GitLab CI
Check the vendor slugs your organization tracks before deploying from the default branch. Store the API token in a masked, protected CI/CD variable.
1. Save the deployment check
Save this as scripts/check-upstream.mjs. It runs on Node.js 24 without additional packages.
CHECKUPSTREAM_API_TOKEN: a read-scopedcup_api_token stored in CI secrets.CHECKUPSTREAM_SERVICES: comma-separated slugs your organization tracks, such asstripe,openai.
const token = process.env.CHECKUPSTREAM_API_TOKEN;
const services = process.env.CHECKUPSTREAM_SERVICES;
if (!token || !services?.trim()) {
throw new Error("Set CHECKUPSTREAM_API_TOKEN and CHECKUPSTREAM_SERVICES in CI");
}
const url = new URL(
"/api/v1/deploy-gate",
process.env.CHECKUPSTREAM_BASE_URL || "https://checkupstream.com",
);
url.searchParams.set("services", services);
const response = await fetch(url, {
headers: { Authorization: `Bearer ${token}` },
signal: AbortSignal.timeout(20_000),
});
if (!response.ok) throw new Error(`Deployment check failed: HTTP ${response.status}`);
const gate = await response.json();
console.log(JSON.stringify(gate, null, 2));
if (
gate?.safe !== true ||
!Number.isInteger(gate.totalServicesChecked) ||
gate.totalServicesChecked <= 0
) {
process.exitCode = 1;
}2. Add the GitLab job
Set both variables in your project's CI/CD settings. Merge this job into your existing pipeline and require it before deployment. Protected variables must be available to the branch running the job.
upstream-health:
image: node:24-alpine
stage: test
rules:
- if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
script:
- node scripts/check-upstream.mjsThis script blocks deployment for: a recorded major outage, unmatched services, empty results, invalid responses, failed requests or missing configuration.
It does not block for: degraded, partial-outage, maintenance or unknown status. It does not check how old a status is. The API response omits observation dates; check the vendor's status page for that context.
This checks stored vendor status, so a passing result cannot guarantee a safe deployment or confirm application health. Your deployment job must require this check.
Continue your setup
Review the endpoints and credentials used by your integration.