Scan your staging site in Buildkite after each deploy, and fail the build on what you choose.

Before you start

A verified domain for the site.
An API key, in your agent's environment hook or a secrets plugin. Use a team key in CI: see Keys for CI.

Add the step

.buildkite/pipeline.yml

steps:
  - label: "ValiqAI scan"
    command: npx -y @valiqai/cli scan "$STAGING_URL" --fail-on blocker --output valiqai-junit.xml
    artifact_paths: valiqai-junit.xml
    env:
      STAGING_URL: https://staging.example.com
    plugins:
      - docker#v5.11.0:
          image: node:20
          propagate-environment: true
          environment: [VALIQAI_API_KEY]

The key goes in: Your agent environment hook or secrets plugin. Results show in: the build's artifacts, as JUnit XML.

Deploy, then scan

A wait step holds the scan until the deploy is done:

YAML

steps:
  - label: "Deploy to staging"
    command: ./scripts/deploy-staging.sh

  - wait

  - label: "ValiqAI scan"
    command: npx -y @valiqai/cli scan "$STAGING_URL" --fail-on blocker --output valiqai-junit.xml
    artifact_paths: valiqai-junit.xml
    env:
      STAGING_URL: https://staging.example.com
    plugins:
      - docker#v5.11.0:
          image: node:20
          propagate-environment: true
          environment: [VALIQAI_API_KEY]

What you'll see

The build's artifacts: the JUnit file, for Buildkite Test Engine or any tool that reads JUnit.
The step log: progress, the summary, and a link to the scan.
The scan's page in ValiqAI says Buildkite · main · a1b2c3d, linking back to the build.