Integrations - Pandorian

Pandorian integrates into your existing SDLC to enforce guidelines continuously and automatically. This guide covers PR scanning, CI/CD integration, repository policy, and notifications.

Source Control & Pull Request Scanning

The fastest way to enforce guidelines is through automatic PR scanning via your source control integration. Pandorian supports GitHub, GitLab, and Azure DevOps.

How PR Scanning Works

Once you connect your source control manager during initial setup, PR scanning is automatically triggered on every new PR or push to an existing PR. What happens during a PR scan:

Developer opens or updates a pull request.
Pandorian scans only the modified files against guidelines.
Violations appear as inline comments on specific lines and as a summary comment on the PR (if opted in)
The PR check appears in your source control’s status checks (configurable as required or optional)

PR Actions

Rescan: Re-trigger a scan for an existing PR with the current set of active guidelines applied to it. Useful after updating guidelines or resolving earlier violations. Archive: Archive individual findings that are no longer relevant — archived violations are excluded from future Jira ticket creation and reporting views. Skip CI Check: Manually skip the CI check for a specific PR. The scan will still run, but results will not block the PR build associated with it.

Blocking vs. Monitoring Mode

Blocking Mode (recommended for production): Pipeline fails if violations are found, preventing non-compliant code from being deployed. Set exit code 1 when violations > 0. Monitoring Mode (useful for gradual rollout): Pipeline continues regardless of violations. Scan results are logged for visibility. Set exit code 0 and log violations without blocking.

Multi-Org Governance

Multi-Org Governance connects multiple git organizations — any mix of GitHub, GitLab, and Azure DevOps — to a single Pandorian account. Use this when your engineering organization runs multiple git organizations by design (one per business unit or product line), or has inherited additional organizations through an acquisition.

How It Works

One Pandorian account can hold a separate view for each connected org. Every org keeps its own guidelines, scan history, and UI, exactly as it operated before joining — data is not merged between orgs. What changes is that all of them are now managed from that one account instead of separate logins.

Connecting an Additional Org

Connect each additional git organization the same way you connected your first — through the standard source control integration flow. Pandorian adds it as its own view under your account automatically. No repos move, no orgs get renamed, nothing migrates.

Guidelines Are Not Shared Across Orgs

Multi-Org Governance adds one place to manage from, not shared rules or shared data. Each connected org keeps the guidelines it already has. Standardizing guidelines across orgs is a decision your team makes deliberately, on its own timeline.

Guidelines as Code

High-velocity teams can manage guidelines directly within their code repositories, treating engineering standards as living documentation that evolves alongside the codebase. If your team already uses internal markdown files or AI coding assistant skills, you can sync those same files to Pandorian — ensuring the rules your AI uses to write code are the exact same rules Pandorian uses to validate it.

How It Works

Designate a repository and base directory (e.g., /docs/guidelines) in the Integrations tab
Pandorian monitors that directory for .md files
Any merge to the main branch triggers an update — guidelines are immediately enforced across all associated repositories

File Structure & Metadata

Each Markdown file must contain a YAML frontmatter block with a pandorian-metadata section:

Attribute	Type	Description
`id`	string	Unique identifier (e.g., `scala-expert`)
`language_ids`	string	Target languages (e.g., `scala`, `python`)
`title`	string	Clear, actionable rule name
`block_build`	boolean	`true` to block on violation; `false` defaults to monitor
`category`	string	Area of focus (e.g., `security`, `performance`)
`is_active`	boolean	Whether this guideline is currently enforced
`account_level`	boolean	Whether this guideline should be globally enforced on all organizations within the account
`tags`	list	Strings for filtering and organization

Supported Categories

Architecture, Code Quality & Maintainability, Reliability & Resilience, Performance & Scalability, Security, Data & Storage, Infrastructure & Environments, Observability

Supported Languages

c, cobol, cpp, csharp, dockerfile, elixir, go, haskell, java, javascript, kotlin, lua, perl, php, python, ruby, rust, scala, swift, terraform, typescript, shell

Implementation Example

Create a file named scala-expert.md in your guidelines directory:

---
pandorian-metadata:
  id: scala-expert
  language_ids: [scala]
  title: Scala Functional Programming Expert
  block_build: true
  category: Architecture
  is_active: true
  account_level: false
  tags: [scala, functional-programming, cats, fs2]
---

# Scala Functional Programming Standards

You are an elite Scala developer. When writing or reviewing code, ensure:
- **Immutability First**: Always use `val` over `var` and prefer immutable collections.
- **Referential Transparency**: Effects must be properly tracked in the type system using `IO`.
- **Resource Management**: Use `Resource` for anything requiring cleanup.

### Prohibited Patterns
- Never use `null`. Use `Option` instead.
- Avoid `Thread.sleep`; use `IO.sleep` for non-blocking delays.

Configuration Steps

Navigate to Integrations → Connections → Source Control in the Pandorian platform
Select the repository containing your .md files
Provide the top-level directory path (e.g., /docs/guidelines)
Save to trigger an initial import

Exporting from the Guidelines Manager

If you’ve been managing guidelines through the Pandorian UI and want to move to a code-based workflow, you don’t need to rewrite anything. Any guideline in the Guidelines Manager can be exported as a Markdown file that is already valid Guidelines-as-Code — frontmatter, metadata, and rule body included. To export:

Open the Guidelines tab
Select the guideline you want to export
Click Export
Commit the downloaded .md file(s) to your designated guidelines directory

The exported file is already valid Guidelines-as-Code. It carries over language_ids, title, block_build, category, is_active, and tags exactly as configured in the UI, so you can paste the contents straight into your guidelines directory with no reformatting.

