Untitled

A MergeBot. (A microservice to which PRs are sent to via a webhook configuration on a repo, and which initially does a no-op, but over time does things based upon content/context - i.e. seeks a policy decision or orchestrates out-of-band controls).
A PolicyBot. This should determine what to do based upon a) state (i.e. # of secrets, vulnerabilities) and/or policy (in code).It should be a microservice which is deployed and exposes an API which MergeBot can query.
An API for our gitlab-config-registry (the customer exposed repo). This should be a) deployed as a microservice, b) queriable by MergeBot and PolicyBot.