.skilltrust.yml

An optional file at the root of your repository that decides when the SkillTrust check run fails. Without it, every repository gets the defaults below.

The whole file #

Put it at the repository root. It is read on every pull-request scan from the head commit, so a change to the file takes effect in the same pull request that changes it.

Exception: a re-scan of a commit we already scanned, whether from the Re-scan button or a duplicate webhook delivery, reuses the cached result and does not re-read the file. It is evaluated against the defaults instead.

version: 1
threshold:
  min_grade: C
  fail_on_severity: high
  per_axis:
    security: B
    permission_hygiene: C

version #

Always 1. It exists so a future format change can be introduced without breaking files written today.

threshold.min_grade #

The lowest axis grade you accept. If any axis grades below it, the check run fails. Defaults to C.

An axis grade is always one plain letter (A, B, C, D or F); the engine never emits a +/- suffix on a result. min_grade compares by rank, worst to best: min_grade: C accepts a C grade and anything better (B or A), and rejects D and F.

You may write a +/- suffix in min_grade itself for a threshold finer than a full letter. min_grade: C+ requires better than a plain C, so only B or A pass, while min_grade: C- lets a C through along with everything better.

threshold.fail_on_severity #

The lowest severity that fails the build when it appears as a new finding in the pull request. One of critical, high, medium, low. Defaults to high.

Only new findings count. A finding that already existed on the base branch does not fail the pull request that did not introduce it.

threshold.per_axis #

Per-axis overrides of min_grade, keyed by axis name. An axis listed here ignores min_grade entirely and is measured against its own value.

  • security
  • permission_hygiene
  • transparency
  • quality

What never fails your build #

A scan we declined to run always reports the check run as neutral, never as a failure. A decision of ours about whether to run is not a statement about your repository, so it must not break your pipeline.

A scan that cannot complete for a technical reason on our side, a fetch or extraction failure for instance, does not fail the check run either. It is retried automatically; if every retry fails, the check simply does not resolve, rather than reporting a failing grade.

An invalid file #

If the YAML does not parse, the scan does not silently fall back to the defaults: the check run reports action_required and the comment explains that the file is invalid. A policy file you think is in force but is not would be worse than no file.