Harrison Stephan
All work

GitHub App / Structural Review

PR Impact

A GitHub App that compares dependency graphs across a pull request and reports structural risk where review already happens.

Proof of webhook security, asynchronous analysis, graph comparison, and developer-facing risk communication.

RepositorySource excerpt

01 / Problem

Pull-request review usually exposes changed lines but not the downstream structural consequences of those changes.

02 / What I built

Built a GitHub App that verifies pull-request webhooks, queues analysis, compares dependency graphs for base and head, computes blast radius and structural changes, and creates or updates a Markdown review comment.

System boundary

How the pieces connect.

The request path stays short while Redis and ARQ own bounded analysis jobs, retries, graph caching, and the longer repository comparison workflow.

  1. 01GitHub webhook
  2. 02HMAC verification
  3. 03Redis / ARQ job
  4. 04Base-head graph diff
  5. 05Risk analysis
  6. 06PR comment

Engineering decision

Developer tools are strongest when analysis appears at the decision point with enough evidence to challenge it.

Tradeoff

Moving analysis out of the webhook request adds Redis and worker deployment complexity, but keeps webhook handling bounded and supports retries.

What happens next

The public roadmap still lists broader provider support, a hosted dashboard, notifications, and custom rules as future work.

Implemented proof

What can be evaluated today.

The repository proves an implemented and tested version 0.1 workflow; it does not claim production adoption or scale.

  1. 01

    Fails closed on invalid webhook signatures outside debug mode.

  2. 02

    Fetches fork-safe pull-request refs and caches base/head dependency graphs.

  3. 03

    Reports blast radius, architecture violations, cycle changes, coupling alerts, and risk.

Source proof

A decision visible in code.

PR Impact / Pythonapp/analysis/pipeline.py
  1. 1. Clone both branches (base and head) into temp directories
  2. 2. Load repo config (.pr-impact.yml) if present
  3. 3. Build dependency graphs for both using the engine
  4. 4. Diff the graphs to find structural changes
  5. 5. Compute blast radius for all changed files
Line 5Review the graph, not only the diff.

Blast radius is calculated from the base/head graph comparison instead of inferred from changed-line count.

Next case study

DepGraph