CI/CD Integration

CloudBurn is designed to fit into CI/CD pipelines as a cost optimization quality gate. Run it on pull requests to catch cost issues before they reach production.

How it fits into your pipeline

GitHub Actions

Add this workflow to .github/workflows/cloudburn.yml:

name: CloudBurn Cost Check
on: [pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '24'
      - run: npx cloudburn scan --exit-code

Using npx avoids a separate install step — it downloads and runs CloudBurn in one command.

This runs on every pull request and fails if CloudBurn finds any cost issues.

To scan a specific path:

      - run: npx cloudburn scan --exit-code ./infrastructure

To only fail on specific services:

      - run: npx cloudburn scan --exit-code --service ebs,ec2

Severity gates

--exit-code fails CI on any active finding. To fail CI only above a severity threshold, use --fail-on instead:

      - run: npx cloudburn scan --fail-on high

--fail-on can also be set as iac.fail-on / discovery.fail-on in .cloudburn.yml — see Configuration. --exit-code has no config equivalent. Pass the config file explicitly with --config to apply its rule selection, output defaults, or severity gate — see CI environments for why CI needs the flag.

      - run: npx cloudburn scan --config .cloudburn.yml

GitLab CI

Add to your .gitlab-ci.yml:

cloudburn-scan:
  image: node:24
  stage: test
  script:
    - npx cloudburn scan --exit-code
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

JSON output for CI annotations

Use JSON output to capture structured results for reporting or annotations:

npx cloudburn --format json scan --exit-code ./iac

In GitHub Actions with output capture:

      - name: Run CloudBurn scan
        id: scan
        run: |
          npx cloudburn --format json scan --exit-code ./iac > cloudburn-results.json || true
      - name: Upload results
        uses: actions/upload-artifact@v4
        with:
          name: cloudburn-results
          path: cloudburn-results.json

Discovery scans in CI

Running discovery scans in CI requires AWS credentials. Use your CI provider's secret management to inject them.

GitHub Actions with OIDC (recommended):

name: CloudBurn Discovery
on:
  schedule:
    - cron: '0 8 * * 1'  # Weekly on Monday

permissions:
  id-token: write
  contents: read

jobs:
  discover:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '24'
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/CloudBurnReadOnly
          aws-region: us-east-1
      - run: npx cloudburn discover --exit-code

Two discovery behaviors matter in CI:

• A large account may need more than the five-minute default. Raise it with npx cloudburn discover --timeout 900 --exit-code. An expired deadline exits 2, not 1. See Discovery timeout.
• Every CI run collects from AWS in full. Customer evidence is scoped to the credential session, and OIDC or other temporary credentials give each run a new session, so persisting ~/.cache/cloudburn/evidence between runs shares only public pricing. Size --timeout for a full collection. See Evidence cache.

What's next