Tutorial 3 of 6
Release gate and policy — decide whether a build can ship
Intermediate 8 min
Configure the policy rules (severity threshold, KEV, licences, root containers, end-of-life bases, provenance, Scorecard, web grade, OAuth risk, overdue) and read the pass, warn or fail verdict.
The release gate turns findings and asset facts into one verdict: pass, passes with warnings or fail. It appears on the dashboard, in the report and in the Policy tab.
1. Rules and levels
Open Policy. Every rule has a Level — Fail the gate, Warn or Off — and some have a Threshold:
| Rule | Default | Threshold |
|---|---|---|
| Open vulnerabilities at or above the severity threshold | Fail | High or worse |
| Known exploited vulnerabilities (CISA KEV) | Fail | — |
| Licence conflicts with the project licence | Fail | — |
| Unknown or missing licences | Warn | — |
| Container images that run as root | Warn | — |
| Base images past end of life | Fail | — |
| npm packages without verified build provenance | Warn | — |
| Repositories below the minimum OpenSSF Scorecard | Warn | 5 / 10 |
| Domains below the minimum configuration grade | Warn | Grade C |
| OAuth integrations at or above the risk threshold | Fail | Critical |
| Findings past their due date | Warn | — |
The Result column says how many items break a rule; open it to see which assets and findings.
2. What never counts
Findings you marked Risk accepted or False positive never fail or warn. That is how you record a decision instead of switching a rule off for everyone.
3. Licences depend on your product
The licence rules use the SBOM License Checker verdicts against your project licence. Set it under File → Project settings… → Project licence for licence checks (for example Proprietary, distributed or Proprietary, network service only (SaaS)). An SBOM asset can override it — a quick scenario: switch one SBOM to GPL-3.0-or-later, run its licence check again and compare the verdicts.
Licence verdicts are not legal advice; use the conflicts and reviews as the list to check with counsel.
4. Deadlines
Remediation deadlines (SLA) set the days to fix per severity. Changing them moves every due date that you did not set by hand — and the overdue rule follows.
5. Per-asset verdicts
The coloured dot in the asset list shows each asset's verdict: green pass, amber warning, red fail, outlined = not checked yet. The report lists them in the Assets table, so a reviewer can see which component blocks a release.
Ready to try it?