250+organizations install via GitHub Marketplace

Org engineering standards live in wikis. Nothing checks pull requests against them.

Warestack checks every pull request and deployment in your GitHub organization against the standards you already wrote. Was it approved by the right people, tested, linked to an issue, and kept in scope?

Get started

Install from GitHub Marketplace

Free for open source projects and for teams that ship a light volume.

ci(preview): pin the kaniko executor and pass base_ref through the build#1182

Openamira wants to merge 4 commits into main from ci/orb-418-pin-kaniko

Some checks were not successful1 failing, 2 successful checks

CodeQL— Successful in 2m

Run pre-commit hooks— Successful in 41s

Warestack Rules— 1 blocking rule violation

1 blocking Warestack rule violation detected.

Detect pull request scope drift: Linked Linear issue ORB-418, Batch mute alert rules by label, does not match this pull request. The change pins the kaniko executor and passes base_ref through the preview build.

Recommended action: Limit the pull request to ORB-418, or link the issue that describes this build change.

Merging is blockedRequired statuses must pass before merging.

Merge pull requestYou can also merge from the command line. View instructions.

This is what a reviewer sees on the pull request. Sample data from a workspace.

GitHub Technology Partner

01How it works

A rule finds the problem. A chain acts on it. A report keeps the record.

one pull request · waitingQueued

Pull request

Rule

Slack

GitHub

Linear

Report

01Rules

Write a standard in plain English and Warestack turns it into checks you can read before turning them on. A catalog covers the common ones: linked issues, independent approvals, scope, size, tests, deploy windows.

A rule, as written

Pull requests that change db/migrations/ must include a Rollback section.

Enabled on orbital/control-plane. 14 pull requests checked this week, 2 flagged.

02Chains

When a rule fails, a chain decides what happens: a comment on the pull request, a live card in Slack, a note on the Linear or Jira issue, a message to the owner if nobody acts. One problem, one notification, escalated on a timer.

A chain, running

Review requested → live card in Slack → after 12h, message the reviewer → after 24h, the owner.

Ran 318 times in 30 days; 291 resolved early.

03Reports

Ask a question in plain English and get the answer with the rows behind it. Schedule it to Slack or email, export the CSV, and keep every run. The record for the auditor, the board, or the incident review.

A report, answered

Which production deployments in the last 30 days had no independent approval?

3 rows · orbital/control-plane, orbital/billing-service · CSV attached

Not a code reviewerWarestack checks how a change was delivered, not what the code says. It does not review code, run your CI or orchestrate coding agents. People and agents are held to the same standards at the same point, the pull request.

02Where it shows up

It shows up where your team already works.

GitHub connects first. Slack, Linear and Jira share the same rules, the same chains and the same record. Nothing new to adopt.

03Rollout

As wide as the organization. As narrow as one folder.

Every rule is enabled on a scope you choose: a team, a repository, or a path inside one. Different rules, different scopes, one organization. New repositories join their team's rules as they arrive.

teamPlatform gets independent production approval on all seven of its repositories, including the ones created next quarter.

repobilling-service alone needs a finance-eng approval on pricing changes.

pathcontrol-plane/db/migrations/ is the only place the rollback-notes rule runs. Nowhere else sees it.

Rules report first. Merge blocking is a separate switch, per repository, that stays off until you require the check in branch protection.

Rule 58 · Independent prod approvalteam · Platform

Rule 29 · Finance approval on pricingrepo

Rule 31 · Migration rollback notespath

orbital12 repositories · 3 teams

Platform7 repositories

control-plane

db/migrations/

collector-agent

ingest

auth-service

terraform-modules

sdk-go

cli

Product3 repositories

console-web

billing-service

mobile

Shared2 repositories · no rules

docs

design-system

Merge blockingOff · check not required0 scopes

04Evidence

The record is ready before anyone asks for it.

Ask a question in plain English. Get the answer with the rows behind it, scheduled to Slack or email, exported as CSV. Every run is kept for up to 365 days.

For the auditorApprover, checks, linked issue and deployment for every production change. SOC 2 change management, answered from the record.

For the incident reviewWhat shipped, when, and who approved it, without reconstructing it from chat history.

Question

Answer

3 of 186 production deployments were approved by the person who requested them.

RepositoryDeployApproved byFinished

control-plane#2061rdiaz, the requesterSep 30

billing-service#598tobiaslind, the requesterSep 24

collector-agent#418ipetrov, the requesterSep 19

3 rows · ran just now · kept 365 daysDownload CSVSchedule weekly

05The pilot

Four weeks on one to three repositories.

A paid pilot with the success metric agreed before anything is installed. Nothing blocks a merge during the pilot unless you decide it should.

Week 1

Install and observe

The app on the pilot repositories. Rules from the catalog plus two of yours, reporting only. The baseline is recorded.

Weeks 2 to 3

Chains on

Live cards in Slack, the timeline on Linear or Jira, escalation to named owners. Rules are tuned against real pull requests.

Week 4

Review the evidence

The metric against the baseline, from the reports. Decide which rules become required checks, and on which repositories.

Free · 100 governed changes a month, 14-day retention$0

Pro · Allowances for changes, reports, briefs, and chains, then usage rates. No seat limits$49 /mo

Enterprise · 365-day retention, full audit trail, SSO/SCIM, SLAFrom $1.5K /mo

Usage is metered per change, report, brief, and chain. Seats are not billed.

What we need from you

A GitHub organization admin for the install, five minutes. A Slack channel. The standards document you already have.

Get started

Install free