GitHub Actions

Create .github/workflows/compliance.yml. The scan runs on every pull request and uploads SARIF to Code Scanning.

name: Compliance
on: [pull_request]
permissions:
  contents: read
  security-events: write   # required to upload SARIF
jobs:
  scrutora-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - id: scan
        uses: Scrutora/scrutora-scan@v1
        with:
          frameworks: dpdpa,hipaa
          fail-on: high        # none|low|medium|high|critical
      - if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.scan.outputs.sarif-file }}

The scan runs automatically. Findings show in Security → Code scanning with the file, line, severity and the compliance obligation each maps to. With fail-on set, the check blocks the merge on findings at or above that severity.