ENGINEERING
Block high-risk dependency bumps until a senior reviewer signs off
Grades each dependency-bump PR from its changelog and, when the risk is high, posts a blocking review and assigns a senior reviewer so the bump cannot merge unattended.
How it runs
The automated pipeline, trigger to output.
- TriggerDependency-bump PR opened or updatedGitHub
- ActionFetch changelog for the version spanGitHub
- ActionLLM grades risk + lists breaking signalsOpenAI
- LogicContinue only if grade is high
- ActionPost blocking REQUEST_CHANGES reviewGitHub
- OutputAssign senior reviewer from rotationGitHub
What it does
This workflow turns the risk grade into a merge gate. It reads the changelog for the version jump, classifies the breaking-change risk, and only intervenes on `high` results — posting a `REQUEST_CHANGES` review, assigning a senior reviewer, and explaining why in the review body. Low and medium bumps pass through untouched.
When to use it
Use it when you trust most automated bumps to auto-merge but want a hard stop on the dangerous ones — major version jumps, removed APIs, or framework migrations — so they never slip through an auto-merge rule.
How it works
- 1A PR-opened or PR-synchronized webhook fires on dependency-bump PRs.
- 2The flow extracts the package and the old→new version span and fetches the changelog.
- 3An LLM grades the risk and lists the specific breaking signals it found.
- 4A branch checks the grade: anything below `high` ends the run quietly.
- 5For `high` PRs, a blocking GitHub review is posted with the rationale.
- 6A senior reviewer from a configured rotation is assigned as the final output.
Set it up
What you configure once, before turning it on.
- 1Connect GitHubRepos, issues, pull requests, actions.
- 2Connect OpenAIModels, embeddings, files.
- 3Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 4Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 5Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More Engineering workflows
Gate breaking API PRs behind downstream consumer acknowledgement
When a PR introduces a breaking contract change, comments the impact summary back on the PR, applies a blocking label.
Publish a versioned API changelog to Confluence on each release tag
On a new semver release tag, gathers the contract changes since the last release and writes a clean.
Agent reviews model-license fit and suggests compliant swaps on the PR
When a PR adds a Hugging Face model, an agent reads the model card and license, judges fit against your commercial-use policy.
Upgrade Impact Router to Module Code Owners
Maps a dependency-bump PR's affected modules to their CODEOWNERS, then DMs each owner on Slack with only the changelog slice that touches code they own.
Re-Voice IVR Prompts on Phone-Tree Config Merge
When a phone-tree config change merges in GitHub, regenerates the ElevenLabs audio for any prompt whose script changed in the diff and opens a follow-up PR adding the new audio…
Upstream Release to Notion Upgrade Brief
When a watched package publishes a new release, fetches the release notes, maps them to the internal modules that depend on it.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.