Source Control & Pull Request Scanning
The fastest way to enforce guidelines is through automatic PR scanning via your source control integration. Pandorian supports GitHub, GitLab, and Azure DevOps.How PR Scanning Works
Once you connect your source control manager during initial setup, PR scanning is automatically triggered on every new PR or push to an existing PR. What happens during a PR scan:- Developer opens or updates a pull request.
- Pandorian scans only the modified files against guidelines.
- Violations appear as inline comments on specific lines and as a summary comment on the PR (if opted in)
- The PR check appears in your source control’s status checks (configurable as required or optional)
PR Actions
Rescan: Re-trigger a scan for an existing PR with the current set of active guidelines applied to it. Useful after updating guidelines or resolving earlier violations. Archive: Archive individual findings that are no longer relevant — archived violations are excluded from future Jira ticket creation and reporting views. Skip CI Check: Manually skip the CI check for a specific PR. The scan will still run, but results will not block the PR build associated with it.Blocking vs. Monitoring Mode
Blocking Mode (recommended for production): Pipeline fails if violations are found, preventing non-compliant code from being deployed. Set exit code 1 when violations > 0. Monitoring Mode (useful for gradual rollout): Pipeline continues regardless of violations. Scan results are logged for visibility. Set exit code 0 and log violations without blocking.Guidelines as Code
High-velocity teams can manage guidelines directly within their code repositories, treating engineering standards as living documentation that evolves alongside the codebase. If your team already uses internal markdown files or AI coding assistant skills, you can sync those same files to Pandorian — ensuring the rules your AI uses to write code are the exact same rules Pandorian uses to validate it.How It Works
- Designate a repository and base directory (e.g.,
/docs/guidelines) in the Integrations tab - Pandorian monitors that directory for
.mdfiles - Any merge to the main branch triggers an update — guidelines are immediately enforced across all associated repositories
File Structure & Metadata
Each Markdown file must contain a YAML frontmatter block with apandorian-metadata section:
| Attribute | Type | Description |
|---|---|---|
id | string | Unique identifier (e.g., scala-expert) |
language_ids | string | Target languages (e.g., scala, python) |
title | string | Clear, actionable rule name |
block | boolean | true to block on violation; false defaults to monitor |
category | string | Area of focus (e.g., security, performance) |
is_active | boolean | Whether this guideline is currently enforced |
tags | list | Strings for filtering and organization |
Supported Categories
Architecture, Code Quality & Maintainability, Reliability & Resilience, Performance & Scalability, Security, Data & Storage, Infrastructure & Environments, ObservabilitySupported Languages
c, cobol, cpp, csharp, dockerfile, elixir, go, haskell, java, javascript, kotlin, lua, perl, php, python, ruby, rust, scala, swift, terraform, typescriptImplementation Example
Create a file namedscala-expert.md in your guidelines directory:
Configuration Steps
- Navigate to Integrations → Connections → Source Control in the Pandorian platform
- Select the repository containing your
.mdfiles - Provide the top-level directory path (e.g.,
/docs/guidelines) - Save to trigger an initial import
Policy as Code
Policy as Code lets you configure repository-level settings as code, so Pandorian knows which guidelines to run and when to block pull requests — without managing these rules outside your codebase. The policy is defined in a.Pandorian/.policy file inside the repo and is applied on every full and PR scan.
Repository Policy Schema
Comprehensive Configuration Example
Scan Policies
Scan Policies let you define exactly where and how guidelines run — which paths to ignore, and which guideline groups to scope to specific files or directories. Repo-level overrides take precedence over org-level defaults. Navigate to Scan Policies in the Pandorian dashboard to configure.Organization Policy
Organization-level policy applies across all repositories by default. Ignored Paths: Paths that should never be scanned, applied to all guidelines. Use this to exclude vendor code, generated files, test fixtures, or any directory that shouldn’t be subject to enforcement. Click Ignore a path to add an exclusion. Guideline Scoping: Restrict a guideline group to specific paths only. Rather than running all guidelines across the entire codebase, scoping rules let you target enforcement by tag — for example, applying security guidelines only to the auth service, or data guidelines only to migration files. Click Add scoping rule to configure.Repository Overrides
Repository overrides let you customize scan policy for a specific repository, overriding the organization defaults. This is useful when a particular repo has different conventions, third-party code that should be excluded, or guidelines that only apply in that context. Click Add repository override to configure.Dynamic Context Providers
Dynamic Context Providers connect external data sources directly to your guidelines, ensuring they evaluate code against real-time context — approved libraries, internal API routes, active feature flags — rather than static hardcoded lists.Configuring a Provider
When creating or editing a guideline, add a provider with:- Title: Descriptive name (e.g., “Approved Config Flags”)
- Command: The exact command Pandorian executes to fetch data (e.g., a
curlto your internal API) - Grep: Optional regex to filter the command output to only the relevant data
- Timeout: Maximum seconds to wait for the external source before timing out
Slack Integration
Setting Up Slack Notifications
- Navigate to Settings → Integrations
- Click Connect Slack
- Authorize Pandorian to access your Slack workspace
- Choose the notification channel
- Configure alerts for scan completed or scan failed events
Jira Integration
Connect Pandorian to Jira to create issues directly from scan results, turning violations into actionable tickets without leaving the dashboard.Setting Up Jira
- Navigate to Integrations → Jira in the Pandorian dashboard
- Click Connect and sign in via Atlassian
- Once authorized, the integration status shows Configured
- Under Configuration, select your default Jira board and click Save
Creating a Jira Issue from a Guideline
From the Guidelines page, click the Violations badge on any guideline. Click Create Issue — Pandorian generates a ticket draft containing all current open violations for that guideline in bulk. The Create Jira Issue form is pre-populated with:| Field | Details |
|---|---|
| Summary | Pre-filled; editable |
| Description | Auto-generated from guideline details, violation count, category, and repo context; editable |
| Issue Type | Defaults to Task; editable |
| Priority | Optional; editable |
| Assignee | Optional; editable |
| Labels | Optional; comma-separated |
Tip: Archive irrelevant violations before creating a ticket — archived violations are excluded from the generated issue.
