Run Vibgrate on CircleCI

CircleCI runs jobs defined in .circleci/config.yml. A Vibgrate job adds a DriftScore to every pipeline, stores the SARIF report as an artifact, and can gate the workflow on a drift budget.

Prerequisites

• A project connected to CircleCI with a .circleci/config.yml.
• Basic familiarity with CircleCI executors and workflows.

Steps

1. Create .circleci/config.yml

Start with the version and a job definition.

version: 2.1
jobs:
  drift:

2. Use a Node executor

Pick a Node Docker image so npx is available, then check out the code.

    docker:
      - image: cimg/node:20.11
    steps:
      - checkout

3. Run the scan

Add a run step that invokes the CLI. Bare scan analyzes the checked-out directory.

      - run: npx @vibgrate/cli scan

The DriftScore and findings appear in the step output.

4. Store the SARIF artifact

Produce SARIF and store it so you can download it from the job page.

      - run: npx @vibgrate/cli scan --format sarif --out vibgrate.sarif
      - store_artifacts:
          path: vibgrate.sarif

5. Gate on a drift budget

Apply a budget so the job fails when the DriftScore is too high.

      - run: npx @vibgrate/cli scan --drift-budget 60

Verification

Trigger a pipeline. The drift job should print a DriftScore; a budget breach turns it red. Confirm the SARIF appears under the job's Artifacts tab.

vg scan --drift-budget 60

Next Steps

• Add the job to a workflow alongside your tests.
• Limit scope on PRs with vg scan --changed-only.
• Push results to Vibgrate Cloud with vg scan --push.