--- title: We now auto-approve and merge 15% of PRs | daily.dev description: An engineering lead describes building a GitHub Action that automatically approves and merges low-risk pull requests without human review, aiming to fix code... canonical: https://daily.dev/posts/we-now-auto-approve-and-merge-15-of-prs-8bygwtyr3 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: We now auto-approve and merge 15% of PRs | daily.dev og:description: An engineering lead describes building a GitHub Action that automatically approves and merges low-risk pull requests without human review, aiming to fix code... og:url: https://daily.dev/posts/we-now-auto-approve-and-merge-15-of-prs-8bygwtyr3 og:image: https://api.daily.dev/og/posts/8bYgWtyr3.png og:image:alt: We now auto-approve and merge 15% of PRs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # We now auto-approve and merge 15% of PRs **[swizec.com](https://daily.dev/sources/swizec)** · 4 min read · 42 upvotes · 14 comments ## Summary An engineering lead describes building a GitHub Action that automatically approves and merges low-risk pull requests without human review, aiming to fix code review as a bottleneck to team velocity. The system relies on custom deterministic linters, end-to-end UI test coverage, and existing risk-score tagging (low/mid/high) that had already become a rubber-stamp process for trusted engineers. Out of 143 PRs from 19 contributors, 22 were auto-merged with no incidents. Low-risk criteria include no public interface changes, no migrations, human-authored code, all checks green, no finance-related code, and no outstanding review comments. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What criteria should a PR meet to be safely auto-merged without human review? Safe auto-merge criteria include no public interface changes, no database migrations, human-authored code (not bot-generated), all automated checks passing green, no changes touching finance-related code, and no outstanding code-level comments from humans or bots. One team applied these rules via a GitHub Action that sweeps the codebase every few minutes and merges qualifying pull requests automatically. _See how developers weigh automated PR merging trade-offs and workflows on daily.dev._ ### How effective is auto-merging low-risk pull requests in practice? One engineering team auto-merged 22 out of 143 total pull requests from 19 contributors using a low-risk tagging system, with no incidents reported. The approach built on prior work tagging PRs by risk level, custom deterministic linters covering code structure and design guidelines, and end-to-end UI tests for critical user flows, rather than aiming for full test coverage. _Track real-world results from teams automating code review on daily.dev before adopting similar changes._ ## Community discussion Top comments from developers on daily.dev. **@ahmetozel** · 13 upvotes > The honest framing here is that you did not remove review, you replaced a rubber stamp with a written-down rule. That is a strict improvement, because the previous process claimed a human check that was not really happening, and now the criteria are explicit and auditable. Excluding human-authored code from the low-risk set is the constraint I would not have guessed, and it is the right way round: machine-generated changes are exactly where a plausible-looking diff needs eyes. The number I would track alongside the 22 auto-merges is how often a PR was tagged low-risk and later touched by a... **@akkitto** · 13 upvotes > I agree with that. I do a lot of YOLO shit and nothing happened. And most of the stuff, that could've happened was absolutely reversible. I think, 15% is still a very safe margin. **@capjavert** · 11 upvotes > only 15? > >  **@jonathanclendenon** · 10 upvotes > what could go wrong… **@envico801** · 2 upvotes > Seems like a cool idea but it has some risks, say for example a pr with bad intentions, malware or whatever. ## Similar posts on daily.dev - [AI Code Review Bottleneck 2026: Why PRs Are Stuck in Review](https://daily.dev/posts/ai-code-review-bottleneck-2026-why-prs-are-stuck-in-review-o7qcycgq0) · Alex CloudStar · 2 upvotes · 1 comments - [Why AI Code Reviews Are Slowing Down PRs](https://daily.dev/posts/why-ai-code-reviews-are-slowing-down-prs-yubjqxjqr) · Aviator Blog · 0 upvotes · 1 comments --- Tags: [#testing](https://daily.dev/tags/testing), [#cicd](https://daily.dev/tags/cicd), [#leadership](https://daily.dev/tags/leadership), [#github-actions](https://daily.dev/tags/github-actions), [#code-review](https://daily.dev/tags/code-review) [View this post on daily.dev](https://daily.dev/posts/we-now-auto-approve-and-merge-15-of-prs-8bygwtyr3) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"We now auto-approve and merge 15% of PRs","url":"https://daily.dev/posts/we-now-auto-approve-and-merge-15-of-prs-8bygwtyr3","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/we-now-auto-approve-and-merge-15-of-prs-8bygwtyr3"},"datePublished":"2026-09-19T16:26:55.757Z","dateModified":"2026-09-19T16:27:19.750Z","description":"An engineering lead describes building a GitHub Action that automatically approves and merges low-risk pull requests without human review, aiming to fix code...