CI/CD Integration

Yamlr acts as the ultimate deterministic gatekeeper. The engine was explicitly designed to return standard unix exit codes and output standardized reporting formats natively, making it a drop-in integration for GitHub Actions, GitLab CI, and pre-commit hooks.

1. The Safety Gate (Exit Codes)

When running locally, Yamlr prefers to guide the user. During CI pipeline evaluations, Yamlr must act ruthlessly.

You control workflow blocking via two primary flags:

--fail-on {error,warning,any} Instructs the engine to return Exit Code 1 when it uncovers an issue matching that severity level.
--risk-threshold {high,medium,low} Forces the engine to only trigger Exit Code 1 if the Safety Engine assigns the failure an architectural impact equivalent to or exceeding this threshold.

Example Scan Job

bash
# This pipeline fails if any High-Impact dependency failure is detected:
yamlr scan ./manifests --fail-on error --risk-threshold high --quiet

(The --quiet flag suppresses the standard verbose table output, logging purely critical workflow breaks).

2. Native GitHub Action

Yamlr provides an official GitHub composite action to keep your workflows pristine.

yaml
name: K8s Integrity Check
on: [push, pull_request]

jobs:
  yamlr-safety-engine:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Yamlr
        uses: yamlr/setup-action@v1
        with:
          version: 'latest'

      - name: Execute Deterministic Scan
        run: yamlr scan . --fail-on error --output sarif > report.sarif

3. SARIF Reporting

Yamlr natively outputs Security Analysis Results Format (SARIF).

Piping yamlr scan . --output sarif > report.sarif directly imports all semantic misconfigurations, missing port bindings, and ghost services natively into the GitHub Advanced Security UI, annotating the exact lines of code directly on the Pull Request.

4. Pre-Commit Hooks

Move the feedback loop "left" to the absolute beginning. Yamlr provides a native pre-commit hook.

Add this block to your .pre-commit-config.yaml:

yaml
repos:
  - repo: https://github.com/yamlr/yamlr-pre-commit
    rev: v1.0.0
    hooks:
      - id: yamlr-check
        args: ["--fail-on", "error", "--quiet"]

Whenever a developer types git commit, Yamlr parses the graph locally in < 2.0s. If of a structurally valid manifest introduces a broken semantic reference, Yamlr rejects the commit instantly, preserving the CI build queue.