GitLab CI

Use a masked JUSTSCAN_TOKEN variable and configure the CLI profile with your public JustScan URL and organization ID. Run the CLI after building the image and before publishing or deploying it. Protect the variable so untrusted branches cannot read a production organization token.

justscan_scan:
  stage: test
  script:
    - justscan scan registry.example.com/my-app:$CI_COMMIT_SHA

For archive-based workflows and the complete request/response model, see CI/CD integration. Confirm that a nonzero exit code fails the job; do not use an unconditional allow_failure once JustScan is the release gate.

To discover and schedule scans for image and service declarations in GitLab CI, connect the repository and choose GitLab CI configuration as its discovery method. Paths are optional: leave them empty for the conventional root .gitlab-ci.yml or .gitlab-ci.yaml, or provide relative files, directories, or patterns for repositories with CI configuration elsewhere. This schema-aware mode follows local includes and skips references that still contain runtime variables. See Git repository discovery.

If the goal is to find concrete references throughout the repository without maintaining CI paths, choose Registry image references instead. It searches automatically under a selected configured registry or a custom host/path; see Registry image-reference discovery.