feat(ci): add Quality Orchestrator action for PR risk analysis#147
Merged
Conversation
RCA: No automated PR risk analysis or test coverage mapping existed in the CI pipeline Fix: Add parallel quality-analysis job using mrdailey99/QualityOrchestrator@v1 to score PR risk and post coverage comments Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…sis job RCA: @v1 tag does not exist on the action repo; mutable tag and unvalidated stub paths posed supply chain and path-traversal risk Fix: pin to @v1.0.0, disable stub generation, add persist-credentials: false to checkout step Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new GitHub Actions job to run PR risk analysis in parallel with the existing CI workflow for PRs targeting develop.
Changes:
- Introduces a
quality-analysisjob that checks out the repo and runsmrdailey99/QualityOrchestrator@v1.0.0. - Configures minimal permissions for reading contents and writing PR feedback, with
persist-credentials: false. - Ensures the analysis is non-blocking (
fail-on-high: 'false').
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a parallel
quality-analysisjob toCI_Execution.ymlthat runs on every PR targetingdevelop. The job usesmrdailey99/QualityOrchestrator@v1.0.0to:The job runs in parallel with
provardx-ci-executionand never blocks merges (fail-on-high: false).Pre-Landing Review
Adversarial review found 4 issues — all fixed before merge:
@v1tag does not exist on action repo → pinned to@v1.0.0generate-stubs: falsepersist-credentialsnot disabled before third-party Python process runs → addedpersist-credentials: falsefail-on-high: falsemeans no merge blocking — intentional; can be flipped totruewhen confidence in the action is establishedTest Coverage
Workflow YAML only — no application code paths changed.
Test plan
developand verify thequality-analysisjob appears and posts a risk comment🤖 Generated with Claude Code