alror

module

v0.2.0 Latest Latest Go to latest Published: Oct 2, 2026 License: Apache-2.0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/alrors/alror

Links

Open Source Insights

README ¶

Alror

The release gate for the age of AI-written code.
Alror scores every change for risk, rolls it out as a canary sized to that risk,
verifies each step against live metrics, and rolls back on its own when a release hurts users.

Website · Quickstart · Docs · Self-hosting · Releases · Contributing

Alror is open source. Teams merge more changes than ever, many written by agents, yet most pipelines still treat a green test run as proof that a change is safe. Alror is the step between merge and production that makes that true.

Change risk scoring. A 0–100 score from named, auditable factors: critical services, sensitive paths, migrations, missing tests, agent-authored commits, recent rollbacks. (Docs)
Risk-sized canaries. Low risk goes 25% → 100%. High risk goes 1% → 5% → 25% → 50% → 100% with longer bakes. (Docs)
Statistical verification. Each stage compares canary and baseline with a Mann-Whitney U test and an effect-size threshold, so noise doesn't trigger rollbacks. (Docs)
Automatic rollback. A regression shifts traffic back in seconds, with a plain-English reason, and alror deploy exits with code 2 so CI goes red. (Docs)
GitHub checks. A risk check run and a sticky comment on every pull request, plus check and deploy actions. (Docs)
Targets and metrics. Kubernetes via Argo Rollouts, Amazon ECS (beta), Prometheus, Datadog, Slack. (Docs)
Workspace console. Live rollouts, release stories, insights, policies, API keys, audit log and a plugin marketplace. (Docs)
Runner. alror runner executes deploys and rollbacks queued from the console inside your own infrastructure. (Docs)
SDKs. Go and TypeScript clients for the workspace API. (Docs)

Watch "releases" of this repo to get notified of new versions.

alror deploy rolling back a regressed canary

Documentation

The docs live in internal/docsite/content and are served offline by alror docs.

Guide
Quickstart	Install, `alror init`, your first verified rollout
Configuration	`alror.yaml`, services, policy and plans
Risk scoring · Rollouts	How changes are scored and verified
Targets and metrics	Kubernetes, ECS, Prometheus, Datadog
GitHub	Check runs, PR comments, actions
Connected mode	`alror login`, the workspace API and `alror runner`
CLI reference	Every command and flag
Architecture · Platform API	Internals and the REST contract

Community & support

GitHub Issues: bugs and errors you run into.
GitHub Discussions: questions, ideas and help with your setup.
Security: report vulnerabilities privately.

How it works

Alror is a release engine plus a workspace. The engine runs inside the alror CLI, usually as one step in CI, or inside alror runner for deploys started from the console. It needs nothing hosted: in local mode its whole state is alror.yaml and plain JSON under .alror/.

Risk scorer (internal/risk) reads the git diff and history and returns a score with every factor that moved it.
Planner and rollout engine (internal/rollout) pick the canary steps and bakes from the score and drive the state machine.
Verifier (internal/verify) compares canary and baseline samples per metric and decides pass or roll back.
Drivers (internal/driver) shift traffic: Argo Rollouts on Kubernetes, ECS target-group weights, or a simulated target for trying it out.
Metrics providers (internal/metrics) query Prometheus or Datadog, or generate synthetic samples.
Workspace (apps/web) is a Next.js app with the website, the console and the /api/v1 REST API, on PostgreSQL and Redis. The CLI connects to it with an API key.

Install

# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/alrors/alror/main/scripts/install.sh | sh

# Windows (PowerShell)
irm https://raw.githubusercontent.com/alrors/alror/main/scripts/install.ps1 | iex

# Go 1.22+
go install github.com/alrors/alror/cmd/alror@latest

alror init        # writes alror.yaml
alror risk        # score the current branch
alror deploy -s checkout-api -i registry.example.com/checkout-api:v2

Add the risk check to pull requests:

- uses: alrors/alror/actions/check@main

Client libraries

Language	Package	Source
Go	`github.com/alrors/alror/pkg/alror`	`pkg/alror`
TypeScript / JavaScript	`@alror/sdk` (not on npm yet)	`sdk/js`
CLI via npm	`alror` (not on npm yet)	`npm`

Self-hosting

Run the workspace (website, console and API) with PostgreSQL, Redis and automatic HTTPS:

git clone https://github.com/alrors/alror && cd alror/docker
cp .env.example .env && docker compose up -d

See docker/README.md.

