PR bot configuration

Once you install LevelFour on a GitHub organization, the PR bot is on by default for every repository you granted access to. On every pull request, LevelFour reads the Terraform and CloudFormation changes in the diff, computes cost impact, and posts a single check-run comment with the cost breakdown. When LevelFour has concrete patch suggestions, they appear as inline "Suggested change" boxes on the diff itself. The main comment does not list them.

You tune the bot per repo with a .levelfour/config.yml file at the root of the default branch. The file is optional. With no file, the bot uses the defaults documented below.

Where the file lives

Path: .levelfour/config.yml at the repository root, on the default branch.

The bot reads this file at the start of every pull request analysis. Changes take effect on the next PR or push, never on an analysis that has already run.

To check a file before it matters, copy one of the examples below into your repo and open a draft PR. Validation behavior covers what comes back.

Quick examples

Disable the bot on a single repository

enabled: false

This does not stop LevelFour reading the repo. See what this file does not control.

Drop inline patch suggestions, keep the cost comment

code_suggestions_enabled: false

The bot still posts the cost summary on each PR, but does not propose inline "Suggested change" boxes on the diff.

Exclude test fixtures and a noisy resource type

excluded_paths:
  - tests/fixtures/**
  - examples/**
excluded_resource_types:
  - aws_iam_role_policy_attachment
  - AWS::Logs::*

Write each type the way its own language does: aws_* for Terraform, AWS::Service::Resource for CloudFormation.

Price a CloudFormation template with its production parameters

cloudformation:
  samconfig_env: prod
  parameter_files:
    stacks/app.yaml: stacks/params/prod.json

The bot prices stacks/app.yaml with the values in stacks/params/prod.json, and reads the prod environment from any samconfig file beside a template. CloudFormation has the order the bot reads them in.

Pin all cost estimates to a specific region

region_override: us-east-1

Reach for this when your Terraform omits provider "aws" { region = ... } and the bot would otherwise default to the global price. For CloudFormation it also wins over the region in samconfig.

Schema

Limits

excluded_paths, excluded_resource_types and cloudformation.paths each take at most 100 globs of up to 256 characters. cloudformation.parameter_files takes at most 400 entries. The bot drops the rest and warns on the PR comment.

Glob syntax for excluded_paths, excluded_resource_types and cloudformation.paths

A * matches any run of characters, slashes included:

• tests/fixtures/** matches every path under tests/fixtures/.
• aws_iam_* matches every Terraform resource type starting with aws_iam_.
• AWS::Lambda::* matches every CloudFormation Lambda type.
• examples/*.tf matches every Terraform file under examples/, in subdirectories too.

Without *, the bot matches the string exactly.

CloudFormation

A parameter takes the first value the bot finds:

1. The file cloudformation.parameter_files maps to the template
2. parameter_overrides in the samconfig.toml, samconfig.yaml or samconfig.yml in the template's directory, under the cloudformation.samconfig_env environment. A samconfig applies to the template its template_file names. With no template_file, it applies to template.yaml, template.yml or template.json in its directory
3. The Default the template declares

A parameters file is JSON in the AWS CLI format or the CodePipeline template configuration format:

[
  { "ParameterKey": "InstanceType", "ParameterValue": "m7g.large" },
  { "ParameterKey": "Environment", "ParameterValue": "prod" }
]

{
  "Parameters": {
    "InstanceType": "m7g.large",
    "Environment": "prod"
  }
}

The region comes from region_override, then from the samconfig environment, then defaults to us-east-1. A nested stack takes the parameters its parent passes down and the parent's region.

The cost comment lists the values the bot had to assume under Assumptions. Pull request bot covers what the bot reads and what it cannot price.

Validation behavior

The bot validates .levelfour/config.yml on every PR.

What this file does not control

• Whether LevelFour can read the repo. The GitHub App's repository access, set in your GitHub org settings, decides that. Even with enabled: false, LevelFour still reads the Infrastructure-as-Code for the savings recommendations engine. To stop LevelFour reading a repo at all, remove it from the GitHub App installation. See GitHub onboarding.
• PR creation by LevelFour. This file affects PRs your team opens. The savings PRs LevelFour opens come from the recommendation engine and ignore enabled.
• Check runs the dashboard executes. Cost recommendation runs from the dashboard ignore this file.

Next

• GitHub onboarding is how the app gets installed, and where you change which repos it can see
• GitHub Actions is a separate feature: calling the LevelFour API from your own CI workflows