Agents / Guide

Replace three CI checks with one pre-merge review call

Send one unified diff and get a single merge decision that combines logic and security review, secret, dependency and SAST scans, and the hidden-Unicode check.

One diff in, one decision out

The Pre-Merge Review Pack runs the pull request merge gate (bug review, suggested patches, secret, dependency and SAST scans) and the hidden-Unicode scan in one request. You send a unified diff; you get mergeApproved plus the result of each stage. That replaces wiring a reviewer, a secret scanner and a Unicode check together and reconciling their exit codes.

Only diff is required. packageJsonDiff adds the manifest change for dependency checks, and context is a sentence on what the pull request is meant to do, which lets the reviewer flag changes that do something else.

Request
gh pr diff 128 > pr.diff
jq -Rs --arg ctx "Admin check change" '{diff: ., context: $ctx}' pr.diff > body.json

curl -sS -X POST "https://$RAPIDAPI_HOST/v1/bundles/pre-merge-review" \
  -H "Content-Type: application/json" \
  -H "X-RapidAPI-Key: $RAPIDAPI_KEY" \
  -H "X-RapidAPI-Host: $RAPIDAPI_HOST" \
  -d @body.json > result.json

jq '.data | {mergeApproved, gate: .results["diff-gatekeeper"].verdict, unicode: .results["unicode-safety-gate"].verdict}' result.json

A real run

On the same one-line change as the Trojan Source guide (an isAdmin check with hidden bidirectional characters), the pack returned mergeApproved: false. The reviewer stage reported a fail with a risk score of 85 and three blocking findings: the invisible characters (critical, src/auth.js:2), a changed return contract for isAdmin (high, src/auth.js:1), and an unjustified special case that returns true for a role other than admin (high, src/auth.js:2). The Unicode stage independently returned block.

Each finding has a rank, kind (security, bug, breaking_change), severity, file, line, a fix, and blocking. The top-level nextStep names the first thing to change.

Print the blocking findings
jq -r '.data.results["diff-gatekeeper"].topFindings[]
  | select(.blocking)
  | "\(.severity)\t\(.file):\(.line)\t\(.title)"' result.json

Gate on the right field

Use mergeApproved for the pass or fail decision. The reviewer stage uses a language model, so the wording of findings varies between runs on the same diff; the response marks this with deterministic: false. Do not diff the text across runs. The verdict values for the reviewer stage are pass, warn, fail and inconclusive; treat inconclusive as a request for human review, not as a pass.

Reviewers see only the diff. Pass context for anything the diff cannot show, such as the ticket the change implements.

CI step
test "$(jq -r '.data.mergeApproved' result.json)" = "true" || {
  jq -r '.data.results["diff-gatekeeper"].nextStep' result.json
  exit 1
}

Try it

  • Subscribe on RapidAPI and call it with your key.
  • Prefer to pay per call in USDC with no account? The same request body goes to POST https://agents.writerslogic.com/api/v1/bundles/pre-merge-review; see the endpoint documentation.
  • Every response is signed and can be checked for free at POST https://agents.writerslogic.com/api/v1/verify-provenance.

More guides for this API