Rejekto

Cookie consent check in a CI pipeline

After every deployment of a client website, Rejekto runs a scan and stops the pipeline when the score drops below your threshold or a tracker appears that was not in the previous scan. This is a technical audit of the website's behaviour, not legal advice.

What you need

  1. The website in Rejekto. Its ID is in the address of the website's detail page in the dashboard: /app/sites/<id>.
  2. An API key for CI only, with the member role. The owner of the organization creates it in the dashboard under API keys.
  3. The key as a secret CI variable, never in the YAML or in the repository: in GitLab a Masked and Protected variable REJEKTO_API_KEY, in GitHub the secret REJEKTO_API_KEY.
  4. The script copied into the website's repository, for example into ci/. It has no dependencies; Node 18 or newer is enough.

Download the script rejekto-check.mjs

GitLab CI

consent-check:
  stage: post-deploy
  image: node:22-alpine
  needs: [deploy]
  variables:
    REJEKTO_SITE_ID: "00000000-0000-0000-0000-000000000000"
    REJEKTO_MIN_SCORE: "80"
  # REJEKTO_API_KEY: Settings → CI/CD → Variables (Masked, Protected), not here.
  script:
    - node ci/rejekto-check.mjs
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

GitHub Actions

jobs:
  consent-check:
    needs: deploy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: node ci/rejekto-check.mjs
        env:
          REJEKTO_API_KEY: ${{ secrets.REJEKTO_API_KEY }}
          REJEKTO_SITE_ID: "00000000-0000-0000-0000-000000000000"
          REJEKTO_MIN_SCORE: "80"

Things to keep in mind

  • One website and device can be scanned manually at most once every 10 minutes. If two deployments follow shortly after each other, the script waits and retries.
  • The scan uses the public address of the website from its settings in Rejekto, not a deployment preview. Place the step after the production deployment.
  • If the website blocks the automated browser (anti-bot protection) or the scan fails, the step fails with an explanation. Rejekto does not bypass such protection.
  • The first scan of a website has nothing to compare against. New trackers are reported from the second scan on.
  • The script prints the score, new trackers and a link to the website detail. It never prints the API key.
  • The script's output is in English; REJEKTO_LANG: "sk" switches it to Slovak.

Back to the home page