version: 1
rules:
  require_primary_source: true
  require_version_applicability: true
  require_corroboration_for_major_change: true
  reject_unsourced_claims: true
  automatic_apply: false

# El contexto de la empresa no es una fuente de la profesión: vive en
# organization/roles/devops-engineer.md dentro de cada instalación.
sources:
  - name: DORA Capabilities
    url: https://dora.dev/capabilities/
    tier: profession
    topics: [continuous-delivery, deployment-automation, feedback]
  - name: SLSA Specification
    url: https://slsa.dev/spec/
    tier: standard
    topics: [provenance, build-integrity, supply-chain]
  - name: OpenTofu Documentation
    url: https://opentofu.org/docs/
    tier: project
    topics: [iac, plans, state, modules]
  - name: GitHub Actions security hardening
    url: https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions
    tier: standard
    topics: [workflow-security, permissions, oidc]