Review findings backed by a failing test
After a review, MergeHarbor writes small tests that try to reproduce its findings, runs them in an isolated sandbox against your pull request, and attaches the evidence to the findings it proves.
How it works
Write targeted tests
MergeHarbor writes tests for the review's findings and for edge cases of the functions the pull request changed.
Run them in a sandbox
Each run gets a fresh sandbox with strict limits and no secrets, which is removed afterwards.
Report what happened
Proven findings get the failing test, the command and its output as a reply. Tests that were wrong or flaky are discarded and never posted.
What you get
- Evidence on the finding
- A proven finding's confidence goes up, and the reply shows the test and its output. Browser tests also attach screenshots and traces.
- Keep the tests that pass
- Add any test that passed or proved a finding with one click. MergeHarbor opens a small pull request into your branch and never pushes to it directly.
- Run on request
- Comment @mergeharbor test on a pull request, or select Run tests in the console. Or run them after every review in scope.
- Common stacks detected
- Go, Node.js, Python, Java, Kotlin, Ruby, Rust and .NET projects are detected. Add .mergeharbor/sandbox.yml when your project needs more.
- A locked-down sandbox
- No credentials, no network except package registries during install, and output scanned for secrets and redacted before it is stored or shown.
- Counts in the merge gate
- A finding a test reproduced counts as proven in the merge gate, and generated tests that passed raise merge readiness.
Frequently asked questions
What does a proof run cost?
Each run that uses the sandbox costs 2 credits in addition to the review. Proof runs are off by default and included in the Team, Advanced and Enterprise plans.
Can a pull request change how its own tests run?
No. sandbox.yml is read from the branch the pull request targets, so changes to it apply once they merge.
Can I limit when proof runs happen?
Yes. Under Settings → Checks & gates → Proof runs, limit them to some target branches or paths, skip drafts, and set tests per run and runs per month. Each repository can override these.
Have another question? Ask our support team
Review every pull request with the context of your whole codebase
Connect a code host in minutes. Reviews start right away, and codebase context is added as indexing completes.