CI with —fail-on

Gate merges when the inventory still contains findings above a chosen severity.

Local

cryptarium scan . --fail-on critical
echo $?   # 1 if any critical findings; 0 otherwise; 2 on scan error

GitHub Actions

- uses: sgoveia/cryptarium@v0.1.1
  with:
    path: .
    fail-on: critical
    upload-sarif: true

Start with critical, then tighten to high once the backlog is under control. Pair with SARIF upload so failures are inspectable in the Security tab.