Merge Guardian

• 

  markdown file of report

• 

  artifacts show json and .md report of risk analysis

• 

  pipeline trigerred on any change in branch or merge request

• 

  successful pipeline flow

• 

  logs and artifacts show risk analysis before merging

Inspiration

Software teams often merge changes with limited visibility into delivery risk until after something breaks in CI or production. Merge Guardian was inspired by a simple question: can we turn every merge request into an early warning system that helps developers ship safer code without adding review overhead?

What it does

Merge Guardian analyzes merge requests and branch changes, then produces a risk score from 1 to 10 with clear reasoning behind the score. It evaluates factors like code delta size, dependency updates, test coverage signals, CI/CD config changes, sensitive area touches such as auth and database paths, and historical instability patterns. It outputs:

A structured JSON report for automation A readable Markdown risk report for humans An optional auto-posted MR note that updates on every run Suggestions, reviewer recommendations, and pipeline risk indicators

How we built it

I built Merge Guardian as a Python-based analysis engine integrated into GitLab CI pipelines. The system:

Collects MR and git metadata, including changed files, diffs, commits, and branch context. Runs rule-based risk intelligence to score and classify risk as Low, Medium, or High. Generates both machine-readable and developer-friendly outputs. Posts or updates a single persistent MR discussion note via GitLab API. Runs across MR, push, and scheduled pipelines to support both reactive and preventive workflows.

Challenges we ran into

Handling incomplete CI contexts, especially shallow history or missing MR metadata. Computing reliable diff ranges across merge request, push, and scheduled pipeline events. Balancing sensitivity and noise so risk signals stay actionable instead of alarm-heavy. Dealing with token permission differences for posting notes across GitLab setups. Designing resilient behavior so analysis degrades gracefully rather than failing the pipeline.

Accomplishments that we're proud of

Built an end-to-end automated risk intelligence workflow, not just a static report script. Delivered dual outputs for both humans and automation systems. Added reusable MR note updating to avoid duplicate comments and keep discussion clean. Included practical reviewer suggestions and sustainability-oriented CI waste insights. Made the pipeline robust enough to keep providing value even with partial data.

What we learned

Developer trust depends on explainability as much as scoring accuracy. Risk tooling is most useful when it fits existing CI workflows and stays non-blocking. Historical repository signals can significantly improve risk context over raw diff size alone. Small UX details, like concise markdown summaries and stable MR comments, improve adoption. Reliability in edge cases is critical for CI-native tools.

What's next for Merge Guardian

Add smarter weighting using project-specific calibration and optional learning from past outcomes. Introduce language and framework-aware detectors for deeper signal quality. Expand governance features such as configurable risk policies and approval gates. Add trend dashboards for repository-level risk over time. Provide tighter integrations with issue trackers and team notification channels.

Built With

• argparse
• ci/cd
• docker
• git
• gitlab
• gitlabrestapi
• json
• python
• re
• shell
• subprocess
• urllib
• yaml