Skip to content

Install VibeGuard

Where do you write (or read) the code?

All four run the same analysis engine. You can add more later.

Why a finding can differ between your editor and CI
  • Mode defaults differ. The VS Code on-save scan defaults to fast; the CLI, the Action and the Chrome extension use standard, which runs rules that fast skips.
  • What reaches the engine differs. VS Code passes a file, the CLI walks a directory, the Chrome extension joins the code blocks it extracted from a page into one snippet.
Add it to a GitHub workflow
- uses: actions/checkout@v4
  with:
    fetch-depth: 0      # only needed for a diff scan
- uses: YUTAKONDO1205/VibeGuard@v0
  with:
    path: .
    mode: standard
    format: sarif
    out: vibeguard.sarif
    fail-on: high
- uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: vibeguard.sarif
    category: vibeguard

The last step is optional and sends the report to GitHub code scanning, which means the findings — including the matched lines — leave your runner. Drop it and the scan stays entirely inside the job.

Build from source (for developers)
git clone https://github.com/YUTAKONDO1205/VibeGuard
npm install && npm run build
node apps/cli/dist/index.js ./your-project

The CLI is not published to npm, so there is no global install and no npx. Cloning is the way in above; alternatively the tarball attached to each release installs on its own, since the workspace packages are bundled into it. For automation, use the GitHub Action, which wraps this same CLI.