Policy as Code

Policy as Code lets you configure repository-level settings as code, so Pandorian knows which guidelines to run and when to block pull requests — without managing these rules outside your codebase. The policy is defined in a .pandorian/.policy file inside the repo and is applied on every full and PR scan.

Repository Policy Schema

# Exclusions — skip files or directories from analysis using glob patterns
exclusions:
  - type: glob
    value: string
    case_sensitive: bool

# Inclusions — apply specific guidelines (by tag) to specific paths
inclusions:
  - tags: [string]
    rule:
      type: glob
      value: string
      case_sensitive: bool

# Path Inclusions — restrict the entire scan to specific paths
path_inclusions:
  - type: glob
    value: string
    case_sensitive: bool

Comprehensive Configuration Example

exclusions:
  - type: glob
    value: "vendor/**"
    case_sensitive: true
  - type: glob
    value: "**/*.pb.go"
    case_sensitive: true
  - type: glob
    value: "**/*_test.go"
    case_sensitive: true
  - type: glob
    value: "node_modules/**"
    case_sensitive: true

inclusions:
  - tags: [security]
    rule:
      type: glob
      value: "src/auth/**"
      case_sensitive: true
  - tags: [data-storage, performance]
    rule:
      type: glob
      value: "db/migrations/**"
      case_sensitive: true

path_inclusions:
  - type: glob
    value: "src/**"
    case_sensitive: true

Dynamic Context Providers

Dynamic Context Providers connect external data sources directly to your guidelines, ensuring they evaluate code against real-time context — approved libraries, internal API routes, active feature flags — rather than static hardcoded lists.

Configuring a Provider

When creating or editing a guideline, add a provider with:

Title: Descriptive name (e.g., “Approved Config Flags”)
Command: The exact command Pandorian executes to fetch data (e.g., a curl to your internal API)
Grep: Optional regex to filter the command output to only the relevant data
Timeout: Maximum seconds to wait for the external source before timing out

Slack Integration

Setting Up Slack Notifications

Navigate to Settings → Integrations
Click Connect Slack
Authorize Pandorian to access your Slack workspace
Choose the notification channel
Configure alerts for scan completed or scan failed events

Each alert includes a direct link to the scan results in the Pandorian dashboard.

Jira Integration

Connect Pandorian to Jira to create issues directly from scan results, turning violations into actionable tickets without leaving the dashboard.

Setting Up Jira

Navigate to Integrations → Jira in the Pandorian dashboard
Click Connect and sign in via Atlassian
Once authorized, the integration status shows Configured
Under Configuration, select your default Jira board and click Save

Creating a Jira Issue from a Guideline

From the Guidelines page, click the Violations badge on any guideline. Click Create Issue — Pandorian generates a ticket draft containing all current open violations for that guideline in bulk. The Create Jira Issue form is pre-populated with:

Field	Details
Summary	Pre-filled; editable
Description	Auto-generated from guideline details, violation count, category, and repo context; editable
Issue Type	Defaults to Task; editable
Priority	Optional; editable
Assignee	Optional; editable
Labels	Optional; comma-separated

A Ticket Preview panel shows the rendered output before submission.

Tip: Archive irrelevant violations before creating a ticket — archived violations are excluded from the generated issue.

Ticket History & Lifecycle

A Tickets page in Pandorian shows all issues opened, so you can track escalations without leaving the dashboard. Pandorian does not automatically close, update, or comment on tickets — lifecycle is managed within Jira.

​Source Control & Pull Request Scanning

​How PR Scanning Works

​PR Actions

​Blocking vs. Monitoring Mode

​Multi-Org Governance

​How It Works

​Connecting an Additional Org

​Guidelines Are Not Shared Across Orgs

​Guidelines as Code

​How It Works

​File Structure & Metadata

​Supported Categories

​Supported Languages

​Implementation Example

​Configuration Steps

​Exporting from the Guidelines Manager

​Policy as Code

​Repository Policy Schema

​Comprehensive Configuration Example

​Dynamic Context Providers

​Configuring a Provider

​Slack Integration

​Setting Up Slack Notifications

​Jira Integration

​Setting Up Jira

​Creating a Jira Issue from a Guideline

​Ticket History & Lifecycle

Source Control & Pull Request Scanning

How PR Scanning Works

PR Actions

Blocking vs. Monitoring Mode

Multi-Org Governance

How It Works

Connecting an Additional Org

Guidelines Are Not Shared Across Orgs

Guidelines as Code

How It Works

File Structure & Metadata

Supported Categories

Supported Languages

Implementation Example

Configuration Steps

Exporting from the Guidelines Manager

Policy as Code

Repository Policy Schema

Comprehensive Configuration Example

Dynamic Context Providers

Configuring a Provider

Slack Integration

Setting Up Slack Notifications

Jira Integration

Setting Up Jira

Creating a Jira Issue from a Guideline

Ticket History & Lifecycle