deidproof as a CI gate: how are you wiring it into your release pipeline?

[cognis-digital]

deidproof is built to run in CI: deidproof check export.csv --qi ... --sensitive ... -k 5 -l 2 exits 0 on pass, 2 on a privacy failure, and 1 on misuse, and it can emit SARIF 2.1.0 for GitHub code scanning.

How are people wiring it into their release pipeline?

• A dedicated GitHub Actions step that fails the job on exit 2?
• A pre-commit / pre-merge hook on the data-release repo?
• Uploading the SARIF to code scanning so findings surface inline on the PR?

One sharp edge worth flagging for CI users: if you pass -k but forget --quasi-identifiers, older builds computed no k at all and the check silently passed. The current code treats that as a usage error (exit 1) so a typo can never turn into a false "de-identified" green check. If you script deidproof, prefer being explicit about both --qi and --sensitive, and gate your job on the exit code, not on grepping the text output.

What does your gate look like? Share your workflow YAML.