What Context Gitar Sees
When Gitar processes a PR, it pulls context in two ways: a baseline that is always loaded, and on-demand lookups the agent performs when it needs more information.Baseline context
- The diff (changed lines)
- Full contents of files touched by the diff
- CI logs (when CI fails)
- Repository rules (
.gitar/rules/*.md) - Custom review instructions (
.gitar/review/*.md) - Agent instructions (
.gitar/instructions/*.md), plus any organization-wide instructions set in settings - AI instruction files (
CLAUDE.md,AGENTS.md,agent.md,agents.md,.cursorrules,.cursor/rules/*,.claude/rules/*) - merged hierarchically from the repo root down to the agent’s working subdirectory - PR title, description, and comment history
- Linked issue context from Jira, Linear, Plane, YouTrack, or your code host’s own issue tracker
On-demand, when the agent needs it
- Reads related files in the repo to understand callers, types, or config the diff depends on
- Greps or globs across the repo to find usages and patterns
- Runs read-only shell commands to inspect project structure
- Spawns a dedicated explorer sub-agent for deeper investigation on complex changes
- Pulls learned codebase knowledge from previous scans (conventions, architectural patterns, deprecated APIs), each fact citing the file it came from
- Loads a skill (
.gitar/skills/<name>/SKILL.md) when a rule or a comment calls one
What Gitar reads outside the repository
Two things, both scoped. If your organization names a configuration repository, Gitar reads its.gitar/ directory and its skill directories, so rules, review instructions, and skills defined once apply everywhere.
If Cross-Repo Analysis is on, Gitar matches your diff against a generated summary of each sibling repository: what it publishes, what it consumes, its stack, its architecture. It reads those summaries, never a sibling’s source.
Visibility scopes the match. A private repository is matched against every repository in the organization, a public one only against public siblings and itself, so nothing private reaches a public pull request.
Gitar does not read:
- Other branches
- Deployment configurations or infrastructure state
- Secrets or environment variables
- Any repository outside your organization
Code Review Process
Gitar reviews code changes through four lenses: security, bugs, performance, and code quality. See Code Review for what each one looks for. Findings are posted as inline review comments on the exact lines they apply to. A consolidated summary appears in the Gitar dashboard comment on the PR, showing the overall verdict and findings breakdown. When new commits are pushed, Gitar updates the existing dashboard comment rather than creating new ones, and resolves inline threads for findings that have been addressed. Custom review instructions placed in.gitar/review/*.md let you tailor what Gitar looks for in your specific codebase. See Repository Customization for details.
CI Failure Fixing
When CI fails on a PR, Gitar:- Reads the full CI log output across all jobs and steps
- Identifies the failing step and extracts relevant error messages
- Determines the root cause by cross-referencing errors with the code diff
- Pushes a fix commit to the branch
Data Flow and Privacy
Gitar processes code in ephemeral, Gitar-managed containers.
For full details on infrastructure security, encryption, compliance, and certifications, see Security.
What Gitar Does Not Do
Gitar never force-pushes, and it merges only when you turn Auto-Merge on.- Does not force-push. Every fix lands as an additional commit
- Does not merge PRs by default. Merging only happens when you explicitly enable Auto-Merge, which relies on your code host’s native merge and your branch protection rules