glinr-bot

A GitHub App that reads a policy file, checks each pull request against it, and says why. In shadow mode it only comments. In enforce mode it can also approve and arm auto-merge, and GitHub still waits for the required checks.

How it works

• Trigger: pull_request_target, so the app secrets are available to Dependabot and same-repo PRs.
• Safety: the job checks out the base branch only. The policy and the evaluator come from the base, so a PR cannot edit its own rules, and nothing from the PR is built or executed. It reads the PR through the API.
• Output: one comment per PR, updated in place, with a table of gates.

The policy file

.github/glinr-bot.yml:

Key	Meaning
mode	shadow comments only, enforce may approve and merge
deny_paths	globs that always send the PR to a person
block_labels	labels that always send the PR to a person
rules[].authors	exact logins allowed
rules[].paths_only	every changed file must match one glob
rules[].max_files, max_changed_lines	size limits
rules[].update_types	patch, minor or major, read from "from X to Y" in the title
rules[].title_prefix	required title start
rules[].actions	comment, approve, automerge

Global gates apply before any rule: not a draft, not from a fork, touches no denied path, no blocking label. The first rule whose gates all pass wins.

Rollout pattern for other repos

1. Install the app on the repo and set the RELEASE_APP_CLIENT_ID variable and RELEASE_APP_PRIVATE_KEY secret.
2. Copy .github/workflows/glinr-bot.yml, .github/glinr-bot.yml and scripts/glinr-bot/.
3. Start with mode: shadow and read the comments for a week.
4. Move the lowest-risk rule to enforce first, for example docs only.

What it does not do

It does not review code quality, does not merge past failing required checks, and never acts on a fork or on a path in deny_paths.