Gate a deploy on open findings

How it works

A small Node script (check.js, no dependencies beyond Node's built-in fetch) calls GET /api/sites/:id/findings for one site, and exits with a non-zero code if anything at or above your configured severity is still open.

• Exit code 0 — no findings at or above the threshold; safe to proceed
• Exit code 1 — findings found at or above the threshold; the gate should block
• Exit code 2 — the check itself failed (network error, bad credentials) — distinct from a real gate failure, since a broken check shouldn't silently look identical to "the site is clean"

Environment variables

Variable	Required	Notes
MONITOR_API_URL	Yes	e.g. https://app.drubix.com
MONITOR_AGENCY_ID	Yes	Your agency UUID, from the dashboard
MONITOR_SITE_ID	Yes	The specific site UUID to check
MONITOR_FAIL_ON_SEVERITY	No	Default high — one of critical/high/moderate/low

GitHub Actions example

This ships with the product as ci-integration/.github/workflows/example-monitor-gate.yml — copy it into your own repo's .github/workflows/ and adjust the trigger:

name: Drubix Gate

on:
  deployment_status:
  workflow_dispatch:

jobs:
  monitor-gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Check for open high/critical findings
        working-directory: ci-integration
        env:
          MONITOR_API_URL: ${{ secrets.MONITOR_API_URL }}
          MONITOR_AGENCY_ID: ${{ secrets.MONITOR_AGENCY_ID }}
          MONITOR_SITE_ID: ${{ secrets.MONITOR_SITE_ID }}
          MONITOR_FAIL_ON_SEVERITY: high
        run: node check.js

Add MONITOR_API_URL, MONITOR_AGENCY_ID, and MONITOR_SITE_ID as repository secrets before running this.

Running it locally

cd ci-integration
MONITOR_API_URL=https://app.drubix.com \
MONITOR_AGENCY_ID=<your-agency-uuid> \
MONITOR_SITE_ID=<a-site-uuid> \
node check.js

Any other CI system

check.js has no GitHub-specific dependency — it's a plain Node script reading environment variables and exiting with a status code, so it drops into GitLab CI, CircleCI, Jenkins, or any system that can run node check.js with the right env vars set.