CI Integration: GitLab CI

Overview

Vibgrate integrates with GitLab CI using standard SARIF output, which GitLab can ingest as a SAST report.

Basic Pipeline

vibgrate:
  image: node:22
  script:
    - npx @vibgrate/cli scan . --fail-on error

SAST Report Integration

vibgrate:
  image: node:22
  script:
    - npx @vibgrate/cli scan . --format sarif --out vibgrate.sarif --fail-on error
  artifacts:
    reports:
      sast: vibgrate.sarif

Findings appear in the Security Dashboard and on merge requests.

Drift Budget Enforcement

vibgrate:
  image: node:22
  script:
    - |
      npx @vibgrate/cli scan . \
        --baseline .vibgrate/baseline.json \
        --drift-budget 40 \
        --drift-worsening 5 \
        --fail-on error

Dashboard Push

vibgrate:
  image: node:22
  variables:
    VIBGRATE_DSN: $VIBGRATE_DSN
  script:
    - npx @vibgrate/cli scan . --push --strict --fail-on error

Store your DSN in Settings → CI/CD → Variables.

Merge Request Pipeline

vibgrate:
  image: node:22
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  script:
    - npx @vibgrate/cli scan . --format sarif --out vibgrate.sarif --fail-on error
  artifacts:
    reports:
      sast: vibgrate.sarif