In CI

Post-quantum support can regress: a load balancer swap, a base-image downgrade, a hand-edited curve list. A scheduled check in CI catches it.

GitHub Actions

The pqdoctor GitHub Action does it in one step, with a job summary and a pull-request comment. It isn’t published yet. Until it is, any CI can run the CLI directly.

Any CI: exit codes

For one host, pqdoctor’s exit status is the verdict:

Exit	Verdict
0	Post-quantum
1	Not post-quantum, TLS 1.2 only, or broken
2	Unreachable or an error

Shell

#!/bin/sh
# Fail if any host isn't post-quantum. Unreachable hosts only warn.
status=0
for host in example.com api.example.com:8443; do
  pqdoctor "$host" --no-auth
  code=$?
  if [ "$code" -eq 1 ]; then status=1; fi
  if [ "$code" -eq 2 ]; then echo "warning: $host unreachable"; fi
done
exit $status

PowerShell

# Fail if any host isn't post-quantum. Unreachable hosts only warn.
$failed = $false
foreach ($h in 'example.com', 'api.example.com:8443') {
  pqdoctor $h --no-auth
  switch ($LASTEXITCODE) {
    1 { $failed = $true }
    2 { Write-Warning "$h unreachable" }
  }
}
if ($failed) { exit 1 }

GitLab CI

post-quantum:
  image: rust:1
  script:
    - cargo install pqdoctor
    - pqdoctor example.com --no-auth
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"

--no-auth skips the certificate check, which a key-exchange gate doesn’t need. Leave it on if you also want the ML-DSA result in the log.

Many hosts: read the JSON

scan exits 0 whenever it finishes, so check its records instead:

pqdoctor scan hosts.txt --json --quiet > results.jsonl
# fail if any host answered but isn't post-quantum
! grep -E '"verdict":"(notPq|noTls13|broken)"' results.jsonl

More recipes, including PowerShell, are in Scripting with JSON.

Check from the right place

An origin behind Cloudflare often only accepts Cloudflare’s IPs, so a CI runner on the internet gets unreachable. Run the check from somewhere that can reach the origin, such as a runner in the same network, or check the public name instead.

Building pqdoctor in CI

Until there’s a published Linux binary, install it from crates.io. It’s pure Rust with no system packages:

cargo install pqdoctor

Cache ~/.cargo between runs to make it fast.