CI/CD integration
Run policy-aware scans in pipelines and use their final verdict safely.
After deployment and first-time setup, use the CLI for most pipelines. It handles profiles, authentication, registry scans, local Docker or Podman images, archives, polling, and exit codes. Create a dedicated organization token with pipeline_scan, inject it only from the CI secret manager, and label the token so pipeline activity remains attributable.
export JUSTSCAN_TOKEN="<pipeline-scoped-org-token>"
justscan scan registry.example.com/my-app:${GIT_SHA}The CLI waits for the final verdict by default. A successful command means the policy passed; a policy failure exits 1; infrastructure or scan problems exit 2. Start the job as advisory while validating scanner access and policy rules, then make it required before promotion or deployment.
Do not print tokens or full credential-bearing registry URLs in logs. For local-image scanning, run on a trusted runner because Docker socket access grants broad control of the host daemon.
Use the GitHub Actions, GitLab CI, and callback guide for provider-specific patterns.