This article explains how to make a Vibgrate scan fail the build based on the severity of its findings, using the --fail-on flag. It is for CI engineers and teams that want risky drift to block a merge.
Overview
By default a scan reports findings and exits successfully. --fail-on changes the exit code so that when a finding reaches the severity you specify, the scan exits non-zero and your pipeline stops.
Step-by-step
Fail the build when any error-level finding is present:
vg scan --fail-on error
With no install, the same gate in npx form:
npx @vibgrate/cli scan --fail-on error
When the threshold is met, the command exits with a non-zero status, which CI interprets as a failed step.
How it fits a pipeline
Place the scan as a required step in your pull request checks. With --fail-on set, drift that reaches your chosen severity prevents the change from merging until it is addressed. To also produce findings your platform can display inline, combine this with --format sarif.
Combining with a drift budget
--fail-on gates on individual finding severity, while --drift-budget gates on the overall DriftScore. Use them together when you want both a per-finding gate and a whole-project ceiling.
Exit codes
A successful scan that passes the gate exits 0. A scan that trips the --fail-on threshold exits non-zero. See the exit codes reference for the full list.
Related
See the setting a drift budget guide, the exit codes reference, the SARIF output guide, and the scan command reference.