Repository labels, owner and criticality

A repository is an asset of the business, and the same finding matters more in some repositories than others. The asset record of a repository says how your organisation sees it:

• Labels: key/value pairs such as tier: prod, data: pii or pci: in-scope. At most 50.
• Owner: a team, a user or an email address.
• Criticality: low, medium, high or critical. A repository with none is unclassified.

Rules read these as the labels, owner and criticality variables of the CEL finding context, so a rule can rank, suppress or jail by where a finding is. The criticality is also the mission and well-being input of SSVC decisions.

Set them

Open a repository (Repositories, then the repository) and use the Asset panel on the Overview tab. Owners and admins can save; every member can read. The Repositories list shows a repository’s criticality beside its scan coverage.

The same record is part of the RepositorySettings document, so it can be kept in Git or Terraform:

apiVersion: vulnetix.com/v1
kind: RepositorySettings
metadata:
  name: acme-payments-api
spec:
  repository: acme/payments-api
  autonomy: suggest
  labels:
    tier: prod
    pci: in-scope
  owner:
    kind: team
    name: payments
  criticality: critical

Download as code on the Asset panel produces this document for a repository the Software Factory manages. A RepositorySettings document owns the asset fields of its repository: leaving one out clears it, and deleting the document clears the record. A repository that has an asset record but no factory settings is managed on the Repositories page, not as a document.

The record is kept apart from the factory’s autonomy settings on purpose. A repository with no factory settings runs at your organisation’s default autonomy, and classifying a repository does not change that.

Label and owner rules

Field	Rule
Label key	Lower case letters, digits and . _ / -, at most 63 characters, starting and ending with a letter or digit.
Label value	At most 256 characters.
Owner kind	team, user or email.
Owner name	At most 320 characters. An email owner must be a bare address and is stored in lower case.

Use them in rules

criticality in ['high', 'critical'] && kev
labels['tier'] == 'prod' && severity in ['critical', 'high']
owner == 'payments' && !reachable

All three are empty for a repository with no record, so criticality in ['high', 'critical'] is false for an unclassified repository, and 'tier' in labels is false for one with no labels.

Rule	Where the asset is read
Risk strategy when	By the repository of each finding. The ranking is cached for 60 seconds, so a change shows within a minute.
Suppression when	The same lookup, when a rule is matched against findings.
Jail policy when	For the repository being assessed, on every kind of fact.
Release jail in the factory gate	For the repository of the run.
SSVC decision	The repository of the finding: the criticality is the mission and well-being input, and a policy expression reads all three. This includes the decision the CLI scan and the remediation plan report under your SsvcPolicy. A scan uses the repository it runs in and the plan takes ?repo=owner/name.

The CLI does not evaluate CEL rules itself; its gate, jail and SSVC results come from the same server rules.

Before the database migration

The asset record needs the database migration 20261228000000_repository_asset. Until it is applied, repositories read as unclassified, every asset variable is empty, and saving an asset record, or applying a RepositorySettings document that sets an asset field, is refused with the migration’s name. A document that sets none applies as before.