Run Vibgrate in a GitLab CI Pipeline

GitLab CI/CD runs jobs defined in .gitlab-ci.yml. Adding a Vibgrate job gives every pipeline a DriftScore and lets you gate merge requests on a budget, with the SARIF report saved as a downloadable artifact.

Prerequisites

• A GitLab project with CI/CD enabled.
• Runners that can pull a Node.js image.

Steps

1. Add a job to .gitlab-ci.yml

Define a stage and a job that uses a Node image.

stages:
  - quality
vibgrate:
  stage: quality
  image: node:20

2. Run the scan

Invoke the CLI with the no-install form so nothing needs to be pre-baked into the image.

  script:
    - npx @vibgrate/cli scan

The job log shows the DriftScore (0 to 100) and the findings behind it.

3. Save the SARIF report

Produce SARIF and keep it as an artifact for download and review.

  script:
    - npx @vibgrate/cli scan --format sarif --out vibgrate.sarif
  artifacts:
    paths:
      - vibgrate.sarif

4. Gate merge requests

Add a drift budget so the job fails when the DriftScore is too high, blocking the merge request.

  script:
    - npx @vibgrate/cli scan --drift-budget 60

5. Verify in the pipeline view

Open the pipeline for a recent commit. The vibgrate job should run in the quality stage, and the artifact should be downloadable from the job page.

Verification

A passing scan exits 0 and the job is green; a budget breach exits non-zero and the job fails, blocking the merge request. Download the SARIF artifact to confirm findings were written.

vg scan --drift-budget 60

Next Steps

• Restrict scope on merge requests with vg scan --changed-only.
• Push results to Vibgrate Cloud with vg scan --push.
• Add a scheduled pipeline for nightly drift scans.