Repository layout

cmd/            alror, alror-docs and a dev API server
internal/       engine: risk, rollout, verify, driver, metrics, store, runner, cli, docs
pkg/alror       Go SDK
apps/web        website, console and /api/v1 (Next.js, PostgreSQL, Redis)
sdk/js          TypeScript SDK
npm             npm launcher packages
actions         GitHub Actions: check and deploy
docker          self-hosting
docs            platform contract, images

License

Apache-2.0.

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
cmd
alror command Command alror is the Alror CLI.	Command alror is the Alror CLI.
alror-devserver command Command alror-devserver serves an in-memory fake of the Alror workspace API (internal/api/apitest) for local demos and CLI development.	Command alror-devserver serves an in-memory fake of the Alror workspace API (internal/api/apitest) for local demos and CLI development.
alror-docs command Command alror-docs serves the Alror documentation (embedded, works offline).	Command alror-docs serves the Alror documentation (embedded, works offline).
internal
api Package api is a typed client for the Alror workspace REST API v1 (docs/platform-contract.md, section 5).	Package api is a typed client for the Alror workspace REST API v1 (docs/platform-contract.md, section 5).
api/apitest Package apitest is an in-memory fake of the Alror workspace API v1 (docs/platform-contract.md, section 5).	Package apitest is an in-memory fake of the Alror workspace API v1 (docs/platform-contract.md, section 5).
cli Package cli implements the `alror` command.	Package cli implements the `alror` command.
cli/ui Package ui is the CLI's visual language: the same mint-on-graphite palette, LED meters and paper receipts as the Alror website.	Package ui is the CLI's visual language: the same mint-on-graphite palette, LED meters and paper receipts as the Alror website.
config Package config loads alror.yaml, the per-repository configuration file.	Package config loads alror.yaml, the per-repository configuration file.
credentials Package credentials stores the Alror workspace server and API key for the current user and resolves which server and key a command should use.	Package credentials stores the Alror workspace server and API key for the current user and resolves which server and key a command should use.
docsite Package docsite serves Alror's documentation.	Package docsite serves Alror's documentation.
domain Package domain holds the types shared by every Alror component: the CLI, the Alror workspace (web platform), the runner and the docs.	Package domain holds the types shared by every Alror component: the CLI, the Alror workspace (web platform), the runner and the docs.
driver Package driver shifts traffic on a deployment target.	Package driver shifts traffic on a deployment target.
github Package github integrates Alror with GitHub: it reads the GitHub Actions environment, posts check runs and a sticky pull-request comment, and writes job summaries and step outputs.	Package github integrates Alror with GitHub: it reads the GitHub Actions environment, posts check runs and a sticky pull-request comment, and writes job summaries and step outputs.
metrics Package metrics fetches canary and baseline observations for verification.	Package metrics fetches canary and baseline observations for verification.
notify Package notify sends deployment outcomes to people.	Package notify sends deployment outcomes to people.
risk Package risk scores a code change from 0 to 100 and explains why.	Package risk scores a code change from 0 to 100 and explains why.
rollout Package rollout turns a risk report into a plan and executes it.	Package rollout turns a risk report into a plan and executes it.
runner Package runner runs deploys and rollbacks queued from the Alror console, inside your own infrastructure (like a CI runner).	Package runner runs deploys and rollbacks queued from the Alror console, inside your own infrastructure (like a CI runner).
store Package store persists deployments and their events on the local file system.	Package store persists deployments and their events on the local file system.
verify Package verify decides whether a canary is worse than its baseline.	Package verify decides whether a canary is worse than its baseline.
pkg
alror Package alror is the public Go SDK for Alror, the release-safety tool that scores the risk of a change, rolls it out in verified steps and rolls it back on its own when it hurts users.	Package alror is the public Go SDK for Alror, the release-safety tool that scores the risk of a change, rolls it out in verified steps and rolls it back on its own when it hurts users.
alror/risk Package risk exposes Alror's rule-based change risk scorer for library use.	Package risk exposes Alror's rule-based change risk scorer for library use.