The action downloads a pinned, checksum-verified release binary, then runs scan push followed by status — it fails the job when anything is overdue.

name: craclock
on: [push]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: craclock/craclock/action@v1
        with:
          api-key: ${{ secrets.CRACLOCK_API_KEY }}