---
title: Rules
description: Choose checks for your repository, tune their thresholds, or create a rule from a signal.
---

A **rule** evaluates one condition, such as whether a pull request touches at most 200 files. Repository rules apply on their own. Rules inside a **workflow** can run on a particular trigger, use exceptions, or lead to different actions.

## Repository rules

The **Library** lists rules available to the repository. The **Installed** tab shows active rules and their settings. Underlined values are editable, such as the file limit for **Max files changed**.

<a className="docs-capture docs-capture-rules" href="/screenshots/installed-rules.jpg">
  <img src="/screenshots/installed-rules.jpg" alt="Installed rules with Account age set to seven days and Max files changed set to 200 files. Open full screenshot." />
</a>

The installed Account age and Max files changed rules show their current thresholds.

**Used in a workflow** identifies rules included in a workflow. Those steps have their own settings. The repository’s install toggle applies to standalone use.

## Built-in rules

| What you want to check | Rule |
| --- | --- |
| Minimum age of the contributor’s account | Account age |
| Prior merges in repositories owned by someone else | Merged change requests |
| Number of recent pull requests from one contributor | Rate limit |
| Number of files touched by the pull request | Max files changed |
| Whether a change touches a protected path such as `.github/workflows/**` | Honeypot paths |
| Cryptocurrency addresses in titles, comments, or patches | Crypto address |
| Whether the contributor has enough text in their profile | Profile README |
| Whether the author owns public repositories with enough stars | Owned repositories by stars |
| Prior merges in public repositories with enough stars | Merged pull requests by repository stars |

The two star checks answer different questions. **Merged pull requests by repository stars** can require five merges in repositories with at least 50,000 stars each, with an option to exclude repositories the author owns. **Owned repositories by stars** checks the author’s own public repositories. These checks use GitHub data.

**Pilot** is in **Shared blocklists** in the **Library**. Once installed on an active GitHub repository, it sends new pull requests from listed accounts to **Human review**. [Pilot](/pilot).

## Custom rules

A custom rule compares a **signal** with a value. Signals are facts Tripwire reads or calculates from forge data, such as a pull request’s file count or the author’s username. The available comparisons depend on the signal. A file count can have a maximum. A username can be compared with a list. [Signals in Concepts](/concepts#signals).

For example, a rule can require that the author’s username is outside a list of accounts. A workflow can route a failed check to **Human review**.

## Rule evidence

**Activity** records why a rule produced its result. For example, a run that reports 410 changed files against a limit of 200 shows exactly why **Max files changed** failed. A **skipped** result means Tripwire lacked enough evidence to evaluate the condition. Changing the limit won’t supply the missing data.