mitigation-dot-team/MergeShield - PR Risk Analysis
Calculates a risk score (0-10) for each PR using heuristics + LLM. Risk visibility for CTOs.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| mergeshield-api-key | MergeShield API key for plan validation and account association. Get yours at https://mitigation.team | yes | — |
| github-token | GitHub token to access the API (pull requests, comments) | yes | — |
| llm-provider | LLM provider: openai (Starter+Premium), claude, azure, gemini (Premium only). Default: claude | no | claude |
| llm-api-key | API key for the selected LLM provider (optional) | no | "" |
| llm-model | Model to use. Default: gpt-4o-mini (OpenAI), claude-3-5-sonnet-20241022 (Claude), gpt-4o-mini (Azure), gemini-1.5-flash (Gemini) | no | "" |
| enable-llm | Enable contextual LLM analysis (requires llm-api-key) | no | false |
| risk-threshold | Minimum score to fail the check (0-10). Default: 7 | no | 7 |
| webhook-url | Webhook URL to send analysis results to (optional) | no | "" |
| webhook-secret | HMAC secret to sign the webhook payload (optional but recommended) | no | "" |
| internal-reporter-url | MergeShield internal system URL to report analysis results (optional) | no | "" |
| internal-reporter-secret | HMAC secret to authenticate with the internal system (optional but recommended) | no | "" |
| comment-language | Language for the PR comment: en (English) or es (Spanish). Default: en | no | en |
Outputs
| name | description |
|---|---|
| risk-score | Final risk score (0-10) |
| risk-level | Risk level: low, medium, high |
| heuristic-score | Heuristic analysis score (0-10) |
| llm-score | LLM analysis score (0-10), empty if LLM is disabled |
| llm-justification | LLM justification |