Gate
CI check
Same rule as the local CLI: unregistered or expired findings fail. Covered findings pass. Closed pins do not cover anything.
Empty ledger
No scan to gate
Run a scan first. The check script compares a scan JSON file against pins.json and exits non-zero on unregistered or expired findings.
Go to ScanCLI and Action
Commit a pins.json next to the repo. Scan writes findings. Check compares the two and fails the job when something is unregistered or past its expiry.
node scripts/scan.mjs --dir . --out shorepin-scan.json node scripts/check.mjs --pins pins.json --scan shorepin-scan.json
Workflow file: .github/workflows/shorepin.yml