Release Gate
Run the policy gate over a canonical report. It returns PASS, PASS_WITH_KNOWN_RISK, BLOCKED, or INCOMPLETE, and fails closed on missing or malformed evidence.
The instruction
The release gate is the only part of the workflow that produces a go or no-go answer. It reads a canonical report and applies a policy; it does not re-open the investigation.
Run the SecHelix release gate.
Return PASS, PASS_WITH_KNOWN_RISK, BLOCKED, or INCOMPLETE.
Fail closed for missing required evidence. Never convert UNKNOWN/BLOCKED to NOT_APPLICABLE.
List verified Critical/High blockers, unresolved authorization/tenant isolation tests, secrets,
reachable critical dependencies, auth/session failures, SSRF/upload/webhook/business-logic risks,
regression status, and accepted risks.Running the gate
Generate the canonical report in an authorized job, then run the policy gate in a separate fail-closed step. Two commands, two responsibilities.
python -m reports.report_renderer report.canonical.json --format json --output report.json
python scripts/security_gate.py report.json --policy policies/default.json --json-outputOutcomes and exit codes
| Outcome | Meaning | Exit code |
|---|---|---|
| PASS | No unresolved release-blocking verified findings. | 0 |
| PASS_WITH_KNOWN_RISK | Explicit accepted non-blocking risk, with owner, reason, approval, and expiry. | 0 |
| BLOCKED | Unresolved Critical or High finding, or an integrity-critical unknown under a strict policy. | 1 |
| INCOMPLETE | Required evidence unavailable, malformed input, or missing policy. Never implies certification. | 2 |
CI must treat both 1 and 2 as non-green. An INCOMPLETE that is allowed to pass silently is the failure mode the fail-closed design exists to prevent.
Policy controls
policies/default.json blocks unresolved verified Critical and High findings, requires independent verification and regression proof for those severities, and returns INCOMPLETE for integrity-critical unknowns. policies/strict.json additionally blocks Medium findings and turns integrity-critical unknowns into BLOCKED.
- Blocking severities.
- Severities that require independent verification.
- Severities that require regression proof.
- Whether accepted risk is allowed, and which approval fields it must carry.
- The outcome for integrity-critical unknowns.
- Required evidence tools.
- Forbidden deployment states.
- Severity overrides.
The default policy sets allow_accepted_risk to false and requires reason, approver, approved_at, expires_at when a policy does allow it.
Required gate tests
The CI guidance lists six behaviours a gate integration should verify before it is trusted.
- Unresolved verified Critical or High produces BLOCKED.
- A fixed Critical or High with complete independent verification produces PASS if the run is otherwise clear.
- A valid policy-approved accepted risk produces PASS_WITH_KNOWN_RISK.
- An integrity-critical unknown produces INCOMPLETE, or BLOCKED under a policy that selects it.
- A missing required tool produces INCOMPLETE.
- An empty or malformed report produces INCOMPLETE, never PASS.