Build with Covenant Engine

curl -X POST https://api.covenantengine.com/v1/scan \
  -H "Authorization: Bearer $COVENANT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "file_uri": "s3://acme-corp/q3-report.pdf",
    "vertical": "VENTURE_CAPITAL",
    "enforce": true
  }'

{
  "id": "scan_8a3d9b1",
  "status": "completed",
  "risk_score": 87,
  "action": "WATERMARK_AND_ALERT",
  "enforcement_id": "enf_92c4bf3"
}

# .github/workflows/covenant-scan.yml
name: Covenant IP Scan
on:
  pull_request:
    branches: [main]

jobs:
  covenant-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Install covenantctl
        run: pip install covenantctl
      
      - name: Authenticate
        run: covenantctl auth login --token ${{ secrets.COVENANT_TOKEN }}
      
      - name: Scan repository for IP leaks
        run: |
          covenantctl scan dir . \
            --exclude '.git,node_modules,*.test.js' \
            --vertical VENTURE_CAPITAL \
            --output json > covenant-results.json
      
      - name: Fail on high risk
        run: covenantctl report --fail-on HIGH --input covenant-results.json
      
      - name: Upload results
        uses: actions/upload-artifact@v4
        with:
          name: covenant-scan-results
          path: covenant-results.json