Back
52/65
Lesson 52
8 min
CI/CD for Agent Code
Build automated quality gates with UBS, Beads, and DSR
Ready to level up?
Mark complete to track your learning progress.
Build automated quality gates with UBS, Beads, and DSR
Mark complete to track your learning progress.
Build automated quality gates using UBS, Beads, and DSR so bugs from agent-generated code never reach production.
AI coding agents write code fast but make predictable classes of mistakes: unclosed resources, missing error handling, hardcoded secrets, and stale imports. Automated quality gates catch these before they ship.
1000+ bug patterns across 9 languages
Export findings as trackable issues
Build releases locally when CI is throttled
Block bad code before it enters git
UBS detects 1000+ bug patterns that AI agents commonly produce. Run it on every commit and in CI pipelines.
# Scan only staged files (fast pre-commit check)ubs --staged# Scan working tree changes vs HEADubs --diff# CI mode: fail the build on warningsubs . --fail-on-warning# Output SARIF for GitHub Code Scanningubs . --format=sarif > results.sarif# Focus on specific bug categoriesubs . --category=resource-lifecycleubs . --category=security# Generate an HTML report for reviewubs . --html-report=scan-results.html# Compare against a baseline (only show new bugs)ubs . --comparison=baseline.json
ubs --staged in a pre-commit hook so agents can't commit code with known bugs. The scan runs in under 2 seconds for most projects.Wire UBS into your git hooks so every commit is automatically scanned.
#!/bin/bash# .git/hooks/pre-commit (or .githooks/pre-commit)# Run UBS on staged files onlyif command -v ubs &>/dev/null; thenecho "Running UBS scan on staged files..."ubs --staged --fail-on-warningif [ $? -ne 0 ]; thenecho "UBS found issues. Fix them before committing."echo "Run 'ubs --staged' to see details."exit 1fifi# DCG is separate: it runs as a Claude Code hook, not a Git hook.
# ubs:ignore comments for intentional false positives. Use sparingly.UBS can export Beads-compatible JSONL so you can review findings and turn the high-signal ones into tracked issues.
# Export UBS findings as Beads-compatible JSONLubs . --beads-jsonl findings.jsonl# Review a few findings firsthead -n 3 findings.jsonl# Create the findings you want to track as real issuesbr create --title "Fix UBS finding: resource leak in worker pool" --labels quality,ubs --priority 1br create --title "Fix UBS finding: missing auth error handling" --labels quality,ubs --priority 1# Now use BV to triage the findingsbv --robot-triage# → Prioritize the new quality issues alongside your regular work# Track scan results over timeubs . --format=json > scans/$(date +%Y%m%d).jsonubs . --comparison=scans/20260310.json# → Shows only NEW bugs since the baseline
When GitHub Actions is throttled or your CI is overloaded, DSR lets you build artifacts locally and then upload a GitHub release from the verified build output.
# Build artifacts locallydsr build ntm# Build only one targetdsr build ntm --target linux/amd64# Build a tagged version explicitlydsr build ntm --version 1.2.3# Upload the verified artifacts as a draft releasedsr release ntm 1.2.3 --draft# Verify an existing release laterdsr release verify ntm 1.2.3
dsr build <tool> first to verify the artifact set, then publish with dsr release <tool> <version> --draft before creating a final release.UBS --staged catches bugs before they enter git
UBS findings exported to Beads for triage
SARIF output for GitHub Code Scanning integration
DSR builds releases locally when CI is unavailable