Gate every PR on
launch readiness.

Add VibeCheck to your CI pipeline. Every pull request gets a Vibe Score, a full report posted as a PR comment, and an automatic block if a CRITICAL or HIGH check fails.

Install from GitHub Marketplace →

Takes you to github.com/marketplace

Why we built this

Vibe coders ship fast. That is the point. But every PR is a potential launch — a new feature going live, a config change, a dependency bump. The problem is that none of your existing CI checks are asking the questions that matter at launch: Is the admin route protected? Is the AI key in the client bundle? Does the payment webhook verify signatures?

Lighthouse runs in your browser on demand. VibeCheck was built to run automatically, on every PR, against your staging deployment — before anyone merges anything. The goal is to make launch-readiness a default part of your workflow, not something you remember to check the night before going live.

The GitHub Action takes the same 168 checks available on the web app and runs them inside your CI pipeline. It posts the result as a PR comment so your whole team can see the score before merge, and it can block the PR if a check at the severity you care about fails.

How it works

PR is opened

A pull request is opened or updated against your main branch. Your CI workflow triggers.

VibeCheck runs

The action visits your staging URL with a headless browser and runs all 168 checks — auth, security, AI safety, SEO, mobile, performance.

Results posted

A Vibe Score is posted as a PR comment with a full breakdown. The step fails if a check at your configured severity is found.

Set it up in 3 steps

Run this on every PR, automatically, with no account required.

Create the workflow file

Create .github/workflows/vibecheck.yml in your repo.

.github/workflows/vibecheck.yml

name: VibeCheck

on:
  pull_request:
    branches: [main]

jobs:
  vibecheck:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write

    steps:
      - uses: actions/checkout@v4

      - name: Run VibeCheck
        uses: Sathappan/vibecheck-action@v1
        with:
          url: https://your-staging-app.vercel.app
          fail_below: 60
          block_on: CRITICAL,HIGH
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Set your staging URL

Replace https://your-staging-app.vercel.app with your actual preview deployment URL.

If you use Vercel, the preview URL is available as ${{ steps.deploy.outputs.url }} from the Vercel GitHub Action. Railway and Fly.io have similar outputs from their own actions.

The URL must be publicly reachable — VibeCheck visits it with a headless browser, just like a real user would.

Push and open a PR

Commit the workflow file, push to your branch, and open a pull request. The action runs automatically. No account required, no API key to set up — just GITHUB_TOKEN, which GitHub provides automatically in every workflow.

What the PR comment looks like

Every PR gets a comment automatically posted by the action with the full audit result.

vibecheck-botcommented just now

Vibe Score — Almost there

VibeCheck · 168 checks · 4 min 12 sec

View full report →

blockers

failures

warnings

150

passing

Blockers — merge blocked

CRITICAL

Admin route not server-protected

/admin returns 200 without auth check

auth-018

HIGH

OpenAI key exposed in client bundle

sk-proj-... pattern found in 972-abc.js

ai-003

▸ 3 more failures, 11 warnings — view full report

All inputs

Configure the action with these parameters in your workflow file.

Input	Required	Default	Description
url	Yes	—	Staging URL to audit. Must be publicly reachable.
fail_below	No	60	Fail the step if Vibe Score is below this value (0–100).
block_on	No	CRITICAL,HIGH	Comma-separated severities that block the PR when a FAIL is found.
privacy	No	private	Audit visibility: private or public.
comment_mode	No	update	PR comment behavior: update (edit existing), new, or off.
auth_login_url	No	—	Login URL for an authenticated second pass.
auth_username	No	—	Test account email for the authenticated pass.
auth_password	No	—	Test account password. Use a GitHub secret.

Testing behind a login

If your app has a dashboard or protected flows you want to audit, pass test credentials to run a second authenticated pass. Create a throwaway test account in your app, store the password as a GitHub secret, and add the auth inputs.

authenticated pass example

- name: Run VibeCheck
  uses: Sathappan/vibecheck-action@v1
  with:
    url: https://your-staging-app.vercel.app
    auth_login_url: https://your-staging-app.vercel.app/login
    auth_username: test@yourapp.com
    auth_password: ${{ secrets.TEST_ACCOUNT_PASSWORD }}
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}