CI/CD Integration

CloudBurn is designed to fit into CI/CD pipelines as a cost optimization quality gate. Run it on pull requests to catch cost issues before they reach production.

How it fits into your pipeline

GitHub Actions

For GitHub, the CloudBurn GitHub Action is the quickest route. It needs no Node.js setup and adds inline annotations, a sticky pull request comment, and a step summary:

      - uses: actions/checkout@v6
      - uses: towardsthecloud/cloudburn-action@v1
        with:
          fail-on: high

To run the CLI directly instead, add this workflow to .github/workflows/cloudburn.yml:

name: CloudBurn Cost Check
on: [pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '24'
      - run: npx cloudburn scan --exit-code

Using npx avoids a separate install step — it downloads and runs CloudBurn in one command.

This runs on every pull request and fails if CloudBurn finds any cost issues.

To scan a specific path:

      - run: npx cloudburn scan --exit-code ./infrastructure

To only fail on specific services:

      - run: npx cloudburn scan --exit-code --service ebs,ec2

Severity gates

--exit-code fails CI on any active finding. To fail CI only above a severity threshold, use --fail-on instead:

      - run: npx cloudburn scan --fail-on high

--fail-on can also be set as iac.fail-on / discovery.fail-on in .cloudburn.yml — see Configuration. --exit-code has no config equivalent. Pass the config file explicitly with --config to apply its rule selection, output defaults, or severity gate — see CI environments for why CI needs the flag.

      - run: npx cloudburn scan --config .cloudburn.yml

GitLab CI

Add to your .gitlab-ci.yml:

cloudburn-scan:
  image: node:24
  stage: test
  script:
    - npx cloudburn scan --exit-code
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

JSON output for CI annotations

Use JSON output to capture structured results for reporting or annotations:

npx cloudburn --format json scan --exit-code ./iac

In GitHub Actions with output capture:

      - name: Run CloudBurn scan
        id: scan
        run: |
          npx cloudburn --format json scan --exit-code ./iac > cloudburn-results.json || true
      - name: Upload results
        uses: actions/upload-artifact@v4
        with:
          name: cloudburn-results
          path: cloudburn-results.json

Discovery scans in CI

Running discovery scans in CI requires AWS credentials. Use your CI provider's secret management to inject them.

GitHub Actions with OIDC (recommended):

name: CloudBurn Discovery
on:
  schedule:
    - cron: '0 8 * * 1'  # Weekly on Monday

permissions:
  id-token: write
  contents: read

jobs:
  discover:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '24'
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/CloudBurnReadOnly
          aws-region: us-east-1
      - run: npx cloudburn discover --exit-code

Two discovery behaviors matter in CI:

• A large account may need more than the five-minute default. Raise it with npx cloudburn discover --timeout 900 --exit-code. An expired deadline exits 2, not 1. See Discovery timeout.
• Every CI run collects from AWS in full. Customer evidence is scoped to the credential session, and OIDC or other temporary credentials give each run a new session, so persisting ~/.cache/cloudburn/evidence between runs shares only public pricing. Size --timeout for a full collection. See Evidence cache.

What's next