Code review

Ara can review pull requests in connected GitHub repositories and merge requests in connected GitLab projects. When you choose, Ara can merge Ara-authored change requests after your requirements pass.

The Code Review settings page has two separate controls:

Regular code review

Regular code review is the comments-and-findings workflow. Ara reviews changed code and posts findings directly on the pull request or merge request.

Use it when you want Ara to catch regressions, security issues, missed tests, risky migrations, or repo-specific policy problems before a human merges the change.

What it checks

• Changed files and the pull request or merge request diff.
• Repository context and policy files.
• Test coverage and verification evidence.
• Product boundaries described in your custom prompt.

Set up regular review

Keep this mode on when you want review comments but still want a human to own the final merge decision.

PR Merge Bot

PR Merge Bot is the merge-decision workflow. It is separate from regular review comments, and it can run in either summary-only mode or unattended merge mode. For GitLab projects, the same control is labeled MR Merge Bot.

Use it when Ara opens PRs or MRs and you want them merged automatically only after your merge requirements pass.

Merge requirements

The configurable merge requirements are:

• No findings at the accepted risk threshold.
• Only merge Ara-authored PRs or MRs.
• CI is green.
• Ara verification holds.
• Any database migration requires human approval.

If any enabled requirement fails, the change request stays open for a human.

Accepted risk threshold

Choose the highest residual risk Ara may merge:

Anything above the selected threshold stays open.

Review context

PR/MR Merge Bot only reads bot-authored comments and reviews for merge context.

• All review bots includes findings from every detected review bot.
• Ara review bot only restricts context to Ara’s own review bot.

Human GitHub or GitLab discussion is not treated as merge authorization.

Custom prompt

Use the custom prompt for short merge guidelines that are specific to the repository. Good prompts describe required tests, security boundaries, release rules, or files that always need a human.

The prompt can add stricter criteria, but it should not weaken the configured merge gates.

Set up PR Merge Bot

Practical defaults

• Start with comments only before enabling unattended merge.
• Treat medium and high findings as requiring human attention.
• Keep custom prompts short and concrete.
• Put long-lived product rules in repository policy files.