Other CI providers

nestjs-doctor is a CLI, so anything that runs Node can run it. These are the integrations that need more than a bare command.

SARIF sends findings to the repository's Security tab. They persist across runs as alerts rather than living only in a pull request comment.

Add the scan and the upload step to .github/workflows/nestjs-doctor.yml:

permissions:
  contents: read
  security-events: write
 
steps:
  - uses: actions/checkout@v4
    with:
      fetch-depth: 0
  - uses: RoloBits/nestjs-doctor@v1
    id: doctor
    with:
      scope: full
      sarif: "true"
  - uses: github/codeql-action/upload-sarif@v3
    if: always() && steps.doctor.outputs.sarif-file != ''
    with:
      sarif_file: ${{ steps.doctor.outputs.sarif-file }}

Every result carries a partialFingerprints entry derived from the rule, path, message, and source text. Without it GitHub computes its own fingerprint from the surrounding source. An edit near a finding then closes the old alert and opens an identical new one.

The gitlab format emits the CodeClimate subset GitLab's Code Quality widget reads, so findings appear on the merge request diff.

Add the job to .gitlab-ci.yml:

nestjs-doctor:
  image: node:22
  script:
    - npx nestjs-doctor@latest . --format gitlab --output gl-code-quality-report.json
  artifacts:
    reports:
      codequality: gl-code-quality-report.json

--format gitlab defaults --blocking to none, so the job passes whatever it reports. Pass --blocking error to fail the pipeline instead.

--output <path> writes the payload to a file instead of stdout, and --json-compact drops the indentation from the JSON-based formats.

github is additive rather than a replacement. It prints annotations and appends the markdown report to $GITHUB_STEP_SUMMARY, while still printing the readable console report to the log.

GitHub caps annotations at ten errors and ten warnings per step and silently drops the rest. The annotations are a convenience; the job summary carries every finding.

Gate a commit from .husky/pre-commit:

npx nestjs-doctor . --staged --blocking error

--staged scopes to the files in the git index. The project is still analyzed in full. A change that breaks a cross-file rule is caught even when the file it is reported against is not in the commit.

Running from inside a hook is safe. Git exports GIT_DIR, GIT_INDEX_FILE, and friends to every hook, and children inherit them. nestjs-doctor clears those before shelling out to git, so it resolves everything against the directory it was pointed at.