diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 14931f9..694f93e 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -19,6 +19,7 @@ mirror:
   - npmci git mirror
   tags:
   - docker
+  - notpriv
 
 snyk:
   stage: security
@@ -28,6 +29,26 @@ snyk:
     - npmci command snyk test
   tags:
   - docker
+  - notpriv
+
+codequality:
+  stage: security
+  image: docker:stable
+  allow_failure: true
+  services:
+    - docker:stable-dind
+  script:
+    - export SP_VERSION=$(echo "$CI_SERVER_VERSION" | sed 's/^\([0-9]*\)\.\([0-9]*\).*/\1-\2-stable/')
+    - docker run
+        --env SOURCE_CODE="$PWD"
+        --volume "$PWD":/code
+        --volume /var/run/docker.sock:/var/run/docker.sock
+        "registry.gitlab.com/gitlab-org/security-products/codequality:$SP_VERSION" /code
+  artifacts:
+    paths: [codeclimate.json]
+  tags:
+  - docker
+  - priv
 
 testLEGACY:
   stage: test
@@ -38,6 +59,7 @@ testLEGACY:
   coverage: /\d+.?\d+?\%\s*coverage/
   tags:
   - docker
+  - notpriv
   allow_failure: true
 
 testLTS:
@@ -49,6 +71,7 @@ testLTS:
   coverage: /\d+.?\d+?\%\s*coverage/
   tags:
   - docker
+  - notpriv
     
 testSTABLE:
   stage: test
@@ -59,16 +82,19 @@ testSTABLE:
   coverage: /\d+.?\d+?\%\s*coverage/
   tags:
   - docker
+  - notpriv
 
 release:
   stage: release
   script:
+  - npmci node install stable
   - npmci npm prepare
   - npmci npm publish
   only:
   - tags
   tags:
   - docker
+  - notpriv
 
 trigger:
   stage: trigger
@@ -78,6 +104,7 @@ trigger:
   - tags
   tags:
   - docker
+  - notpriv
 
 pages:
   image: hosttoday/ht-docker-node:npmci
@@ -87,6 +114,7 @@ pages:
     - npmci command npmpage
   tags:
     - docker
+    - notpriv
   only:
     - tags
   artifacts:
diff --git a/ts/npmts.cli.ts b/ts/npmts.cli.ts
index 275235d..36611d3 100644
--- a/ts/npmts.cli.ts
+++ b/ts/npmts.cli.ts
@@ -51,11 +51,10 @@ export let run = async () => {
   );
   plugins.beautylog.log('---------------------------------------------');
   let npmtsCli = new plugins.smartcli.Smartcli();
-  
+
   // build
-  npmtsCli
-    .addCommand('build')
-    .subscribe(async (argvArg) => {
+  npmtsCli.addCommand('build').subscribe(
+    async argvArg => {
       let done = q.defer();
       plugins.beautylog.info('npmts version: ' + npmtsProjectInfo.version);
       const configArg: NpmtsConfig.INpmtsConfig = await NpmtsConfig.run(argvArg);
@@ -94,16 +93,18 @@ export let run = async () => {
         .then(NpmtsShip.run);
 
       return done.promise;
-    }, err => {
+    },
+    err => {
       if (err instanceof Error) {
         console.log(err);
       }
-    })
+    }
+  );
 
   // standard task
   npmtsCli.standardTask().subscribe(async argvArg => {
-    await npmtsCli.trigger('build')
-  })
+    await npmtsCli.trigger('build');
+  });
 
   // cli metadata
   npmtsCli.addVersion(npmtsProjectInfo.version);