assess-merge-risk

Assess GitHub pull requests for reversibility and blast radius as merge decisions.

5|Updated Sep 9, 2017
One-click install
npx skills add https://github.com/hpcsc/dotfiles --skill assess-merge-risk-hpcsc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: assess-merge-risk
Source: https://github.com/hpcsc/dotfiles/tree/main/link/common/claude/.claude/skills/assess-merge-risk
Command: npx skills add https://github.com/hpcsc/dotfiles --skill assess-merge-risk-hpcsc

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? Code reviews answer whether code is correct, but they do not answer whether a PR is safe to merge: how expensive it is to undo, what it reaches if it is wrong, and how quickly a failure would surface. This Skill prices being wrong by grading every effect of a PR on a durability ladder and sizing its exposed population. ## Core Features & Use Cases - Reversibility grading: Enumerates each effect of the change (writes, events, outbound calls, deploy-time actions like migrations and terraform applies) and grades it on a D0–D5 durability ladder, producing a two-way or one-way door verdict with an undo procedure and residue list. - Blast radius analysis: Runs six lenses (code fan-out, deploy surface, traffic, failure loudness, detection time, coupling) and quantifies exposed population with labeled bases — measured, derived, or estimated. - Signal scanning and skeptic pass: Ships scripts that fetch PR metadata via gh and scan the diff for durability and radius signals, then spawns adversarial subagents to attack the draft verdict from both sides. - Use Case: Before merging a PR that adds a database migration and changes an SMS-sending path, run the assessment to learn the migration is a one-way door, the SMS path can reach 40,000 customers before detection, and the smallest merge conditions (a feature flag plus an alarm) that make shipping boring. ## Quick Start Ask the assistant to assess merge risk for PR #123 in the current repository at standard depth.

Frequently Asked Questions about assess-merge-risk

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I assess whether a GitHub PR is safe to merge?▼

Run the assessment with a PR number, owner/repo#N, or URL. It fetches the diff and metadata with gh, scans for durability and blast-radius signals, then prints a glance block with a SAFE TO MERGE, MERGE AFTER, or HOLD verdict plus merge conditions.

How is merge risk assessment different from a code review?▼

A code review asks whether the code is correct; this assessment assumes it might not be and prices being wrong. It grades reversibility of each effect and sizes the blast radius, and deliberately does not hunt defects, approve, or merge anything.

Can I assess merge risk before a pull request exists?▼

Yes. Pass --branch or no ref at all to assess the current local branch against the default branch. It produces the same analysis and file layout using a stub metadata file, with no PR comments or review data.

What tools does the merge risk assessment require?▼

It requires an authenticated gh CLI, jq, python3, and git. The --measure flag additionally uses the repository's own data tooling or CloudWatch to put real numbers on traffic and population, and may need cloud authentication.

What are the limitations of the automated signal scan?▼

The scanner generates leads, not verdicts, and only knows its built-in patterns, so a clean scan proves nothing. Deploy-time behavior like terraform plan outcomes, filter policies, and per-environment flag state is invisible to a diff and must be verified by hand.

When should I use deep depth instead of standard?▼

Choose deep when the scan reaches D4 or D5, or when the PR touches money, auth, customer communications, data migration, or a public contract. Deep fans out one agent per effect cluster, adds failure-mode and detection lenses, and runs three skeptics per side.