govcms-saas

Development rules for GovCMS Distribution projects, a Drupal-based government website platform. They limit custom work mainly to themes, such as Twig templates, styles, JavaScript, theme hooks, and theme configuration, while protecting infrastructure and core files.

In plain words
What is it for?
Use them when identifying a GovCMS project and deciding whether a change belongs in the theme or in a restricted infrastructure, deployment, or core area.
Why use it?
They help prevent theme changes from breaking the shared platform, deployment setup, or Drupal core. They also make clear which project areas are intended for custom development.

Cursor rule for Cursor

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/abderrahimghazali/cursor-rules/govcms-saas
Clone the repo
git clone --depth 1 https://github.com/abderrahimghazali/cursor-rules

Made for: Cursor.

Per session 37 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 843 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00037 $0.00843
Opus 5 $0.00018 $0.00421
Sonnet 5 $0.00007 $0.00169
Haiku 4.5 $0.00004 $0.00084

Measured 2d ago against content hash 809cf6f9cd04, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

govcms-saas scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/govcms-saas.mdc · 110 lines

What it actually says

name: govcms-distribution-development-standards id: govcms_distribution

description: > This rule defines the constraints and best practices for working with GovCMS Distribution projects. The primary focus is theme-level development only, as the distribution's infrastructure and core functionality should remain unchanged.

project_identification:

  • "docker-compose.yml with GovCMS-specific services"
  • ".lagoon.yml configuration"
  • ".ahoy.yml for GovCMS commands"
  • "Standard GovCMS directory structure"
  • "The .version file will contain 'type: saas'"

development_constraints: restricted_areas: - "docker-compose.yml" - ".docker/" - ".lagoon.yml" - ".lagoon.env" - ".ahoy.yml" - "Core infrastructure files" - "Docker-related configurations" - "CI/CD configurations (.gitlab-ci.yml)" - "Root-level configuration files" allowed_areas: - name: "Theme Development" location: "themes/" modifications: - "Twig templates" - "CSS/SCSS files" - "JavaScript files" - "Theme hooks in .theme files" - "Theme-specific libraries" - "Theme configuration" - "Theme-level preprocess functions" - "Theme-level template suggestions" - name: "Theme-Level Functionality" note: "Implement all custom functionality within theme using relevant theme hooks and practices" modifications: - "hook_preprocess_ functions" - "theme-specific JavaScript" - "Twig templates and includes" - "Theme hooks" - "Library definitions" - "CSS/SCSS modifications"

best_practices: theme_development: - "Follow Drupal 10 theming standards" - "Use Twig templates for markup modifications" - "Implement responsive design patterns" - "Use theme hooks for dynamic content" - "Maintain accessibility standards" - "Use BEM methodology for CSS" - "Implement JavaScript as behaviors" performance: - "Optimize theme assets" - "Use Drupal's library system" - "Implement lazy loading where appropriate" - "Minimize CSS/JavaScript file sizes" security: - "Sanitize all output in Twig templates" - "Use Drupal's Form API for any forms" - "Implement proper XSS protection" - "Follow Drupal security best practices"

implementation_guidelines:

  • "All customizations must be contained within the theme directory"
  • "Use theme hooks instead of custom modules"
  • "Leverage Drupal's theme layer APIs"
  • "Maintain backwards compatibility"
  • "Document all theme modifications"
  • "Use responsive images and optimize assets"
  • "Follow Drupal coding standards"

error_prevention:

  • "Prevent modifications to infrastructure files"
  • "Ensure all development stays within theme boundaries"
  • "Avoid custom module development"
  • "No modifications to distribution core files"

file_patterns: protected: - "docker-compose.yml" - ".docker/" - ".lagoon.yml" - ".lagoon.env" - ".ahoy.yml" - ".gitlab-ci.yml" - "behat.yml" - "phpcs.xml" - "composer." allowed: - "themes//css//" - "themes//js//" - "themes//templates//" - "themes//.theme" - "themes//theme-settings.php" - "themes/*/config//" - "themes//images//" - "themes//fonts//" - "themes//.libraries.yml" - "themes//*.info.yml"

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 110 lines · 37 tokens per session scan A 809cf6f9cd04

Subscribe to this mod's changes

govcms-saas is a cursor rule published in the GitHub repository abderrahimghazali/cursor-rules (2 stars, last pushed 1y ago), licensed MIT. It adds 37 tokens to every session and 843 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.