Run Vibgrate in Bitbucket Pipelines

Bitbucket Pipelines runs steps defined in bitbucket-pipelines.yml. A Vibgrate step gives every pipeline a DriftScore, keeps the SARIF report as an artifact, and can fail the pipeline on a drift budget.

Prerequisites

• A Bitbucket repository with Pipelines enabled.
• A bitbucket-pipelines.yml file at the repository root.

Steps

1. Create bitbucket-pipelines.yml

Define the default pipeline.

pipelines:
  default:
    - step:
        name: Vibgrate Drift

2. Use a Node image

Set a Node image so npx is available to the step.

        image: node:20

3. Run the scan

Add the scan to the step's script. Bare scan analyzes the cloned repository.

        script:
          - npx @vibgrate/cli scan

The DriftScore and findings print to the step log.

4. Keep the SARIF artifact

Produce SARIF and declare it as an artifact so it is retained.

        script:
          - npx @vibgrate/cli scan --format sarif --out vibgrate.sarif
        artifacts:
          - vibgrate.sarif

5. Gate on a drift budget

Apply a budget so a high DriftScore fails the step.

        script:
          - npx @vibgrate/cli scan --drift-budget 60

Verification

Push a commit to trigger the pipeline. The step should report a DriftScore; a budget breach turns the step red. Confirm vibgrate.sarif is listed under the pipeline's artifacts.

vg scan --drift-budget 60

Next Steps

• Add a pull-request-specific pipeline that runs vg scan --changed-only.
• Push results to Vibgrate Cloud with vg scan --push.
• Schedule a nightly pipeline for full drift scans.