Guardrail Ledger documentation

The gate and exceptions

The gate decides whether a pull request passes. An exception keeps an accepted finding from failing it, until the exception expires.

Set the gate

An owner or admin opens the Gates page and sets:

• The lowest severity that fails a pull request: critical, high, medium or low. New workspaces start at high.
• The engines that count toward the gate. Every scanner still runs and every finding is recorded. Findings from an engine that is not on the list do not fail the gate.
• The contributor cap, counted as unique build requesters over 30 days. The gate adds one failing item when more people than the cap have run builds.

Choose Save. Changing the gate is written to the audit log.

Read the result

Each run answers with the gate result. When the gate blocks, the ingest call answers with status 409 and the step or job fails, unless you set failOnGate: false on the task or fail-on-gate: false on the Action. The result is also written to the pull request comment and, on GitHub, the job summary. Findings stay under Findings with the repository and the pull request they were found in.

A scan resolves only the findings of the engines that reported in it. A finding that no longer appears is marked resolved.

Record an exception

1. An owner or admin opens the Exceptions page.
2. Pick an open finding, or paste its fingerprint.
3. Pick the owner, a workspace member who is someone other than you. You are recorded as the approver.
4. Write the reason and set the expiry, at most 90 days from today.
5. Choose Record exception. It applies at once.

An excepted finding does not fail the gate. After the expiry date the next scan counts it against the gate again. The console has no button to revoke an exception.