Guides

PR bot configuration

Once you install LevelFour on a GitHub organization, the PR bot is on by default for every repository you granted access to. On every pull request, LevelFour reads the Infrastructure-as-Code changes in the diff (Terraform, CloudFormation, AWS CDK, Pulumi, or Kubernetes manifests), computes cost impact, and posts a single check-run comment with the cost breakdown. When LevelFour has concrete patch suggestions, they appear as inline "Suggested change" boxes on the diff itself. The main comment does not list them.

You tune the bot per repo with a .levelfour/config.yml file at the root of the default branch. The file is optional. With no file, the bot uses the defaults documented below.

A dashboard-driven org and per-repo toggle is on the roadmap, so you will be able to silence the bot across thousands of repos at once, or roll it out in stages, without committing a YAML file to every repo. The toggle will take precedence over .levelfour/config.yml. Until then, every per-repo override lives in this file.

Where the file lives

Path: .levelfour/config.yml at the repository root, on the default branch.

The bot reads this file at the start of every pull request analysis. Changes take effect on the next PR or push, never on an analysis that has already run.

To check a file before it matters, copy one of the examples below into your repo and open a draft PR. Validation behavior covers what comes back.

Quick examples

Disable the bot on a single repository

.levelfour/config.yml
enabled: false
The next pull request on this repo gets no comment and no check run.

This does not stop LevelFour reading the repo. See what this file does not control.

Drop inline patch suggestions, keep the cost comment

.levelfour/config.yml
code_suggestions_enabled: false

The bot still posts the cost summary on each PR, but does not propose inline "Suggested change" boxes on the diff.

Exclude test fixtures and a noisy resource type

.levelfour/config.yml
excluded_paths:
  - tests/fixtures/**
  - examples/**
excluded_resource_types:
  - aws_iam_role_policy_attachment

Pin all cost estimates to a specific region

.levelfour/config.yml
region_override: us-east-1

Reach for this when your Terraform omits provider "aws" { region = ... } and the bot would otherwise default to the global price.

Schema

FieldTypeDefaultWhat it does
enabledbooltrueMaster switch. When false, the bot skips this repo. No comments, no check runs.
code_suggestions_enabledbooltrueWhen false, the bot still posts the cost comment but does not propose inline patch suggestions.
max_code_suggestionsint (0 to 25)25Cap on inline suggestion count per PR. Lower it if the bot is too chatty on large changes.
excluded_resource_typesstring[][]Terraform resource type globs to skip. Example: aws_iam_* matches every IAM resource.
excluded_pathsstring[][]File path globs to skip when parsing Terraform. Example: tests/fixtures/**.
region_overridestring or nullnullPin all cost estimates to one AWS region.
graviton_for_managed_services_enabledboolfalseOpt in to Graviton-vs-Intel suggestions for AWS managed services (RDS, ElastiCache, OpenSearch). Off by default while the rule is being tuned.
comment_sections.summarybooltrueShow the top-of-comment summary block.
comment_sections.cost_breakdownbooltrueShow the per-resource cost diff table.
comment_sections.monthly_spendbooltrueShow the monthly spend total.

Glob syntax for excluded_paths and excluded_resource_types

The bot supports * wildcards in both fields:

  • tests/fixtures/** matches every path under tests/fixtures/.
  • aws_iam_* matches every Terraform resource type starting with aws_iam_.
  • examples/*.tf matches Terraform files directly inside examples/, but not in subdirectories.

Without *, the bot matches the string exactly.

Validation behavior

The bot validates .levelfour/config.yml on every PR.

SituationWhat the bot does
An unknown field, at the top level or under comment_sectionsStrips it silently from the parsed config, and reports it as a warning at the bottom of the PR comment
A type mismatch, for example a number where a bool is expectedFalls back to defaults for that field, and warns on the PR
No fileUses all defaults. This is the expected state for most repos
A misspelled key is stripped, so enabld: false leaves the bot enabled and commenting. Read the unknown-field warning on the PR comment before you assume a repo is silent.

What this file does not control

  • Whether LevelFour can read the repo. The GitHub App's repository access, set in your GitHub org settings, decides that. Even with enabled: false, LevelFour still reads the Infrastructure-as-Code for the savings recommendations engine. To stop LevelFour reading a repo at all, remove it from the GitHub App installation. See GitHub onboarding.
  • PR creation by LevelFour. This file affects PRs your team opens. The savings PRs LevelFour opens come from the recommendation engine and ignore enabled.
  • Check runs the dashboard executes. Cost recommendation runs from the dashboard ignore this file.

Next

  • GitHub onboarding is how the app gets installed, and where you change which repos it can see
  • GitHub Actions is a separate feature: calling the LevelFour API from your own CI workflows

GitHub Actions

Workflows that comment a cost summary on a pull request, run a scheduled cost check with the Python or TypeScript SDK, and upload a daily report as a build artifact.

CI/CD Integration

Gate a pull request on cloud cost with l4 estimate and l4 diff, using ready-made workflows for GitHub Actions and GitLab CI.

On this page

Where the file livesQuick examplesDisable the bot on a single repositoryDrop inline patch suggestions, keep the cost commentExclude test fixtures and a noisy resource typePin all cost estimates to a specific regionSchemaGlob syntax for excluded_paths and excluded_resource_typesValidation behaviorWhat this file does not controlNext