Pro / Agency

Fail the build if Reject leaks

One staging URL in GitHub Actions. If Reject still lets advertising or analytics hosts fire, the job fails. This is a baseline gate — not a full consent-journey CI product, SARIF report, or CLI. Pair it with scheduled re-scans in the dashboard if you need drift after a deploy that CI never saw.

What you need

A ConsentSignals Pro or Agency plan
An API key from Dashboard → Drift alerts & CI gate (header X-ConsentSignals-Key)
A public staging URL you are authorised to scan — same rules as a dashboard scan
Poll budget of at least typically 5–12 minutes (workflow default is 300s; raise poll-seconds if scans queue)

GitHub Action (copy-paste)

Copy .github/workflows/trackless-compliance-gate.yml and .github/scripts/trackless-gate.sh from the ConsentSignals repo into yours, then call the reusable workflow. The GitHub secret name is still TRACKLESS_API_KEY (legacy env name). Store the key from the dashboard there.

jobs:
  consent-gate:
    uses: ./.github/workflows/trackless-compliance-gate.yml
    secrets:
      TRACKLESS_API_KEY: ${{ secrets.TRACKLESS_API_KEY }}
    with:
      api-url: https://api.consentsignals.com
      url: https://staging.example.com

Or the shell script:

export TRACKLESS_API_URL=https://api.consentsignals.com
export TRACKLESS_API_KEY=cs_...
export SCAN_URL=https://staging.example.com
bash .github/scripts/trackless-gate.sh

When the job fails

PRE_CONSENT_TRACKERS
Reject-persistent / pre-consent third-party domains above the allowed count (default: 0). This is the “Reject leaked” check.
UNDISCLOSED_AI_TOOLS
Undisclosed AI tooling detected in the scan (optional; on by default). Turn off with fail-on-ai-detected: false.
NEW_PRE_CONSENT_DRIFT
New reject-persistent domains vs a baseline scan_id. Pass baseline_scan_id on POST /api/compliance/gate when you want “don’t get worse than last week.”

Honest limits

One URL per job — not a multi-page journey, logged-in app, or mobile SDK.
Browser-visible traffic only. Server-side / CAPI beacons are out of scope.
A pass is “no blocking signals under this policy,” not a legal certification or DPO sign-off.
Headless Chromium typically sees one geo and one A/B variant — same as a dashboard scan.

Generate an API key →How scans work Pricing