How to Gate Your CI Pipeline on Quantum Vulnerability - with quantum-audit

Part 3 of the quantum-audit series. Part 1 | Part 2

🌐 Tool: quantum-audit-site.vercel.app

Most security tools tell you there's a problem. Then you close the tab and forget about it. The only way to actually fix that is to make the problem block your deployment. quantum-audit exits with a non-zero code when it finds critical quantum-vulnerable cryptography. That means you can drop it into any CI pipeline and have it fail the build automatically. Here's how.

The exit code behaviour

npx quantum-audit .
echo $?  # 0 = no critical findings, 1 = critical findings found

• Exit 0 - no critical findings (safe to deploy)
• Exit 1 - critical findings detected (block the build)

Medium findings (SHA-256, AES-128) don't fail the build - they appear in the output as warnings but don't block deployment. Only CRITICAL findings (RSA, ECDSA, secp256k1) cause a non-zero exit.

GitHub Actions

Add this to your .github/workflows/ci.yml:

name: CI
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
jobs:
  quantum-audit:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
      - name: Run quantum-audit
        run: npx quantum-audit .

If your project uses ethers, web3, elliptic, or any other ECDSA/RSA library - the step will fail and your PR cannot be merged until the finding is addressed.

JSON output for custom reporting

Need to parse the results programmatically? Use the --json flag:

npx quantum-audit . --json

Output:

{
  "project": "my-dapp",
  "score": 60,
  "grade": "C - Moderate Exposure",
  "findings": [
    {
      "algorithm": "ECDSA (secp256k1) signing",
      "risk": "critical",
      "weight": 40,
      "file": "package.json",
      "line": null,
      "source": "ethers"
    },
    {
      "algorithm": "SHA-256 (crypto.createHash)",
      "risk": "medium",
      "weight": 8,
      "file": "src/utils/hash.js",
      "line": 14
    }
  ]
}

You can pipe this into a Slack notification, a dashboard, or a custom reporting step.

Slack notification on failure

Here's a GitHub Actions step that posts to Slack when critical findings are detected:

- name: Run quantum-audit
  id: audit
  run: npx quantum-audit . --json > audit-result.json || true
- name: Check for critical findings
  run: |
    SCORE=$(cat audit-result.json | python3 -c "import sys,json; print(json.load(sys.stdin)['score'])")
    echo "Quantum readiness score: $SCORE"
    if [ "$SCORE" -lt 70 ]; then
      echo "CRITICAL: Quantum exposure score below threshold"
      exit 1
    fi

Soft mode - warn without blocking

If you're not ready to hard-fail on critical findings yet, use this pattern:

- name: Run quantum-audit (warn only)
  run: npx quantum-audit . || echo "⚠️ Quantum vulnerabilities detected - review before next release"
  continue-on-error: true

This surfaces the findings in your CI logs without blocking the build. Good for teams that need a transition period before enforcing the gate.

What to do when the build fails

If quantum-audit fails your build, you have three options:

Option 1 - Accept the risk temporarily

Use continue-on-error: true in your CI step to warn without blocking while you plan a migration.

Option 2 - Migrate to a post-quantum library

NIST standardized the replacements in 2024:

• CRYSTALS-Dilithium - drop-in for ECDSA signatures
• CRYSTALS-Kyber - for key encapsulation
• SPHINCS+ - hash-based signatures (most conservative choice)

Option 3 - Scope the scan

If the vulnerable dependency is isolated to a specific non-critical part of your codebase, you can scope the scan:

npx quantum-audit ./src/critical-path

Only scan the directories that matter most.

Full workflow example

Here's a complete GitHub Actions workflow with quantum-audit integrated alongside your existing checks:

name: Security checks
on: [push, pull_request]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - name: Install dependencies
        run: npm install
      - name: npm audit (classical vulnerabilities)
        run: npm audit --audit-level=high
      - name: quantum-audit (quantum vulnerabilities)
        run: npx quantum-audit .
      - name: quantum-audit JSON report
        if: always()
        run: npx quantum-audit . --json > quantum-report.json
      - name: Upload quantum report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: quantum-audit-report
          path: quantum-report.json

This runs both npm audit (for classical CVEs) and quantum-audit (for quantum exposure) side by side, and uploads the full JSON report as a build artifact for review.

Install

npm install -g quantum-audit
# or
npx quantum-audit .

• GitHub: takundanashebmuchena-pixel/quantum-audit
• npm: npmjs.com/package/quantum-audit

Are you running quantum-audit in CI? Drop your setup in the comments - I'd love to see how others are integrating it.