CodeRifts for GitLab — API Governance on Every Merge Request

Setup in 3 Steps

No native app to install. Just add the check to your pipeline.

1

Get a free API key

Sign up at app.coderifts.com/api/signup to get your API key.

2

Add `CODERIFTS_API_KEY` as a CI/CD variable

Go to Settings → CI/CD → Variables in your GitLab project and add the key as a masked variable.

3

Add the contract check to `.gitlab-ci.yml`

# .gitlab-ci.yml
stages:
  - test

api-contract-check:
  stage: test
  image: alpine:latest
  before_script:
    - apk add --no-cache curl jq git
  script:
    - |
      git fetch origin "$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
      OLD=$(git show "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME:api/openapi.yaml")
      NEW=$(cat api/openapi.yaml)
      RESULT=$(jq -n --arg o "$OLD" --arg n "$NEW" '{old_spec:$o,new_spec:$n}' \
        | curl -sf -X POST https://app.coderifts.com/api/v1/diff \
            -H "Authorization: Bearer $CODERIFTS_API_KEY" \
            -H "Content-Type: application/json" -d @-)
      echo "$RESULT" | jq .
      BREAKING=$(echo "$RESULT" | jq '.breaking_changes // 0')
      if [ "$BREAKING" -gt 0 ]; then
        echo "ERROR: $BREAKING breaking change(s) detected:"
        echo "$RESULT" | jq -r '(.changelog.breaking // [])[]'
        exit 1
      fi
  rules:
    - if: $CI_MERGE_REQUEST_IID
      changes:
        - "api/**/*.yaml"
        - "api/**/*.json"

Every Merge Request will now run this CodeRifts check automatically.

Advisory — this gate trusts the CodeRifts API response and fails the CI job. It does not verify a signed receipt, and it blocks a merge only if you make the job a required check. For an unbypassable, cryptographically verified gate, use coderifts/contract-gate as a required status check.

What It Does

On every Merge Request, CodeRifts analyzes your OpenAPI specs and reports:

Breaking Changes

Detects 10 types of breaking changes: endpoint removals, type changes, required field additions, and more.

Risk Scoring

Calculates a 0–100 risk score across 4 dimensions so you know exactly how dangerous a change is.

Policy Checks

Checks policy violations from your .coderifts.yml — breaking budgets, freeze windows, no-delete rules.

Security Analysis

Catches auth regressions, sensitive field exposure, and security-critical schema changes.

Deprecated: the CI/CD component

The gitlab.com/coderifts/gitlab-ci-component component is not currently published to the GitLab CI/CD Catalog. Use the API call above (advisory — it trusts the API response and fails the job), or coderifts/contract-gate for a verified, required-check gate. See the REST API documentation for full details.

Start protecting your APIs in GitLab today.

Add the contract check, get your free API key, and catch breaking changes on every Merge Request.

Get API Key — Free View contract-gate →