lucheeseng827/Mergestro Gate
Behavioral merge gate for AI-generated code: mutation-tests your PR diff to catch lines your tests don't really cover.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 7, 2026
- License
- Apache 2.0
Pinned Snippet
uses: lucheeseng827/mergestro-gate@d822c0f0c1d6a9a5cf0c41fe8b3a1ac8e0c41d47 # v0.5.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| base-ref | Base branch to diff against. Defaults to the PR's base branch. | no | "" |
| config | Path to a slop-gate YAML config file. | no | "" |
| jobs | Parallel mutant jobs. | no | 4 |
| timeout | Per-mutant test timeout, in seconds. | no | 60 |
| max-per-function | Hard cap on mutants tested per function. | no | 5 |
| test-tool | Test runner cargo-mutants drives: `cargo` (default) or `nextest` (per-process, highly parallel — often 2-3x faster; needs cargo-nextest). | no | "" |
| test-changed-package-only | In a workspace, narrow mutation tests to the changed crate (faster, but a mutant caught only by a downstream crate's tests shows as a survivor). Default runs the whole workspace's tests against each mutant. | no | false |
| max-survivors | Survivors tolerated before blocking (0 = any survivor blocks). | no | 0 |
| advisory | Report but never block (Phase 1 behaviour). | no | false |
| block-on-zero-assertion | Also block when assertion-free tests are found. | no | false |
| block-on-severity | Block when a survivor reaches this tier (low|medium|high|critical). Phase 4. | no | "" |
| debt-budget | Per-PR structural-debt budget (net complexity + duplication + coupling). Phase 4. | no | "" |
| block-on-debt | Also block when the debt-delta exceeds the budget. Phase 4. | no | false |
| block-on-pattern | Block when a pattern lane flags something. Comma-separated; each value is a lane (slop|security|convention|all) or a rule id (e.g. hardcoded-secret, unknown-crate-import). Advisory if empty. | no | "" |
| comment | Post / update the report as a PR comment. | no | true |
| metrics-file | Append a JSON-Lines validation record to this file (Phase 3). | no | "" |
| metrics-url | POST the run's telemetry to a Mergestro `/v1/ingest` URL so the hosted fleet views (retention, disable-rate, fix-vs-override) see this run. Best-effort and time-bounded — a slow or unreachable endpoint logs a warning and never fails the gate. Leave empty to skip upload. | no | "" |
| metrics-token | Bearer token for the Mergestro tenant, sent as `Authorization: Bearer <token>` on the metrics-url POST. Pass a secret; it is masked in logs. Required when metrics-url points at an authenticated Mergestro instance. | no | "" |
| enable-python | Install Python + cosmic-ray so changed `.py` files are mutation-tested (advisory PoC). Off by default — your project's own test deps (e.g. pytest) must already be installed for the Python suite to run. | no | false |
| python-version | Python version for the Python toolchain (when enable-python). | no | 3.x |
| cosmic-ray-version | Pinned cosmic-ray version (when enable-python). Pin to a known-good release for reproducible CI. | no | 8.4.6 |
| version | Release tag of the prebuilt slop-gate binary to install. | no | v0.5.0 |
| token | GitHub token used to post the PR comment. | no | "" |
| release-token | Token with read access to the action repo's releases, used to fetch the prebuilt binary via the authenticated GitHub asset API. Required when the action repo is PRIVATE (the default GITHUB_TOKEN of a *different* consumer repo cannot read it — supply a PAT or GitHub App token). Leave empty for a public action repo. Also used to authenticate the source-build fallback. | no | "" |
Outputs
no outputs