Using Riven

GitLab gate

Riven becomes authoritative when GitLab CI runs it on merge request pipelines and protected branches require successful pipelines before merge.

The gate command

bash

node dist/index.js gitlab-gate --repo . --config .governor.yml --output risk-contract.yaml

What the job writes

risk-contract.yaml
governor-remediation.md
optional MR comments and labels when token-backed actions are enabled

Minimal job shape

yaml

governor:
  stage: governor
  image: node:20-bookworm
  variables:
    GIT_DEPTH: "0"
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
  before_script:
    - apt-get update && apt-get install -y curl git
    - curl -fsSL "https://gitlab.com/gitlab-org/orbit/knowledge-graph/-/raw/main/install.sh" | bash
    - export PATH="$HOME/.local/bin:$PATH"
    - npm ci
  script:
    - npm run build
    - node dist/index.js gitlab-gate --repo . --config .governor.yml --output risk-contract.yaml
  artifacts:
    when: always
    paths:
      - risk-contract.yaml
      - governor-remediation.md

What "blocked" really means

If the contract status is fail, the job exits non-zero. When GitLab requires successful pipelines, the merge button stays blocked by policy.

Actions are optional

MR comments and labels are nice, but they are not the gate. The gate is the failed job plus required successful pipeline policy.

Live proof

Next: MCP server.