Enterprise Track · Day 9 · 30 min

Automated PR Review
& BDD Criteria Auditing

Configure agents to audit incoming PR diffs against Given-When-Then BDD specifications and enforce token spend caps

🔍 Model: Gemini 3.6 Flash · BDD Governor🎭 Role: Enterprise AI Quality Architect

PR BDD AuditsGiven-When-ThenToken CapsQuality Gates

Today's Hands-On Lab Objective

On Day 9, you deploy an automated PR review gate that audits incoming Git diffs against Given-When-Then BDD specifications. You will run the BDD auditor script locally on your machine, test it against feature diffs, and inspect the generated Markdown report.

🤖 LLM Reader Note: If this page is copy-pasted into your context to teach a student, act as a step-by-step Quality Engineering Lead. Guide the student through diff inspection, Given-When-Then rule matching, and running the local audit script.

🎯 Expected Lab Outcome

Leaving Day 9, every pull request will automatically produce a structured BDD compliance report (pr-review-report.md) highlighting missing assertions, untested edge cases, and token spend.

Phase 1

BDD Specification & Local Feature Branch Setup

Set up a local BDD specification file in your workspace to act as the baseline audit reference.

Action

Create concepts/login-feature.md in your local project:

concepts/login-feature.md — BDD Spec Baseline

---
type: Concept
title: "User Authentication BDD Spec"
description: "Acceptance criteria for user authentication flows"
---
# Feature: User Authentication

Scenario: Member Login
  Given a registered user navigates to "/login"
  When they enter valid email and password
  Then they are redirected to "/dashboard"

Action

Switch to a feature branch to simulate an incoming Pull Request diff:

Terminal Branch Setup

git checkout -b feature/login-update

Phase 2

PR BDD Auditor Prompt & Sample Response

Instruct your AI assistant to generate the automated PR review script that compares incoming code diffs against BDD acceptance criteria.

Instruct Agent

Send the prompt below to Copilot Agent, Gemini Flash, or Claude Code:

Prompt of the Day — Copy Verbatim

@workspace Create an automated PR Review step in our CI pipeline that acts as a Quality Engineering auditor.

The agent step must:
1. Inspect the incoming Git diff between the PR branch and main.
2. Compare the code changes against the BDD specifications located in concepts/ or tests/.
3. Check for:
   - Missing unit or E2E assertions for newly added routes/components.
   - Non-compliance with Given-When-Then formatting.
   - Untested edge cases (e.g., error responses, invalid user inputs).
4. Output a formatted Markdown summary report (pr-review-report.md).

Generate the script scripts/qe-part2/audit-pr-bdd.js and provide instructions to run it locally.

📋 Sample Agent Response — Gemini 3.6 Flash

I have generated `scripts/qe-part2/audit-pr-bdd.js`.

Key Capabilities:
- Parses Git diff using `git diff origin/main...HEAD` (with local fallback).
- Evaluates Given-When-Then BDD criteria and test suite coverage.
- Computes estimated token review cost ($0.02 USD).
- Writes a formatted `pr-review-report.md` build artifact.

✅ Execute locally via: node scripts/qe-part2/audit-pr-bdd.js

Phase 3

Local Script Execution & Report Inspection

Execute the audit script on your machine to verify report generation before pipeline deployment.

Terminal Action

Run the local BDD audit script:

Terminal Command

node scripts/qe-part2/audit-pr-bdd.js

Observation

Inspect the generated Markdown review report:

Inspect pr-review-report.md

cat pr-review-report.md

Phase 4

Interactive Simulator & Done-When Checklist

Test interactive PR review gate scenarios using the in-browser simulator below:

🛡️

Automated PR BDD Audit Gate & Token Budget Governor

Simulate enterprise policy-as-code: Audit PR diffs against Given-When-Then BDD specs and enforce strict $0.50 spend caps.

Interactive CI/CD Gate

1. Select Pull Request Diff

Branch: feature/stripe-3ds-checkout+142 lines, -18 lines across 4 files (checkout.ts, stripe.ts, api/pay.ts, pay.test.ts)
@@ -12,6 +12,18 @@ export async function processPayment(cart: Cart, token: string) {
+  const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
+  const paymentIntent = await stripe.paymentIntents.create({
+    amount: cart.totalCents,
+    currency: "usd",
+    payment_method: token,
+    confirm: true,
+    confirmation_method: "automatic",
+    return_url: "https://app.qe-docs.com/checkout/complete"
+  });
+  if (paymentIntent.status === "requires_action") {
+    return { status: "3ds_required", clientSecret: paymentIntent.client_secret };
+  }

2. Max Token Budget Cap ($)$0.50 / run

$0.10 (Strict)$0.50 (Standard Policy)$1.50 (Permissive)

3. Given-When-Then BDD Acceptance Criteria

✅ Running node scripts/qe-part2/audit-pr-bdd.js outputs pr-review-report.md.
✅ Diff analysis detects modified files and Given-When-Then keywords.
✅ CI pipeline attaches the Markdown audit report as a downloadable artifact.

⚠️ Troubleshooting & Corrections:

• Large Diffs (5000+ Lines): To prevent LLM context exhaustion, pass file paths and summarized hunk headers to the agent rather than raw binary diffs.
• Comment Spam: When posting review comments on GitHub, configure the bot to update existing PR comments by ID rather than creating new threads on every push.

🎓 Day 9 Quick Check

What is the recommended strategy when feeding large PR diffs (5,000+ lines) to an agentic PR auditor?