Repository Configuration (.codestax.yml)

A .codestax.yml file at the repository root lets a team add to its review policy from the codebase itself, versioned with the code. It can only add: extra path exclusions and focus notes for the AI reviewer. It can never remove an organisation exclusion, suppress or downgrade a finding, or change a quality gate. Those stay in the dashboard, where only organisation administrators can change them.

Example

version: 1
exclude_paths:
  - "vendor/**"
  - "generated/"
  - "fixtures/**"
review:
  focus:
    - "Anything that reaches a shell, a subprocess or a git command from request data."
    - "Every query that touches customer data must filter by organisation."

Patterns follow the same matching as dashboard exclusions: dir/ means everything under the directory, ** spans directories. Patterns that start with / or -, or contain .., are ignored and counted as invalid.

Which version of the file applies

• Pull-request reviews read the file from the target branch at the commit the review is based on, never from the branch under review. A pull request therefore cannot loosen the policy that reviews it. When a pull request changes .codestax.yml, the review says so and applies the new configuration only to reviews after it merges.
• Full scans read the file from the commit being scanned.

What the review shows

The Analyzer coverage section of the pull-request comment names the file and its effect, for example:

Repository config (.codestax.yml on main): 2 extra path exclusions, 1 focus note

Entries the parser could not accept are counted there as ignored, so a typo never silently disappears.

Security contract

Focus notes are treated as untrusted data by the reviewer, exactly like custom rules: they can point the analysis at an area, they cannot instruct it, expand its scope, select a severity or alter its output. Findings are still verified against the changed lines by the worker.