GitLab CI

Scan your staging site in GitLab CI after each deploy, fail the pipeline on what you choose, and see each test in the merge request.

Before you start

A verified domain for the site.
An API key. Use a team key in CI: see Keys for CI.

Add the job

.gitlab-ci.yml

valiqai:
  stage: test
  image: node:20
  variables:
    STAGING_URL: https://staging.example.com
  script:
    - npx -y @valiqai/cli scan "$STAGING_URL" --fail-on blocker --output valiqai-junit.xml
  artifacts:
    when: always
    reports:
      junit: valiqai-junit.xml

The key goes in: Settings › CI/CD › Variables (masked). Results show in: the merge request's test report and the pipeline's Tests tab.

valiqai init adds this job to .gitlab-ci.yml for you. In a linked project the command is just npx -y @valiqai/cli scan: the address comes from valiqai.json, and GitLab checks the repository out already.

Deploy, then scan

Pass the deployed address from the deploy job to the scan with a dotenv report:

YAML

stages: [deploy, scan]

deploy_staging:
  stage: deploy
  script:
    - ./scripts/deploy-staging.sh
    - echo "STAGING_URL=https://staging.example.com" >> deploy.env
  artifacts:
    reports:
      dotenv: deploy.env

valiqai:
  stage: scan
  image: node:22
  needs: [deploy_staging]
  script:
    - npx -y @valiqai/cli scan "$STAGING_URL" --fail-on blocker --output valiqai-junit.xml
  artifacts:
    when: always
    reports:
      junit: valiqai-junit.xml

What you'll see

The merge request's test report and the pipeline's Tests tab: each test the scan ran, grouped by part of the app. A test fails when it found an open problem at --fail-on or above; one that couldn't reach a result is skipped, with the reason.
The job log: progress, the summary, and a link to the scan.
The scan's page in ValiqAI says GitLab CI · main · a1b2c3d, linking back to the job.

See CI output for the other report formats.