The CI gate

Run the scan on every build, not just the release candidate. A minimal GitHub Actions job looks like this; Fastlane, GitLab CI, Xcode Cloud, Bitrise and Jenkins follow the same shape.

- name: AppCompliance gate
  run: appcompliance scan ./build/App.ipa
  # exit code 1 or 2 fails the job, so a bad or
  # unverified build never reaches the store

Because the verdict is the exit code, you do not need any extra parsing: a non-zero exit fails the job, and the fail-closed 2 means an incomplete scan stops the pipeline instead of slipping through.

Next: have each finished scan notify your own tooling with Webhooks.