AI pull request review: every pull request checked before it merges

The quality gate

Each pull request gets a check on GitHub called VibeDoctor Quality Gate. It fails when:

• A changed file contains a leaked secret.
• The PR adds a vulnerable dependency. Only new ones count, not old ones already in the repo.
• The PR adds a security issue on the lines it changes.
• The PR adds a dependency that doesn't exist or is known to be malicious.
• Duplication in new code is above your limit.
• A changed function's cognitive complexity is above your limit.

The first four are on from the start. Turn on the duplication and complexity limits when you want them; they measure JavaScript, TypeScript, Python, C#, PHP, Java, Kotlin and Go. Or pick a preset: Relaxed, Recommended or Strict.

Report only, or block the merge

By default the gate reports: a failed gate shows on the pull request, and it can still merge.

To stop a failing pull request, turn on Block merge on GitHub, then require the VibeDoctor Quality Gate check in the repo's branch rules. You also choose what happens if VibeDoctor can't check a pull request: let it merge, or block it.

Review comments

Next to the check, VibeDoctor posts one review comment: AI notes on the changed code, each with its file and line, and a table of the gate's rules. Secrets are masked in everything we post.

How to set it up

1. Add a project at app.vibedoctor.io and connect its GitHub repository.
2. Open Quality Governance, then Settings, and pick a preset or set your own rules.
3. Open or update a pull request. The check and the review appear on it.

Pick which pull requests to review: only those into certain branches, and drafts too if you want them.

FAQ