Fail CI Builds with vg scan --fail-on

CI systems decide pass or fail from the exit code of each step. The --fail-on flag tells the Vibgrate CLI to exit non-zero when findings reach a chosen severity, turning a scan into a build gate without needing a numeric drift budget.

Prerequisites

• Vibgrate running in any CI system.
• A pipeline step whose pass/fail is driven by the command exit code.

Steps

1. Understand exit codes

A bare scan reports the DriftScore and exits 0 by default. To fail a build you need a non-zero exit code, which is exactly what --fail-on produces when the threshold is met.

vg scan

2. Pick a failure severity

Decide at what severity a build should break. Failing on error is a common starting point because it blocks only the most serious findings.

3. Run scan with --fail-on

Pass the severity to --fail-on. If any finding reaches that level, the command exits non-zero.

npx @vibgrate/cli scan --fail-on error

4. Wire it into CI

Use the flagged command as the scan step. Most CI systems fail the job automatically on a non-zero exit.

      - run: npx @vibgrate/cli scan --fail-on error

5. Verify the failure path

Run the command locally against a project that has error-level findings and check the exit code; it should be non-zero, which is what CI reacts to.

npx @vibgrate/cli scan --fail-on error

Verification

With no error-level findings the command exits 0 and the build passes. Introduce an error-level finding and the same command exits non-zero, failing the build. Compare the two runs to confirm the gate works.

Next Steps

• Combine with --drift-budget to also cap the overall DriftScore.
• Emit SARIF with vg scan --format sarif to route findings into code scanning.
• Scope PR runs with vg scan --changed-only.