Use case

Scan a monorepo

Run one quality gate across many packages in a single repositoryGateTest scans a whole monorepo in one pass — every package, multiple languages, shared and per-package config — without standing up a separate pipeline per project, and reports findings with their real file paths.

The problem

Monorepos concentrate many projects, often in several languages, behind one CI pipeline. A scanner that only understands a single language or a single package at the root either misses most of the tree or forces you to wire up N separate jobs.

What you want is one gate that walks the whole repository, understands each package's stack, and reports findings against their actual paths.

How GateTest does it

A single run covers a mixed monorepo: deep JavaScript/TypeScript analysis, pattern-level checks for Python, Go, Java, Ruby, and PHP, plus infrastructure-as-code (Dockerfile, Terraform, Kubernetes) and polyglot dependency manifests.

The monorepo-constraints module additionally checks for cross-package boundary violations — an app importing a sibling app, a shared package importing an app, relative imports that walk into a sibling member, and sibling packages used without being declared in the member's package.json — which are the bugs unique to the monorepo shape.

.github/workflows/gatetest.yml

# .github/workflows/gatetest.yml
name: GateTest
on:
  pull_request:
jobs:
  gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      # error-severity findings exit non-zero, fail the job and block the merge
      - run: npx -p @gatetest/cli gatetest --suite full

Steps

1Run GateTest from the repository root — it discovers packages and languages automatically.
2Findings are reported with their full path, so you can route them to the owning team.
3Use the prSize module to keep cross-package changes reviewable.

Frequently asked questions

Does GateTest need per-package configuration?

No. It discovers packages and languages from the repository structure and the declared workspaces (npm/yarn/pnpm workspaces, lerna), so a single run from the root covers the whole monorepo. A single .gatetest.json at the root is all the configuration it needs.

Can it catch cross-package problems?

Yes. Beyond scanning each package, the monorepo-constraints and import-cycle modules detect boundary violations and circular dependencies between workspaces — the failure modes specific to monorepos.