AI-generated code increases the number and size of pull requests, making CI and code review a bottleneck.
2
Agentic validation can review pull requests, explain CI failures, fix issues, and merge changes under rules defined by the team.
3
Teams can increase automation gradually as they gain trust, while combining agents with program analysis for better precision and coverage.
Summary
Ali-Reza Adl-Tabatabai argues that CI and code review become harder to scale as engineering teams grow, then become an even larger bottleneck when AI generates more and larger pull requests. Teams either spend more time reviewing every change or accept more risk by rubber-stamping them. His proposed answer is agentic validation through Gitar, now part of Sonar. The agent reviews pull requests, identifies meaningful issues, analyzes CI failures, detects flaky tests, applies fixes, and can approve or merge changes under explicit rules. Teams can adopt these capabilities in stages, starting with review and moving toward automatic fixes and merges. The system also gives platform teams data about CI failures and gives leaders a view of pull request categories. Under the hood, it uses a control plane, a custom agent harness, and an LLM proxy. Adl-Tabatabai also describes combining agents with SonarQube program analysis.
CI and code review become an expensive critical path as teams grow
Adl-Tabatabai describes CI and code review as the centralized validation phase for software teams. It enforces security, compliance, and code-quality gates before changes reach production. Longer builds, asynchronous reviews across teams and geographies, expensive infrastructure, and fragmented integrations make the phase slower as an organization grows. Failures add an outer loop that can take hours or days, while platform teams with limited headcount must keep the whole system running.
AI-generated code increases both review volume and production risk
AI produces more pull requests and larger pull requests, and each change can contain defects. That shifts more cost into the development lifecycle because developers have more code to review and more possible failures to deal with in production. Adl-Tabatabai presents two difficult choices: review every pull request carefully and slow down, or rubber-stamp changes and risk incidents. Both choices reduce developer productivity and satisfaction.
Agentic validation can take a pull request from creation to merge
Gitar's approach uses an agent to automate the validation steps and produce pull requests that are ready to merge or can be merged automatically. It reviews new changes and posts issues and inline comments, with custom rules, checks, workflow automations, and optional merge blocking for unresolved findings. The goal is to reduce noise by reporting issues that matter rather than flooding developers with comments.
The agent handles CI failures and can fix problems until the pull request is green
The system summarizes the root causes of CI failures and is designed to catch flaky tests. Teams can configure automatic retries for flaky tests. The agent can fix review findings and CI failures, either when asked to address a specific issue or through a loop that continues until the issues are fixed and the pull request is green and ready to merge.
Teams gain automation gradually as their trust in the reviews grows
Adl-Tabatabai describes a progression toward fully automated pull requests. Teams first use the review function and assess whether its findings are accurate and important. They then allow the agent to block pull requests, use automatic fixes to turn them green, and finally define rules for automatic approval and merging. Each additional level of automation depends on trust in the system's accuracy.
Processing every pull request produces operational insights
The system can categorize CI failures so platform teams can see whether developers are encountering flaky tests, infrastructure problems, or other failure types. It can also categorize pull requests by activities such as feature development, issue fixes, chores, and refactors. Adl-Tabatabai says this second view is useful to engineering leaders who want to understand what work is being delivered across the organization.
The product uses a control plane, custom agent harness, and model proxy
Under the hood, a control plane orchestrates pull request workflows. Gitar's custom agent harness manages multi-agent execution, context, memory, tool calls, and integrations. Adl-Tabatabai says owning the harness lets the team optimize the validation use case for token cost, precision, and coverage, while delivering outcomes at a fixed pull request price. An LLM proxy routes requests across models and handles failover.
Agents and program analysis cover different parts of code validation
After joining Sonar, Gitar began integrating with SonarQube. Adl-Tabatabai describes combining agentic validation with established program-analysis methods, including taint analysis, control-flow analysis, data-flow analysis, and software composition analysis. He expects the combination to provide better precision and coverage than either approach alone, at a suitable price point.
"You can either ask it to specifically fix an issue or more interestingly you can set it up to automatically loop until all the issues have been fixed in your PR and you have a green PR ready to merge."05:02
Who should watch
You run a platform team that owns CI, code review, and the integrations around them, and failures are consuming developer time.
Your team is receiving more AI-generated pull requests and needs a way to increase review and merge automation without immediately trusting full auto-merge.
You want to understand how an agent harness can be combined with traditional program analysis for code validation.
