Does ShipGuarde comment on every pull request?
No. Reviews are explicit by design - add the shipguarde label, comment @shipguarde run, or call it from CI. Nothing runs until you ask, so there is no drive-by comment on every commit.
Do you run my code? Is it safe?
We never run your repository's own scripts, tests, or build. Your code is analyzed in an isolated, secret-starved sandbox using only our own tools, with a short-lived token scoped to the one repo and read-only. The GitHub App key and other tenants' data never enter that sandbox, and its network access is limited to GitHub and package registries.
Can it block a merge?
By default a block is advisory - a neutral check. Opt in with failCheckOnBlock (in project settings or an in-repo .shipguarde.yml) to make it a failing check you can require in branch protection, or gate CI with the Action's fail-on setting.
How do I use it in CI?
Use shipguarde/review-action@v1 (or call POST /api/runs) with an sg_pat_… API key. It starts a PR-mode run, waits for the verdict, and exits non-zero per your fail-on setting so the job gates the merge.
How does visual QA work without selectors?
A vision model looks at the rendered screen and locates each target, then a separate verifier confirms the step actually worked. Because it grounds on what is visible - not CSS selectors - your flows survive redesigns that would break selector-based tests.
Does it work with preview deployments?
Yes. Point ShipGuarde at a preview URL and describe the flow to check. It can test public previews immediately, or use encrypted credentials for a test account when the relevant pages require sign-in.
Which languages and frameworks does it support?
Code review, secret scanning, and security analysis work across languages; lint reports new issues from your repository's own configured linter. Visual QA runs against any web app, whatever stack it is built on.
What GitHub permissions does it need?
Least privilege: it reads code through short-lived, repo-scoped tokens and writes checks and pull-request comments. It deliberately does not require write access to your file contents.
Can I run it on a schedule or against any URL?
Yes. Run a flow against any public URL on demand or on a cron schedule, and provide credentials (encrypted at rest) so it can sign in and test authenticated pages.
How is it priced?
Two meters, billed separately: visual-QA runs and PR reviews. Every plan starts with a free trial, no credit card. See the
pricing page for the details.
What does a verdict mean?
Every run ends in one decision - ship, ship with notes, or block (occasionally inconclusive) - with findings grouped by category and a step-by-step trace so you can see exactly how it got there.