CI with —fail-on

Gate merges when the inventory still contains findings above a chosen severity. For GitOps schedules, GitLab/CLI jobs, and agentic follow-ups on the same artifacts, see CI/CD & workflow integration.

Local

cryptarium scan --fail-on critical .
echo $?   # 1 if any critical findings; 0 otherwise; 2 on scan error

Outputs are written before the process exits on a threshold breach.

GitHub Actions

- uses: sgoveia/cryptarium@v0.3.0
  with:
    path: .
    fail-on: critical
    upload-sarif: true

Start with critical, then tighten to high once the backlog is under control. Pair with SARIF upload so failures are inspectable under Security → Code scanning. Thresholds follow risk scoring priority bands.