CodeRifts for GitLab — API governance on every merge request
Sign up at app.coderifts.com/api/signup.
Go to Settings → CI/CD → Variables in your GitLab project and add the key as a masked variable.
# .gitlab-ci.yml
stages:
- test
api-contract-check:
stage: test
image: alpine:latest
before_script:
- apk add --no-cache curl jq git
script:
- |
git fetch origin "$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
OLD=$(git show "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME:api/openapi.yaml")
NEW=$(cat api/openapi.yaml)
RESULT=$(jq -n --arg o "$OLD" --arg n "$NEW" '{old_spec:$o,new_spec:$n}' \
| curl -sf -X POST https://app.coderifts.com/api/v1/diff \
-H "Authorization: Bearer $CODERIFTS_API_KEY" \
-H "Content-Type: application/json" -d @-)
echo "$RESULT" | jq .
BREAKING=$(echo "$RESULT" | jq '.breaking_changes // 0')
if [ "$BREAKING" -gt 0 ]; then
echo "ERROR: $BREAKING breaking change(s) detected:"
echo "$RESULT" | jq -r '(.changelog.breaking // [])[]'
exit 1
fi
rules:
- if: $CI_MERGE_REQUEST_IID
changes:
- "api/**/*.yaml"
- "api/**/*.json"Every Merge Request will now run this CodeRifts check automatically.
Advisory — this gate trusts the CodeRifts API response and fails the CI job. It does not verify a signed receipt, and it blocks a merge only if you make the job a required check. For an unbypassable, cryptographically verified gate, use coderifts/contract-gate as a required status check.
What it does#
On every Merge Request, CodeRifts analyzes your OpenAPI specs and reports: breaking changes (10 types), risk scoring (0–100 across 4 dimensions), policy checks from .coderifts.yml (breaking budgets, freeze windows, no-delete rules), and security analysis (auth regressions, sensitive field exposure).
Note on the CI/CD component#
The gitlab.com/coderifts/gitlab-ci-component component is not currently published to the GitLab CI/CD Catalog. Use the API call above (advisory), or coderifts/contract-gate for a verified, required-check gate. See the REST API documentation for full details.