CI/CD Gatekeeper

1. Add the Action — Drop the BinShield step into your GitHub Actions workflow. It runs after npm install and before your test suite.
2. Set your policy — Configure a risk threshold (e.g., block PRs with any binary scoring above 60). Customize which behavior families trigger failures.
3. Review and merge — BinShield posts a PR comment with a summary of every native binary, its risk score, and detected behaviors. Safe PRs pass automatically.

# .github/workflows/binshield.yml
name: BinShield Binary Scan

on:
  pull_request:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - run: npm ci

      - name: BinShield Scan
        uses: ashlrai/binshield-action@v1
        with:
          api-key: ${{ secrets.BINSHIELD_API_KEY }}
          risk-threshold: 60
          fail-on-high: true
          comment-on-pr: true