GitLab CI

Use a masked JUSTSCAN_TOKEN variable and configure the CLI profile with your public JustScan URL and organization ID. Run the CLI after building the image and before publishing or deploying it. Protect the variable so untrusted branches cannot read a production organization token.

justscan_scan:
  stage: test
  script:
    - justscan scan registry.example.com/my-app:$CI_COMMIT_SHA

For archive-based workflows and the complete request/response model, see CI/CD integration. Confirm that a nonzero exit code fails the job; do not use an unconditional allow_failure once JustScan is the release gate.