Pre-Merge Check

Automated pre-merge code review: diff analysis for bugs and security issues, secret scanning, dependency vulnerability check, license compatibility verification, and GitHub Actions workflow security audit. One call before every merge.

5 steps pre-merge-check

What it runs

Diff Review
Source: Claude Haiku (diff analysis)
Secret Scan
Source: Algorithmic (regex pattern matching for secrets/credentials)
Dependency Audit
Source: Algorithmic (dependency tree analysis, no external data)
Licence Compatibility Check
Source: SPDX License List
Workflow Security Audit
Source: Static analysis (YAML parsing + pattern matching)

The answer returns every step’s result, so your agent can show or check each one.

Inputs

Field	Type	Required	What it is
`diff`	string	Yes	Unified diff text (output of `git diff`)
`context`	string	No	Optional project context (e.g. 'TypeScript API, Hono framework')
`lockfile`	string	No	Optional package-lock.json or requirements.txt for dependency audit
`workflow_yaml`	string	No	Optional GitHub Actions workflow YAML for supply chain security audit

How to call it

# Needs an API key. The whole check is charged once, at the listed price.
curl -X POST https://api.strale.io/v1/solutions/pre-merge-check/execute \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "inputs": {
      "diff": "diff --git a/src/app.ts b/src/app.ts\n--- a/src/app.ts\n+++ b/src/app.ts\n@@ -10,6 +10,9 @@\n app.get(\"/health\", (c) => c.json({ ok: true }));\n+app.get(\"/admin/users\", (c) => {\n+  const users = db.query(\"SELECT * FROM users\");\n+  return c.json(users);\n+});"
    },
    "max_price_cents": 32
  }'

The bundle’s published example input.

Limitations

Input diffs are limited to about 12,000 characters and larger diffs are truncated. Split large changes into separate file diffs.
From step: Diff Review
Generated findings can include false positives or miss subtle issues requiring wider project context.
From step: Diff Review
Structured output is limited to about 2000 output tokens per call; requests exceeding this limit are refused rather than returned truncated. A dense diff can exceed the output limit even within the 12,000-character input limit; an identical retry does not help.
From step: Diff Review
What to do instead: Provide a smaller diff (fewer files or lines) per call
Pattern-based detection of common secret formats — custom API key formats and encrypted secrets will not be detected
From step: Secret Scan
What to do instead: Add custom regex patterns for your organisation's API key formats and service-specific credential patterns
AI-based audit of declared dependencies — cannot detect transitive vulnerability chains or runtime-only dependencies
From step: Dependency Audit
What to do instead: Supplement with npm audit or pip-audit for vulnerability scanning that includes transitive dependencies
Unknown SPDX identifiers are flagged as 'unknown' and treated conservatively.
From step: Licence Compatibility Check
Only supports GitHub Actions workflow YAML. Does not audit GitLab CI, CircleCI, or other CI systems.
From step: Workflow Security Audit
Checks YAML structure and patterns. Cannot verify whether a pinned SHA actually corresponds to a trusted release.
From step: Workflow Security Audit