farol 0.2.1

• PR comment follows the report. Merge risk and verdict in the title, one sentence on where the risk comes from, Must check as a task list, the High and Medium files with their share of the score, and how much new code is tested; the other signals move to a collapsed All signals block. Points match the report: a file's findings are parts of their own (a file no longer shows "risk 34" with its security finding inside).
• Diff coverage: files left out on purpose are no longer untested. A changed file missing from the coverage report is excluded by the project when the report shows it lists files no test loaded (Vitest coverage.include, coverage.py source, Jest collectCoverageFrom when an unloaded file has top-level code); files that only declare things (types, static constants) have nothing to run. Both, and signals.coverageIgnore files, keep half their risk instead of all of it, and the report lists them apart.
• Report: syntax highlighting in the diffs (TypeScript/JavaScript, Go, Python, GraphQL) and the whole screen width for the review area; running text keeps a readable width.
• Social preview image in the new look.
• Routes with a computed path are no longer safe by default (#6). In Python (FastAPI, Flask), Go and TypeScript REST (Express, Fastify), a route whose path is computed at run time is dynamic-route (the PR is unknown) when the PR adds it or changes the file that registers it: it may take the URL of an existing route. TypeScript REST used to drop such routes; they are now entry points. Untouched ones stay as they were.
• Go: no toolchain download. go list in the analyzed repository runs with GOTOOLCHAIN=local: a go.mod that needs a newer Go than the installed one makes the analysis unknown with that message, instead of trying to download a toolchain (analyze never uses the network).
• Example workflows: coverage even when a test fails (--coverage.reportOnFailure): Vitest writes no report after a failing run by default, and farol then counted every changed line as untested.
• Command-line tools in TypeScript. With "surface": "backend", commander, cac and yargs commands are entry points (CLI analyze), like REST endpoints: a change is ranked by the commands that run it (backend.cli, on by default).
• farol reviews its own pull requests (.github/workflows/farol.yml), with the action of the pull request itself (read-only) and the coverage of its tests; farol-comment.yml (workflow_run) posts the comment. report takes --since-in / --since-report-url like comment.
• What farol could not read goes to Must check. An unknown part of the score is checked by hand, never cleared by reviewing a file: a low score with such a part no longer says "likely safe to approve".

npx @winninjs/farol@0.2.1 routes

Live demo: https://winnin.github.io/farol/demo/

farol 0.2.0

• New HTML report: a review workbench. A side rail with the live merge risk, Must check (breaking contract changes, security findings, lint errors and vulnerable dependencies, each confirmed on its own) and the files by risk (High, Medium, Skim, Test files), each with a "reviewed" box. One file at a time with its diff, the lines no test ran marked, and links to comment on any line in GitHub. A dependency view with the bump and how to check it. Can affect with the pages to try by hand and feature flags. Results: a Markdown record of the review for the PR comment. The risk turns green when it is low and nothing is left to check. The former sections stay in Details.
• Merge risk score: dependency bumps weigh by how much they can break (a 0.x minor 8 points instead of 25); a lint error on the line of a security finding counts once; findings in files outside the project no longer count.
• Website and demo follow the new report.

npm: npx @winninjs/farol@0.2.0 · demo: https://winnin.github.io/farol/demo/

farol 0.1.2

farol tells the person who approves a pull request how risky the merge is and which files carry the risk, so the riskiest changes get the most attention. It is a free, open-source CLI and GitHub Action, and it works from static analysis: it never executes your code and never blocks a merge.

Try it: live demo · npx @winninjs/farol routes · get started

What's new in 0.1.2

• GitHub Marketplace: action.yml at the repository root, so farol can be listed in the Marketplace. uses: winnin/farol/action@… keeps working: both point at the same action, kept in sync by a test.
• Website and live demo: https://winnin.github.io/farol/, with the CI reports of a demo pull request on the FastAPI full-stack template.
• Social preview image for the repository and the website.

What farol does

• Verdict and merge risk score: fast track, quick review or careful review, with the reasons.
• Riskiest files first: reach (centrality in a declaration graph built with your compilers) times what diff coverage leaves, with inline diffs that mark untested lines and findings.
• Impact: every page, endpoint, RPC method, job or script the change reaches, with the call chain.
• Diff coverage, lint and security findings on the changed lines, from the reports your CI already produces.
• Contract changes for GraphQL, FastAPI, Go handlers and gRPC: breaking, dangerous and safe.
• Dependencies: critical bumps and known vulnerabilities in what the PR adds or changes.
• Suggested reviewers from git blame on the riskiest code, plus CODEOWNERS.
• Incremental mode: after a push, a report with only the commits since the previous one.
• Test plan that follows your review, pages behind a feature flag, and a copyable review record.
• Optional Datadog traffic and errors for the affected pages and endpoints.

Supports React Router, Next.js and TanStack Router frontends; TypeScript (GraphQL/REST), Go and Python backends.

npm: @winninjs/farol · Full changelog: CHANGELOG.md