Quality gates and Jail
The two organization policies that fail a pipeline, the Quality Gate for one scan's findings and Jail for a repository's accumulated state, and how they differ.
Vulnetix has two organization policies that decide whether CI goes red. They answer different questions and are configured separately.
| Quality Gate | Jail | |
|---|---|---|
| Question | Should this scan’s findings break this build? | Is this repository, across every tool that has reported for it, in breach of policy? |
| Evaluated | In the CLI, against one run’s findings | On the server, against the latest result per tool per category |
| Configured as | Nine settings plus four EOL severities, one row per organization | An ordered list of rules, an org default plus optional per-repository overrides |
| Runs in | vulnetix scan, sca, sast, secrets, containers, iac |
vulnetix jail, or --jail on the scan commands |
| Exit codes | 0 pass, 1 a gate breached |
0 clear, 1 jailed, 2 usage error, 3 indeterminate |
| Resolve Platform | www.vulnetix.com/resolve/quality-gate | www.vulnetix.com/resolve/jail |
| CLI | vulnetix config set quality-gate, config set eol-policy |
vulnetix jail, jail exempt |
Both belong to the organization (the tenant), so every member of a Teams organization is held to the same policy.
Quality Gate
The Quality Gate is the org-wide version of the scan’s gate flags (--severity, --exploits, --block-malware, --block-eol, --block-unpinned, --cooldown, --version-lag, and the SCA autofix limits). A setting the organization has set overrides the flag on every authenticated scan, even a flag passed on the command line. A setting left unset leaves the flag in charge.
- Settings: every field, its values and its flag.
- EOL policy: how end-of-life dates are graded into severities.
- Enforcement in CI: the override rule, verbose output and pipeline examples.
Jail
A repository is jailed when it breaches a policy rule over its accumulated state: vulnerabilities past their remediation window, dependencies past end of life, migrations that missed their deadline, hygiene categories that regressed.
- How Jail works: latest-state evaluation, staleness and verdicts.
- Rules: kinds, selectors, aggregates, operators, goals and ratchets.
- Exemptions: time-boxed waivers that never hide the evidence.
- Jail in CI: the standalone gate,
--jail, artefacts and adoption.
The Package Firewall is a third enforcement point, at install time rather than scan time; see Package Firewall.
GitHub Actions
Run the Jail gate in a workflow with the jail GitHub Action.
Platform IaC
The organization’s quality gate is the QualityGate kind, with every field mapped to its scan flag on that page. vulnetix config apply sets it, or vulnetix config set quality-gate and config set eol-policy. Jail policy is JailPolicy (the ordered rules, for the tenant default or one repository) and JailExemption (a time-boxed waiver). A jail rule can take a when; see where it is evaluated. The licence files are LicensePolicy and LicenseExceptions. See the kind catalogue.
When Drift protection is on, a change made in the console or through a legacy API to the quality gate, jail policy or jail exemptions that is managed as code (by Terraform or a repository) is refused with HTTP 409 managed_by_platform_iac. Change it where it is declared, or ask an admin to turn Drift protection off.