From 50a41f46d8b0379d5ddff65737a61525ae73bf04 Mon Sep 17 00:00:00 2001
From: claude <noreply@anthropic.com>
Date: Sun, 19 Jul 2026 07:17:01 +0000
Subject: [PATCH] docs: fix stale Permissions-Policy scoring row and add CI
 Integration section

Combines #90 (Permissions-Policy row was still describing the old
presence-only check; CSP row was already fixed by other merges) and #60
(GitHub Actions integration examples, updated to also mention --fail-on).
---
 README.md | 47 ++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 46 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index acacede..6084370 100644
--- a/README.md
+++ b/README.md
@@ -133,7 +133,7 @@ interface HeaderFinding {
 | X-Frame-Options | 15 | DENY or SAMEORIGIN (or CSP frame-ancestors) |
 | X-Content-Type-Options | 10 | nosniff |
 | Referrer-Policy | 10 | strict values only |
-| Permissions-Policy | 10 | presence |
+| Permissions-Policy | 10 | camera, microphone, and geolocation restricted |
 | Cross-Origin Policies | 5 | COEP, COOP, CORP |
 
 ---
@@ -146,6 +146,51 @@ For legitimate local/staging use, pass `{ allowPrivateNetworks: true }` (library
 
 ---
 
+## CI Integration
+
+### GitHub Actions
+
+Gate deployments on security header grades by adding this job to your workflow:
+
+```yaml
+name: Security Headers
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  security-headers:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check security headers
+        run: npx @hailbytes/security-headers https://staging.example.com
+```
+
+The CLI exits `1` when the grade is **D or F** by default (use `--fail-on` to set a stricter threshold), causing the step to fail. Replace the URL with your staging or production endpoint.
+
+To run as a non-blocking audit (always passes, useful for reporting):
+
+```yaml
+      - name: Audit security headers (informational)
+        run: npx @hailbytes/security-headers https://example.com || true
+```
+
+To capture the JSON report as a workflow artifact:
+
+```yaml
+      - name: Export security headers report
+        run: npx @hailbytes/security-headers https://example.com --json > security-headers-report.json || true
+      - uses: actions/upload-artifact@v4
+        with:
+          name: security-headers-report
+          path: security-headers-report.json
+```
+
+---
+
 ## Who Is This For
 
 Security engineers, DevSecOps teams, and ASM platform integrations that need automated header auditing on every deployment, pentesters who run this against every target scope, and developers who want to verify their app's security posture without leaving the terminal.