-
-
main page
Inspiration
Incident reports contain hard-earned engineering knowledge, but that knowledge is often forgotten during code review. We built MergeGuard around one question: What if every merge request could learn from everything that had broken before?
What it does
MergeGuard analyzes GitLab merge requests against previous incidents and postmortems. It builds an institutional “scar tissue” graph, identifies related failures and risky patterns, calculates a risk score, and posts an actionable review comment with evidence and a pre-merge checklist.
How we built it
We used FastAPI, SQLite, NetworkX, Pydantic, GitLab’s REST API, and Claude.
Claude converts incident reports into validated risk signatures containing affected files, services, dependencies, root causes, and recurring patterns. SQLite persists the graph, while NetworkX matches new code changes against its relationships.
The final score combines deterministic and AI-assisted analysis:
[ R_{\text{final}} = 0.55R_{\text{heuristic}} + 0.45R_{\text{Claude}} ]
GitLab webhooks trigger assessments automatically, and a stable marker lets MergeGuard update one existing comment rather than creating duplicates.
Challenges we ran into
The biggest challenge was making AI-assisted analysis reliable and explainable. We added strict schema validation, input limits, timeouts, audit events, and deterministic fallback scoring when Claude is unavailable.
GitLab integration also required careful handling of authentication, paginated diffs, transient API failures, Markdown sanitization, and idempotent comments. We built a defense-in-depth dry-run mode so the complete workflow can be tested without modifying a merge request.
Accomplishments that we're proud of
We are especially proud that MergeGuard is more than an AI prompt wrapped in an API. It has persistent organizational memory, deterministic scoring, graceful failure handling, authenticated webhooks, observability, rate limiting, and automated tests.
We also designed clean interfaces for future graph and storage backends while keeping the current version lightweight enough to run locally or in a container.
What we learned
We learned that AI is most effective as a reasoning layer—not the sole source of truth. Combining validated model output with deterministic evidence produces results that are more resilient and easier for developers to trust.
We also learned that postmortems become much more valuable when they actively influence future engineering decisions instead of remaining passive documents.
What's next for MergeGuard
Next, we plan to add semantic code-to-incident matching, a Neo4j graph backend, encrypted object storage, distributed rate limiting and assessment jobs, and stronger organization-wide authorization.
We also want to introduce OpenTelemetry tracing, operational dashboards, policy-based merge gates, and a developer-facing interface for exploring how incidents connect to services and code. As GitLab Orbit evolves, we plan to integrate it for richer project context.
Log in or sign up for Devpost to join the conversation.