When Garboard says nothing

Garboard is silent on a pull request it has nothing to say about. No comment, no “looks good”, no green tick. This is deliberate, it is the property most likely to make the tool survive contact with a real team — and it has one uncomfortable consequence.

The uncomfortable consequence

A correctly working install and a completely broken one look exactly the same on a clean pull request.

Both produce nothing. So if you have just installed Garboard, opened a pull request, and seen no comment, you genuinely cannot tell from that alone which of the two you are looking at.

If you are here because you expected a comment and got none, go to Nothing happened — what to check. That page is a checklist for distinguishing the two, and it exists because this design makes the distinction genuinely hard.

Why silence rather than a reassuring comment

A bot that comments on every pull request gets muted within a fortnight. Once it is muted, it is not a control — it is a cost. Every notification a tool spends on “nothing to report” is drawn from the same budget as the notification that actually matters, and the budget is not large.

So Garboard spends nothing on nothing. When it speaks, it is because there is something to say, and that is the only reason it is worth reading.

What counts as “nothing to say”

All three of these, together:

• no findings — nothing from your conventions, the built-in rules, adopted catalog rules or your custom rules;
• no material cost increase — below your cost.comment_above_usd threshold;
• no wide blast radius — below your blast_radius.comment_above threshold.

Miss any one and it comments.

The two things that speak on their own

These are the only narrowings, and both are context, not findings. They carry no severity, they never occupy one of the three finding slots, and they render as a blockquote so they read as a note rather than a verdict.

A priced monthly increase at or above cost.comment_above_usd. The default is 0, which means every priced increase says so. A change that adds money should mention it even when it is otherwise perfect.

A blast radius at or above blast_radius.comment_above. The default is 3, which is the smallest score a change reaching production can have — the weights are production 3, staging 2, everything else 1. So the default reads as: tell me when this reaches production, or when it reaches three or more units anywhere. A change consumed only by a dev environment stays quiet.

Both defaults are your organisation’s to set. Both can be turned off.

Measured, not asserted

On our published benchmark corpus — 40 open-source Terraform, Terragrunt and Crossplane repositories — 29 of 40 repositories produced no findings at all. That is the promise as a measurement: on real code that we did not write and could not tune against, most repositories got silence.

(The CloudFormation corpus is reported separately and is not included in that figure. It is three template libraries whose purpose is to demonstrate every service, and 0 of 3 are silent. Averaging them in would flatter neither number honestly. Both are on the gauntlet page.)

Any further narrowing needs the same proof

Both existing narrowings shipped with two tests: one proving the signal speaks above the floor, and one proving it stays quiet below it. Anything that wants to join them has to bring both. A signal nobody sees is not a control — and neither is one that fires constantly.