Milestones (early access)

The Milestones page tells you, at planning time, which upcoming work you should talk to the team about. heyGRC reads each GitHub milestone (title and description) when it is created or edited, checks it against your own triage questions and linked policies, and puts the ones that match in To consult. Engineers do nothing new, and the detailed check still happens on each pull request.

How a milestone is checked

1. A milestone is created or edited in a repository the heyGRC GitHub App can see, or an issue or pull request that carries it is added to a GitHub Project (this needs the read-only Organization projects permission, which your admin approves on GitHub).
2. heyGRC matches its text against the terms of your triage questions and the clauses of your linked policies. This step uses no AI.
3. Only when something matches, an AI model answers each matched question with Yes, Unclear or No and a one-line reason, and sets a priority: High, Medium or Low. Each answer is labelled AI-generated. "Unclear" counts toward a consult.
4. The milestone lands in To consult. When the match came only from question terms (no policy clause) and the AI answers No to every question, the milestone moves to All with the label "AI: none of your questions applies".

AI answers help you set priorities. They do not replace your review. heyGRC points to where a consult is worth it; it never signs off planned work.

Orgs on EU inference still get the matches, but the AI priority shows Unavailable.

Triage questions

Settings → Triage questions (owners and admins).

• Up to 12 questions. Each can carry terms: words or short phrases that flag a milestone for that question. Leave the terms empty and heyGRC uses terms from the question text.
• Use the example questions loads a starting set you can edit.
• Questions are versioned. After a save, heyGRC re-checks your milestones against the new questions. Questions can be saved up to 20 times a day.

Policies you linked for pull request reviews are used here too. See Where your policies live.

The page

Tabs: To consult, All, Decided. Each row shows the milestone (with Open on GitHub), its state and due date, the priority and what it matched. Show details opens the matched questions with their matched terms, the AI answers, the linked policies, the decision history and the linked work.

Decisions

Owners and admins record a decision on each milestone: Consult, Not needed or Done, with an optional note of up to 500 characters. Members can read everything but not decide.

A milestone you mark Consult stays in To consult while the conversation happens. If the milestone's text changes on GitHub after a decision, it shows Changed since decision and comes back to To consult if it still matches.

Download CSV exports the decision log of the current tab: Decided at, Decided by (user id), Decision, Note, Repository, Milestone number, Title, Priority, Matched question ids. One line per decision; a milestone with no decision yet has one line with the decision cells empty. Up to 2,000 milestones per export.

Weekly email

Every Monday, owners and admins get a "Milestones to consult on" email listing this week's milestones still waiting for a decision (counts only, without titles, for organizations on EU inference), with how many are new this week and decided this week, and a count of older milestones still waiting with a link to see them all in heyGRC. Each owner or admin can switch it off for themselves in Settings, under Weekly email.

Each milestone in the email links to that milestone in heyGRC, with its details open. The email has no open or click tracking.

Linked work

Under a milestone, Linked work lists the pull requests and issues that carry that milestone on GitHub. Pull requests show their state, how many heyGRC reviews ran and their findings by severity; View findings opens the Findings page filtered to that pull request. No keys or labels are needed in titles: the link is GitHub's own milestone field.

What heyGRC does on GitHub

Nothing new for engineers. heyGRC reads milestones, and the GitHub Project items that carry them, with the GitHub App's read access, and posts no comment, label or issue for milestones. See GitHub App permissions.

Limits

• GitHub milestones only (including through GitHub Projects). No other planning tool.
• When Milestones is switched on, heyGRC reads your existing open milestones once. Any it could not read then appear when they are next edited.
• The AI check runs a limited number of times per org per day; above that a milestone shows "Queued: daily limit reached" and is checked the next day.
• Milestone text is kept 12 months from its last change on GitHub. Decisions are kept 3 years while you are a customer, without the title once the text is purged. After you uninstall the GitHub App, both are deleted within the uninstall window; download the CSV first if you want to keep the decision log.