AI-powered risk analysis for pull requests — a GitHub Action by MergeShield

Analyzes code changes using Claude AI and provides a risk score with pass/fail CI status across 6 dimensions: complexity, security, blast radius, test coverage, breaking changes, and dependency risk.

name: MergeShield Risk Check
on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  statuses: write    # Required for commit status
  contents: read
  pull-requests: read

jobs:
  risk-check:
    runs-on: ubuntu-latest
    steps:
      - uses: mergeshield/risk-check@v1
        with:
          api-key: ${{ secrets.MERGESHIELD_API_KEY }}

Note: No actions/checkout step is needed — the action sends PR metadata to the MergeShield API, which fetches the diff using the provided GitHub token.

Note: risk-score, risk-level, analysis-id, analysis-url, and summary are only set when status is completed. Use fail-on-error: false with steps.<id>.outputs.status to handle all cases.

The action needs the following GitHub token permissions:

permissions:
  statuses: write    # To set commit status (mergeshield/risk-check)
  contents: read     # To read repository data
  pull-requests: read # To access PR metadata

If your repository or organization uses restrictive default permissions, add the permissions block to your workflow file.

1. Create an account at mergeshield.dev
2. Generate an API key in Dashboard > Settings
3. Add the secret to your repo: Settings > Secrets > MERGESHIELD_API_KEY
4. Add the workflow file above to .github/workflows/

- uses: mergeshield/risk-check@v1
  with:
    api-key: ${{ secrets.MERGESHIELD_API_KEY }}
    risk-threshold: 75  # Only fail on high/critical risk

- uses: mergeshield/risk-check@v1
  id: risk
  with:
    api-key: ${{ secrets.MERGESHIELD_API_KEY }}
    fail-on-error: false

- name: Comment on PR
  if: steps.risk.outputs.risk-level == 'critical'
  uses: actions/github-script@v7
  with:
    script: |
      github.rest.issues.createComment({
        owner: context.repo.owner,
        repo: context.repo.repo,
        issue_number: context.issue.number,
        body: `Warning: Critical risk detected (${steps.risk.outputs.risk-score}/100). [View analysis](${steps.risk.outputs.analysis-url})`
      })

- uses: mergeshield/risk-check@v1
  with:
    api-key: ${{ secrets.MERGESHIELD_API_KEY }}
    fail-on-error: false  # Don't fail the workflow

1. Trigger: When a PR is opened or updated, the action sends the PR details to the MergeShield API
2. Analysis: Claude AI evaluates the code changes across 6 risk dimensions
3. Score: A risk score (0-100) is computed with a risk level (low/medium/high/critical)
4. Status: A commit status (mergeshield/risk-check) is set on the PR with pass/fail based on your threshold
5. Summary: A GitHub Actions job summary table is written with the results and AI summary

• Documentation
• Dashboard
• Guides
• Pricing

MIT