Skip to content
VibeBeacon

GitHub Action

The best manifest is the one you never think about. This workflow re-scans on every push to main and uploads the result, so what we watch matches what you actually deployed.

1. Add the secret

  1. Create an API key under Settings, API keys, and copy it.
  2. In GitHub go to your repository, Settings, Secrets and variables, Actions, New repository secret.
  3. Name it VIBEBEACON_API_KEY and paste the key as the value.

Why a secret and not a variable

Repository variables are readable by anyone who can read the repo, and they show up in logs. Secrets are masked in output and are not exposed to workflows triggered from forks.

2. Add the workflow

Save this as .github/workflows/vibebeacon.yml.

.github/workflows/vibebeacon.yml
name: VibeBeacon

on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Scan and upload the manifest
        env:
          VIBEBEACON_API_KEY: ${{ secrets.VIBEBEACON_API_KEY }}
        run: npx vibebeacon@latest scan --upload

What it does

  • Checks out the repository so the lockfile is on disk.
  • Installs Node 22.
  • Runs the scanner, which reads the package files, builds the manifest and uploads it. The key comes from the environment, so it never appears in the command line or the log.

It does not install your dependencies. The scanner reads the lockfile, so a npm ci step would only make the job slower.

Useful changes

  • Scanning only when dependencies change: add a paths filter for package-lock.json and friends. Cheaper, but you miss runtime version changes.
  • Monorepos: add a working-directory to the run step, one job per app, and pass --name so each app lands separately.
  • Weekly instead of per push: swap the trigger for schedule: - cron: "0 20 * * 0". The manifest goes stale between runs but the job cost is near zero.
  • Other CI: any runner works. The whole job is one command with one environment variable.

If the job fails

  • 401: the secret is missing or misspelled. Secret names are case sensitive, and secrets are not available to workflows run from a fork.
  • 402: this app would be past your free one and there is no subscription yet. The job output includes the checkout link.
  • No dependencies found: the lockfile is probably not committed. Commit it, or run your install step before the scan.