^release/.*$'
    - '^hotfix/.*$'
  required_files:
    - CHANGELOG.md
    - docs/releases/*.md
rules:
  - id: require_changelog

Require no active deployment freeze

Queries Sentry incident/error state and blocks while the selected deployment-freeze object is active. No matching object means no active freeze.

Requires an active installation-scoped Sentry connection with incident lookup capability. Sentry SaaS uses read-only OAuth; self-managed Sentry can use encrypted token credentials. If multiple Sentry accounts are connected, select one with external_account_ref.

deployment_freeze_reference

Lookup text; defaults to active deployment freeze.

external_account_ref

Optional stable Sentry connection reference.

failure_behavior

fail_closed (default) or fail_open.

mode

block or warn.

schema_version: 1
rules:
  - id: require_no_active_deployment_freeze
    configuration:
      deployment_freeze_reference: active production deployment freeze
      external_account_ref: sentry-production
      failure_behavior: fail_closed

Jira

Require Jira issue in an allowed status

Finds Jira issue keys in the pull request title, description, and branch name, resolves them against the selected Jira site, and requires the linked issue's workflow status to allow merging.

Requires an active installation-scoped Jira connection with issue-status capability. Jira Cloud uses read-only Atlassian OAuth; Jira Data Center can use encrypted token credentials. Connection settings may restrict readable projects; accepted workflow statuses belong to this policy. The hosted editor presents connected Jira sites by name.

accepted_statuses

Required Jira workflow status names.

issue

Optional explicit Jira issue key.

external_account_ref

Optional stable Jira connection reference.

mode

block or warn.

schema_version: 1
rules:
  - id: require_linked_jira_issue_status
    configuration:
      accepted_statuses: [Approved, Ready, Done]
      external_account_ref: jira-production

Linear

Require Linear issue in an allowed state

Finds Linear issue identifiers in the pull request title, description, and branch name, resolves them against the selected Linear workspace, and requires the linked issue's workflow state to allow merging.

Requires an active installation-scoped Linear OAuth connection with issue-status capability. The integration is installed as a read-only workspace application actor. Connection settings may restrict readable teams; accepted workflow states belong to this policy. Discovered team keys identify Linear references automatically, while linear_prefixes remains an optional YAML fine-tuning control.

accepted_states

Required Linear workflow state names.

linear_prefixes

Optional team-key allowlist used to disambiguate detected issue identifiers.

issue

Optional explicit Linear issue identifier.

external_account_ref

Optional stable Linear connection reference.

mode

block or warn.

schema_version: 1
rules:
  - id: require_linked_linear_issue_state
    configuration:
      accepted_states: [Ready, Done]
      linear_prefixes: [ENG, OPS]
      external_account_ref: linear-production

Sentry

Block unrelated PRs during Sentry incidents

Looks up active critical Sentry state and blocks unrelated work. A pull request passes when it references the active incident or has one of the configured incident-fix labels. No active incident means the rule passes.

Requires an active installation-scoped Sentry connection with incident lookup capability. Sentry SaaS uses read-only OAuth; self-managed Sentry can use encrypted token credentials. Connection settings define the projects, environments, critical levels, and optional short-reference prefixes searched by the provider.

incident_reference

Optional lookup text overriding pull request-derived incident references.

incident_fix_labels

Labels treated as incident fixes; defaults to hotfix and incident-fix.

external_account_ref

Optional stable Sentry connection reference.

failure_behavior

fail_closed (default) or fail_open.

mode

block or warn.

schema_version: 1
rules:
  - id: block_unrelated_pr_during_sentry_critical
    configuration:
      incident_fix_labels: [hotfix, incident-fix]
      external_account_ref: sentry-production
      failure_behavior: fail_closed

Sentry

Allow linked hotfix during incident

Evaluates the incident exception explicitly: linked or incident-fix-labeled work passes during an active incident; unrelated work fails or warns. If no active incident exists, no exception is required and the rule passes.

This rule is registered and supported by the engine but is not exposed as a separate hosted-editor control. It uses the same Sentry connection, incident lookup, project/environment/critical-level filtering, account selection, and credential handling described above.

incident_reference

Optional lookup text overriding pull request-derived incident references.

incident_fix_labels

Labels treated as incident fixes; defaults to hotfix and incident-fix.

external_account_ref

Optional stable Sentry connection reference.

failure_behavior

fail_closed (default) or fail_open.

mode

block or warn.

schema_version: 1
rules:
  - id: allow_linked_hotfix_during_incident
    configuration:
      incident_fix_labels: [hotfix, incident-fix]
      external_account_ref: sentry-production
      failure_behavior: fail_open