Danger.js — Automate Code Review Chores in CI

Introduction

Danger.js automates the repetitive parts of code review by running a script (the Dangerfile) during CI that inspects the pull request diff, metadata, and file changes. It posts messages, warnings, and failures as PR comments or inline review annotations, freeing reviewers to focus on logic and architecture.

What Danger.js Does

• Inspects PR metadata: title, description, labels, assignees, and reviewers
• Analyzes the diff to detect changes in specific files or patterns
• Posts markdown messages, warnings, and failure notices as PR comments
• Supports inline comments on specific lines of changed files
• Integrates with GitHub, GitLab, Bitbucket, and Azure DevOps

Architecture Overview

Danger.js runs as a Node.js process in your CI environment. It authenticates with your Git platform API using a bot token, fetches the PR metadata and diff, and exposes them through a structured DSL (danger.github.pr, danger.git.modified_files, etc.). The Dangerfile is a TypeScript or JavaScript module that imports danger, warn, fail, message, and markdown functions. After the Dangerfile executes, Danger collects all messages and posts them as a single PR comment or as individual inline review annotations.

Self-Hosting & Configuration

• Add danger as a dev dependency and create a dangerfile.ts at the project root
• Set a DANGER_GITHUB_API_TOKEN environment variable in your CI with a bot account token
• Run npx danger ci as a CI step after your build and tests
• Use npx danger local to test your Dangerfile against a local git diff before pushing
• Configure a .danger.config.js for custom settings like comment update behavior

Key Features

• Platform-agnostic: supports GitHub, GitLab, Bitbucket Server, and Azure DevOps
• TypeScript Dangerfile: full type safety and autocompletion for the danger DSL
• Plugin ecosystem: community plugins for checking changelogs, coverage reports, bundle size, and more
• Inline review comments: post warnings on specific lines of the diff, not just top-level PR comments
• Local mode: run the Dangerfile against your local branch diff without needing CI

Comparison with Similar Tools

• GitHub Actions review bots — Custom per-workflow; Danger.js provides a reusable DSL across projects and CI systems
• CODEOWNERS — Assigns reviewers by path; Danger.js enforces review policies and posts feedback
• Probot — GitHub App framework for webhooks; Danger.js runs in CI with simpler setup for PR-level checks
• Reviewdog — Focused on linter output annotation; Danger.js handles broader PR policy enforcement

FAQ

Q: Does it work with GitHub Actions? A: Yes. Add npx danger ci as a step in your workflow and set the API token as a secret.

Q: Can I use it with monorepos? A: Yes. The Dangerfile has access to the full list of modified files, so you can scope rules to specific packages or directories.

Q: Does it modify code or just comment? A: It only reads the diff and posts comments. It never pushes commits or modifies the branch.

Q: What is the difference between warn and fail? A: warn posts a non-blocking warning. fail posts an error message and sets the CI status to failed.

Sources

• https://github.com/danger/danger-js
• https://danger.systems/js