Deploy Risk GitHub Action

The Koalr GitHub Action posts a deploy risk score as a PR comment every time a pull request is opened or updated. Engineers see the score before merging — no need to log into the dashboard.

Setup

1. Add the workflow file

Create .github/workflows/koalr-deploy-risk.yml in your repository:

name: Koalr Deploy Risk

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  pull-requests: write

jobs:
  risk-score:
    name: Post deploy risk score
    runs-on: ubuntu-latest
    steps:
      - uses: koalr/deploy-risk-action@v1
        with:
          koalr-api-key: ${{ secrets.KOALR_API_KEY }}

2. Add the API key secret

In your Koalr dashboard, go to Settings → API Keys
Click Create API Key — give it a name like "GitHub Actions"
In your GitHub repository, go to Settings → Secrets and variables → Actions
Add a secret named KOALR_API_KEY with the value from step 2

3. Open a pull request

The action runs automatically on every PR. The comment looks like:

Koalr Deploy Risk Score: 72 / 100 — High Risk ⚠️

Factor Score
Change size 85
Change entropy 90
CODEOWNERS coverage 60
Author file expertise 55
Test coverage delta -3.2%

View full analysis →

Factor	Score
Change size	85
Change entropy	90
CODEOWNERS coverage	60
Author file expertise	55
Test coverage delta	-3.2%

Hard gates

If your organization has enabled Hard Gates, the action will block merge when the score exceeds the configured threshold (default: 85). Configure hard gates under Settings → Deploy Risk.

When a hard gate is triggered, the PR check status is set to failed, preventing merge via branch protection rules. Engineers can request an override from an admin.

Inputs

Input	Required	Description
`koalr-api-key`	Yes	Your Koalr API key
`fail-on-high-risk`	No	Set `true` to fail the check when score > 75 (default: `false`)
`comment-threshold`	No	Minimum score to post a comment (default: `0` — always post)

Troubleshooting

Comment not appearing: Ensure the workflow has pull-requests: write permission and the KOALR_API_KEY secret is set.

Score is 0: The action couldn't find a matching repository in Koalr. Verify the repository is connected under Settings → Integrations → GitHub.

GitHub Action