CI/CD Integration

qtz-discovery-cli is designed for headless CI/CD execution. Use --fail-on to gate deployments, --format sarif to surface findings in code review, and --baseline to detect only new issues on each commit.

GitHub Actions

Basic — fail on critical findings

name: Cryptographic Security Scan

on:
  push:
    branches: [main, develop]
  pull_request:

jobs:
  crypto-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install qtz-discovery-cli
        run: |
          curl -Lo qtz-discovery-cli https://quantizant.io/downloads/releases/qtz-discovery-cli-linux-amd64
          chmod +x qtz-discovery-cli
          sudo mv qtz-discovery-cli /usr/local/bin/

      - name: Scan cryptographic assets
        run: |
          qtz-discovery-cli scan source . \
            --fail-on critical \
            --format sarif \
            --output results.sarif

      - name: Upload SARIF to GitHub Security
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif
          category: quantizant-crypto-scan

Advanced — CBOM artifact + baseline diff

name: Cryptographic Inventory

on:
  push:
    branches: [main]

jobs:
  crypto-inventory:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install qtz-discovery-cli
        run: |
          curl -Lo qtz-discovery-cli https://quantizant.io/downloads/releases/qtz-discovery-cli-linux-amd64
          chmod +x qtz-discovery-cli
          sudo mv qtz-discovery-cli /usr/local/bin/

      - name: Restore baseline
        uses: actions/cache@v4
        with:
          path: .qtz-baseline.json
          key: qtz-baseline-${{ github.ref_name }}

      - name: Scan with baseline diff
        run: |
          qtz-discovery-cli scan source . \
            --format cbom \
            --output cbom.json \
            --baseline .qtz-baseline.json \
            --update-baseline \
            --show-score
        env:
          QTZ_SERVER_API_KEY: ${{ secrets.QTZ_SERVER_API_KEY }}

      - name: Upload CBOM artifact
        uses: actions/upload-artifact@v4
        with:
          name: cbom-${{ github.sha }}
          path: cbom.json
          retention-days: 90

Source + network matrix

jobs:
  crypto-scan:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        include:
          - scan: source
            args: "scan source ."
          - scan: network
            args: "scan network api.example.com:443"
    steps:
      - uses: actions/checkout@v4

      - name: Install qtz-discovery-cli
        run: |
          curl -Lo qtz-discovery-cli https://quantizant.io/downloads/releases/qtz-discovery-cli-linux-amd64
          chmod +x qtz-discovery-cli
          sudo mv qtz-discovery-cli /usr/local/bin/

      - name: Run ${{ matrix.scan }} scan
        run: |
          qtz-discovery-cli ${{ matrix.args }} \
            --format sarif \
            --output ${{ matrix.scan }}-results.sarif \
            --fail-on high

      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ matrix.scan }}-results.sarif
          category: qtz-${{ matrix.scan }}

GitLab CI

crypto-scan:
  image: ubuntu:22.04
  stage: test
  before_script:
    - apt-get update -qq && apt-get install -y curl
    - curl -Lo qtz-discovery-cli https://quantizant.io/downloads/releases/qtz-discovery-cli-linux-amd64
    - chmod +x qtz-discovery-cli && mv qtz-discovery-cli /usr/local/bin/
  script:
    - qtz-discovery-cli scan source .
        --fail-on critical
        --format sarif
        --output gl-sast-report.json
  artifacts:
    reports:
      sast: gl-sast-report.json
    paths:
      - gl-sast-report.json
    when: always
    expire_in: 30 days
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

Exit Codes

Environment Variables

Use these in CI secrets to avoid hardcoding credentials: