Repository policies
Set scan-result rules for severity and coverage, then interpret the actual verdict without assuming enforcement elsewhere.
Decide what needs reviewPermalink to Decide what needs review
Use a policy to apply a consistent decision threshold to a repository's scan results. It is useful when multiple reviewers need the same rule for confirmed findings, unrankable findings, and insufficient coverage. You need a connected repository in the selected workspace and permission to change policies.
Choose rules based on how the team will respond to a failed result. A saved policy does not prove that a scan was evaluated, and it does not by itself configure GitHub branch protection or block a deployment. Review any repository checks and release controls separately.
Understand the available rulesPermalink to Understand the available rules
| Setting | Effect |
|---|---|
| Fail on severity | Fail for a confirmed finding at or above the chosen level. High includes both High and Critical; Medium also includes Medium. |
| Never fail on severity alone | Disable the severity-threshold rule. Other selected rules can still fail the result. |
| Fail on findings that could not be ranked | Fail when a confirmed finding's severity could not be determined. Unknown is not treated as harmless. |
| Require the scan to have covered the code | Fail when coverage is not adequate, including results with zero findings. |
| Apply this policy | Enable the selected rules. Turn it off to retain the settings without applying them. |
Confirmation and coverage are separate
Create or update a policyPermalink to Create or update a policy
Open Policies
Find the repository and choose Add a policy or Edit policy. Review the values in the form rather than assuming every workspace uses the same defaults.
Choose the rules
Select a severity threshold, decide how unknown severity should be handled, and decide whether adequate coverage is required.
Apply and save
Select Apply this policy and choose Create policy or Save policy. An enabled policy with no rules does not provide a meaningful gate.
Inspect a scan result
Run or review a subsequent assessment and look for its policy verdict. Read every failure reason rather than inferring a verdict from the policy settings page.
For example, a policy with High as the threshold, unrankable findings enabled, and adequate coverage required can fail for a confirmed High or Critical issue, a confirmed issue of Unknown severity, or inadequate coverage. Each reason calls for a different response.
Read the actual verdictPermalink to Read the actual verdict
| Result | Interpretation and action |
|---|---|
| Policy passed | The recorded evaluation satisfied its rules. Still review the assessment scope and candidates; this is not a guarantee of security. |
| Policy failed | One or more rules were not satisfied. Read all reasons and inspect blocking findings where reported. |
| Policy not evaluated | The policy did not judge this result, for example because it was off or had no rules. This is not a pass. |
| No verdict displayed | No policy outcome is available on this result. Check the repository policy and scan context; do not infer a pass from absence. |
A coverage failure calls for a better-supported assessment, not necessarily a code edit. A severity failure calls for investigation and remediation or a justified triage decision. Triage can change which findings are counted without fixing code; do not change decisions merely to reduce the reported number.
Turn off or remove a policyPermalink to Turn off or remove a policy
Clear Apply this policy and save to keep the rules without applying them. Use Remove policy to delete the repository's policy configuration. A repository without a policy can still have scan findings; it simply has no configured policy to judge them. Changing settings does not prove that an earlier scan has been evaluated again.