Ci
42 items tagged with "ci"
Tutorials19
Understand Vibgrate Exit Codes for Scripting and CI
Learn how Vibgrate exit codes work so you can gate pipelines on drift with --fail-on and --drift-budget and react in shell scripts.
Add Vibgrate to a GitHub Actions Workflow
Run the Vibgrate CLI on every push and pull request with GitHub Actions so upgrade drift is scanned automatically in CI.
Gate Pull Requests on a Drift Budget
Use vg scan --drift-budget in CI to fail pull requests that exceed a DriftScore threshold, keeping upgrade drift inside an agreed limit.
Run Vibgrate in a GitLab CI Pipeline
Add a drift-scanning job to .gitlab-ci.yml using the Vibgrate CLI, with artifacts and a SARIF report for merge requests.
Run Vibgrate in an Azure DevOps Pipeline
Add a Vibgrate drift scan to an Azure Pipelines YAML pipeline for .NET and Node.js projects, with a drift budget gate.
Run Vibgrate in a Jenkins Pipeline
Add a drift-scanning stage to a Jenkins declarative pipeline with the Vibgrate CLI and fail the build on a drift budget.
Run Vibgrate on CircleCI
Add a Vibgrate drift-scanning job to a CircleCI config using a Node executor, store the SARIF report, and gate on a drift budget.
Run Vibgrate in Bitbucket Pipelines
Add a drift-scanning step to bitbucket-pipelines.yml with the Vibgrate CLI, keep the SARIF report as an artifact, and gate on a drift budget.
Fail CI Builds with vg scan --fail-on
Use the --fail-on flag to make the Vibgrate CLI return a non-zero exit code at a chosen severity so CI builds fail on real problems.
Scan Only Changed Files in CI
Use vg scan --changed-only to focus pull request scans on modified files for faster, more relevant drift feedback in CI.
Cache Vibgrate Between CI Runs
Persist the Vibgrate cache directory across CI runs so repeated scans reuse prior work and finish faster.
Matrix Drift Scans Across a Monorepo
Use a CI matrix to run a Vibgrate scan per package in a monorepo, with the --cwd flag targeting each workspace directory.
Push Drift Results to Vibgrate Cloud from CI
Upload Vibgrate CLI scan results to Vibgrate Cloud from your pipeline with vg scan --push, authenticated by a DSN secret, for team-wide trend tracking.
Fail CI When New Drift Appears Against a Baseline
Wire vg scan --baseline into your pipeline so any new upgrade drift introduced by a change fails the build before it merges.
Generate an SBOM in CI with GitHub Actions
Add a GitHub Actions step that produces a fresh CycloneDX SBOM on every build and uploads it as a workflow artifact.
Integrate SBOM Generation into a Release Pipeline
Add a release-pipeline stage that scans, exports a CycloneDX SBOM, and publishes it as a versioned artifact for every release.
Combine a Drift Scan and SBOM Export in One CI Job
Run a single CI job that scans for drift with a failing gate and exports a CycloneDX SBOM, covering quality and inventory together.
Create a Vibgrate Cloud Data Source with vg dsn create
Generate an HMAC-signed DSN token with vg dsn create to authenticate non-interactive dashboard uploads from CI and automation.
Schedule Recurring Drift Reporting
Run vg scan --push on a schedule with cron or a CI scheduled job so drift reports and dashboard trends stay current without manual effort.
Products4
FAQs17
How do I create a drift baseline?
Run vg baseline to perform a full scan and save the result to .vibgrate/baseline.json. This snapshot becomes your reference point for measuring whethe...
How do I set up the DSN (Data Source Name) for dashboard uploads?
Set the VIBGRATE_DSN environment variable with your DSN token. System-wide: add export VIBGRATE_DSN="your-dsn" to ~/.zshrc or ~/.bashrc (macOS/Linux) ...
What are the best practices for managing the VIBGRATE_DSN?
Never commit DSN tokens to source control. Store DSNs as CI/CD secrets. Use separate DSNs for different environments (dev, staging, production) if nee...
How do I integrate Vibgrate into CI/CD pipelines?
The CLI requires no login for scanning and returns meaningful exit codes (0=success, 2=threshold exceeded). Basic CI integration: npx @vibgrate/cli sc...
How do I upload SARIF results to GitHub Code Scanning?
Run scan with SARIF output: npx @vibgrate/cli scan --format sarif --out vibgrate.sarif --fail-on error. Then use github/codeql-action/upload-sarif@v3 ...
How do I gate pull requests on known vulnerabilities with GitHub Actions?
Use the maintained vibgrate/cli Action: `uses: vibgrate/cli@v1` with `vulns: true`, `fail-on: error`, and `upload-sarif: true`. It scans installed dep...
What is a drift budget and how do I use it?
A drift budget sets a maximum acceptable drift score. Use --drift-budget 40 to fail the scan (exit code 2) if your drift score exceeds 40. Combine wit...
What do the CLI exit codes mean?
Exit code 0: Success (scan completed, all gates passed). Exit code 1: Runtime error (invalid flags, missing files, crash). Exit code 2: Threshold exce...
What's the difference between --fail-on error and --fail-on warn?
--fail-on error exits with code 2 only if error-level findings exist (e.g., runtime near EOL, framework 3+ majors behind). --fail-on warn exits with c...
How do I set up Vibgrate in Azure DevOps?
Add NodeTool@0 task with versionSpec: '22.x', then run npx @vibgrate/cli scan --fail-on error. For SARIF artifacts: add --format sarif --out vibgrate....
How do I set up Vibgrate in GitLab CI?
Use node:22 image and run npx @vibgrate/cli scan --format sarif --out vibgrate.sarif --fail-on error. Add artifacts.reports.sast: vibgrate.sarif for S...
How do I run Vibgrate in Jenkins?
Use node:22 Docker image or ensure Node.js 22+ is installed on agents. Run npx @vibgrate/cli scan --format sarif --out vibgrate.sarif --fail-on error....
What is the baseline.json file for?
The .vibgrate/baseline.json file is a snapshot of your drift score at a point in time. It serves as a reference point for CI gates — you can fail buil...
What does the --changed-only flag do?
The --changed-only flag scans only files that have changed (typically detected via git diff). This speeds up scans in CI by skipping unchanged project...
What does --strict do on the push command?
When --strict is set, the push command exits with error code if the dashboard upload fails (network error, authentication problem, etc.). Without --st...
What does the vg bisect command do?
`vg bisect <package> <constraint>` pinpoints the commit where a dependency crossed a version line. Where `vg why` narrates every version change, `vg b...
Can vg bisect fail my build until a dependency is patched?
Yes. Add `--assert`: `vg bisect lodash 4.17.21 --assert` exits non-zero when the current version does not satisfy the constraint, so a CI step blocks ...
Glossaries2
Dependency Drift
Dependency drift is the growing gap between the dependency versions a project declares and the current, supported releases of those same packages.
Drift Budget
A drift budget is a maximum acceptable DriftScore that a project agrees not to exceed, enforced automatically in CI so drift cannot quietly grow back.