CI/CD Gate

No GitHub App, no separate plugin — any CI that can run curl and jq can gate a merge on Notra findings. A scan takes minutes, longer than most CI platforms let a single HTTP call block, so the pattern is: start the audit, poll a cheap status check, exit non-zero if a finding at or above your threshold shipped.

The gate endpoint

curl "https://your-notra-domain/api/v1/scans/RUN_ID/gate?failOn=high" \
  -H "Authorization: Bearer notra_live_..."

# still running:
{"ready": false, "status": "running"}

# done:
{"ready": true, "passed": false, "status": "done", "failOn": "high", "severityCounts": {"critical": 1}}

failOn is one of critical | high | medium | low | info (default high) — passed is false if anything at or above that severity is present. This is a cheap, synchronous read of the scan's already-stored severity counts, not a blocking wait.

The gate script

A small, readable bash script that does the start → poll → exit-code sequence for you. Vendor it into your repo rather than pulling it at CI time:

curl -O https://your-notra-domain/notra-gate.sh && chmod +x notra-gate.sh

Reads NOTRA_API_KEY, NOTRA_TARGET, and optionally NOTRA_DEPTH / NOTRA_FAIL_ON / NOTRA_MAX_WAIT_SEC from the environment. Exits 0 on pass, 1 on a failed gate, 2 if the audit couldn't start or timed out.

GitHub Actions example

- name: Notra security gate
  env:
    NOTRA_API_KEY: ${{ secrets.NOTRA_API_KEY }}
    NOTRA_TARGET: staging.example.com
    NOTRA_FAIL_ON: high
  run: |
    curl -O https://your-notra-domain/notra-gate.sh
    chmod +x notra-gate.sh
    ./notra-gate.sh

Uses the workflow's own built-in GITHUB_TOKEN if you want the step to also comment on the PR — no Notra-specific GitHub App or webhook required. The same script and endpoint work in GitLab CI, Jenkins, or a plain cron job — nothing here is GitHub-specific except the example above.