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/53ec4e15aa5ec4539937fc66efde34e9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/53ec4e15aa5ec4539937fc66efde34e9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"swizec.com","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"swizec.com","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/a0733daf6e014e23a638ded7f2d4cd70","url":"https://daily.dev/sources/swizec"},"commentCount":14,"discussionUrl":"https://daily.dev/posts/we-now-auto-approve-and-merge-15-of-prs-8bygwtyr3","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":42},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":14}],"keywords":"testing,cicd,leadership,github-actions,code-review","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"swizec.com","item":"https://daily.dev/sources/swizec"},{"@type":"ListItem","position":3,"name":"We now auto-approve and merge 15% of PRs"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/we-now-auto-approve-and-merge-15-of-prs-8bygwtyr3","comment":[{"@type":"Comment","text":"The honest framing here is that you did not remove review, you replaced a rubber stamp with a written-down rule. That is a strict improvement, because the previous process claimed a human check that was not really happening, and now the criteria are explicit and auditable. Excluding human-authored code from the low-risk set is the constraint I would not have guessed, and it is the right way round: machine-generated changes are exactly where a plausible-looking diff needs eyes. The number I would track alongside the 22 auto-merges is how often a PR was tagged low-risk and later touched by a fix within a week. Zero incidents out of 22 is encouraging but small, and near-misses will show up in that follow-up signal long before an incident does.","datePublished":"2026-09-20T20:40:18.352Z","url":"https://daily.dev/posts/8bYgWtyr3#c-3VzWnqmDH","author":{"@type":"Person","name":"Ahmet Özel","url":"https://daily.dev/ahmetozel","image":"https://avatars.githubusercontent.com/u/70992231?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":13}},{"@type":"Comment","text":"I agree with that. I do a lot of YOLO shit and nothing happened. And most of the stuff, that could’ve happened was absolutely reversible. I think, 15% is still a very safe margin.","datePublished":"2026-09-19T23:10:34.661Z","url":"https://daily.dev/posts/8bYgWtyr3#c-C1taVVBlJ","author":{"@type":"Person","name":"Daniel","url":"https://daily.dev/akkitto","image":"https://media.daily.dev/image/upload/s--FtwJqX4c--/f_auto/v1754900041/avatars/avatar_29TCpY2hJR72V3BlxPXzX?_a=BAMClqZW0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":13}},{"@type":"Comment","text":"only 15?","datePublished":"2026-09-20T10:50:32.557Z","url":"https://daily.dev/posts/8bYgWtyr3#c-lQ9jIGXBX","author":{"@type":"Person","name":"Ante Barić","url":"https://daily.dev/capjavert","image":"https://media.daily.dev/image/upload/v1679300599/avatars/avatar_LJSkpBexOSCWc8INyu3Eu.jpg"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":11}},{"@type":"Comment","text":"what could go wrong…","datePublished":"2026-09-19T20:44:45.860Z","url":"https://daily.dev/posts/8bYgWtyr3#c-uMYmCaGwG","author":{"@type":"Person","name":"Jonathan Clendenon","url":"https://daily.dev/jonathanclendenon","image":"https://lh3.googleusercontent.com/a/ACg8ocLyZ7RumbhhPmYvGs5vYCdfzrtdeNuBzYRi_JFIBCrY0u8Kaw=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":10}},{"@type":"Comment","text":"Seems like a cool idea but it has some risks, say for example a pr with bad intentions, malware or whatever.","datePublished":"2026-09-20T22:53:13.901Z","url":"https://daily.dev/posts/8bYgWtyr3#c-auLscGOS5","author":{"@type":"Person","name":"Enzo Davico","url":"https://daily.dev/envico801","image":"https://lh3.googleusercontent.com/a/AAcHTtfaewiR6YNrW2Qklos7bX8ffmRkqW9V99NRHHiGVnm0=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/we-now-auto-approve-and-merge-15-of-prs-8bygwtyr3#faq","mainEntity":[{"@type":"Question","name":"What criteria should a PR meet to be safely auto-merged without human review?","acceptedAnswer":{"@type":"Answer","text":"Safe auto-merge criteria include no public interface changes, no database migrations, human-authored code (not bot-generated), all automated checks passing green, no changes touching finance-related code, and no outstanding code-level comments from humans or bots. One team applied these rules via a GitHub Action that sweeps the codebase every few minutes and merges qualifying pull requests automatically. See how developers weigh automated PR merging trade-offs and workflows on daily.dev."}},{"@type":"Question","name":"How effective is auto-merging low-risk pull requests in practice?","acceptedAnswer":{"@type":"Answer","text":"One engineering team auto-merged 22 out of 143 total pull requests from 19 contributors using a low-risk tagging system, with no incidents reported. The approach built on prior work tagging PRs by risk level, custom deterministic linters covering code structure and design guidelines, and end-to-end UI tests for critical user flows, rather than aiming for full test coverage. Track real-world results from teams automating code review on daily.dev before adopting similar changes."}}]} ```