Vetrix Docs

The Configure wizard

/<owner>/<repo>/security/configure is the UI generator for .vetrix/tooling.yml. Every non-trivial field in the config is represented in the wizard, and every wizard action is expressible as an edit to the YAML — the two are equivalent views of the same source of truth.

Flow

  1. Detect — the server runs the auto-detector against the default branch HEAD. Detection is purely marker-based (presence of composer.json, go.mod, Magento vendor directory, etc.) — no probabilistic analysis.
  2. Propose — the UI renders each detected language / framework with the scanners it would enable.
  3. Edit — freely toggle scanners, change rulesets, override severities, add path-scoped overrides for monorepos.
  4. Commit — hitting Save calls POST /api/v1/repos/{o}/{r}/security/commit-config which writes the final YAML to .vetrix/tooling.yml on the default branch with a standard commit message.

Permissions

Action Grant required
See the wizard PermSecurityRead
Click Save PermPolicyEdit

Saving without the grant returns 403 — the button is disabled on the client but the server re-checks (no UI bypass).

Rate limit

10 wizard commits per hour per user-per-repo. Bot-thrash guard. Exceeding returns HTTP 429; wait one hour.

Hand-editing

The YAML is always editable by hand. The wizard does not overwrite fields it does not know about — unknown keys at a depth the wizard doesn't render are preserved on round-trip. This means:

  • A team can start in the wizard and drift into hand-edits as needs grow.
  • The wizard always matches the committed YAML, so edits made in a PR are reflected on the next Configure visit.

Learn more