> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mergeguide.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CI/CD patterns

> Wire MergeGuide into any CI system using the CLI and SARIF output.

If your CI system isn't one with a dedicated integration, you can still gate builds
with MergeGuide: install the CLI, run a check, and let the exit code fail the build.
This page is the generic recipe.

## The pattern

Every CI integration is the same three steps:

1. Install the CLI (`pip install mergeguide`).
2. Run `mergeguide check` with a fail threshold.
3. Let the non-zero exit code fail the job.

```bash theme={null}
pip install mergeguide
mergeguide check . --fail-on-warning
```

`check` exits `1` when policy violations are found, which fails the step. See
[exit codes](/reference/cli#exit-codes).

## Emit SARIF for your security dashboard

Most CI and security platforms ingest SARIF. Write it to a file and upload it with
your platform's mechanism:

```bash theme={null}
mergeguide check . --format sarif --output mergeguide.sarif --fail-on-warning
```

See [Output formats](/reference/output-formats) for the available formats.

## Examples by system

<Tabs>
  <Tab title="GitHub Actions">
    Use the dedicated [GitHub Action](/integrations/github) — it wraps these steps
    and uploads to code scanning.
  </Tab>

  <Tab title="GitLab CI">
    Use the dedicated [GitLab CI template](/integrations/gitlab) — it produces a
    SAST report automatically.
  </Tab>

  <Tab title="Generic shell">
    ```bash theme={null}
    pip install mergeguide
    mergeguide check . --format sarif --output mergeguide.sarif --fail-on-warning
    ```
  </Tab>
</Tabs>

## Keep credentials in CI secrets

When a step needs an API key, reference it from your CI system's secret store —
never hardcode it:

```bash theme={null}
mergeguide login --api-key "$MERGEGUIDE_API_KEY"
```

## Scanners in CI

The vulnerability and IaC scanners take their own `--fail-on` threshold and also
exit non-zero to fail a build:

```bash theme={null}
mergeguide scan vuln --fail-on critical
mergeguide scan iac --path ./infra --fail-on high
```

## Next steps

<CardGroup cols={2}>
  <Card title="Output formats" icon="file-code" href="/reference/output-formats">
    Pick the right format for your pipeline.
  </Card>

  <Card title="PR gate" icon="code-pull-request" href="/install/pr-gate">
    Block merges on blocking findings.
  </Card>
</CardGroup>