Code scan CI

GitHub Action#

- uses: qtangl/qtangl-scan@v1
  with:
    api-key: ${{ secrets.QTANGL_API_KEY }}
    mode: code
    github-owner: ${{ github.repository_owner }}
    github-repo: ${{ github.event.repository.name }}
    sarif-output: qtangl-results.sarif
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: qtangl-results.sarif

Async API#

curl -X POST https://api.qtangl.com/tenant/coverage/code-scan \
  -H "Authorization: Bearer $QTANGL_API_KEY" \
  -d '{"githubOwner":"org","githubRepo":"app","async":true}'

# Poll job status
GET /tenant/discovery/jobs/{jobId}

Binary / container scan#

POST /tenant/discovery/binary-scan
{"imageRef": "registry.example.com/app:1.2.3", "integrationId": "int_ecr_prod"}

Policy gates#

• fail-on-new-quantum-vulnerable: true — block merge on new findings
• SARIF upload to GitHub Advanced Security when scan completes
• GitHub App install for webhook-driven scans on push/PR

Feature flags#

Requires discovery.codeScan and/or discovery.binaryScan on the tenant (default off).

Related#

CI/CD integration · Code scan API · Host sensor deploy