This guide explains why and how to pin a specific Vibgrate CLI version so scans behave identically everywhere. It is for CI maintainers and teams that need reproducible results.
Overview
Different CLI versions can produce different findings as scanners improve. For trustworthy gates, you want every developer and every CI run using the same version. Pinning a version makes scans reproducible and prevents a surprise release from flipping a green build to red.
Pin in your project
Treat the Vibgrate CLI like any other dependency: pin an exact version in your project's manifest rather than allowing a floating range. With an exact version recorded and committed, every install resolves to the same CLI.
Run a pinned version without installing
When trying Vibgrate without a project install, the no-install form is:
npx @vibgrate/cli scan
For reproducibility, request a specific published version of @vibgrate/cli from your package runner so the same version is used each time, rather than always pulling the latest.
Pinning vs. vg update
vg update is great for keeping an interactive, local install current. In CI, prefer an explicit pinned version so updates are a deliberate, reviewed change rather than something that happens automatically mid-pipeline.
A healthy workflow
- Pin an exact version and commit it.
- Bump the pin in a pull request when you choose to adopt a new release.
- Re-baseline if a new version legitimately changes your DriftScore.
Related
See the update article, the CI integration guides, and the baseline refresh guide for handling score changes after a version bump.