Integrate the scanner into CI with a gated report adapter #30

Goal

Integrate the scanner into CI only after the scanner and measured fixtures exist, through an approved report adapter with no auto-approval, secret read, environment fetch, or code execution.

Observations

• CI integration requires B06-02's built scanner and measured fixtures; it cannot run before them.
• B01-02 provides the regression-gate pattern this integration should reuse.
• The scanner must not approve changes, read secrets, or fetch the environment.

Decision gate

Approve the CI integration and report adapter contract before enabling the job.

Acceptance criteria

• CI runs the scanner read-only with the measured fixtures from B06-02.
• The adapter never auto-approves, reads secrets, fetches the environment, or executes scanned code.
• Findings are reported with paths and confidence.

Verification

• CI job on the clean tree -> exit 0, no findings.
• CI job with a malicious fixture -> non-zero exit and a redacted finding.

Release checkpoint

Remaining risk: CI verifies fixtures, not live third-party code. No approval authority is granted.

Tracking

Roadmap item: B06-03. All acceptance criteria remain pending; publication does not grant approval or release authority.

Dependencies

• Depends on Verify regression fixtures for the secret and workflow-lint gates #14 (B01-02).
• Depends on Add benign and malicious corpus with false-positive and redaction policy #29 (B06-02).