Blocking a Bad Change

A CI check only sees changes that travel through CI. Anyone holding cloud credentials can create the instance from a console session or a local apply, and that route never reaches the check at all.

Merging is not deploying. The reconciler reads whatever sits on the tracked branch and applies it, without consulting the check that ran on the pull request. The check informs humans; it has no authority over the applier.

A required check must report a passing result before the pull request may merge. An advisory check only posts a result nobody consults. If a required check never reports, the merge stays blocked rather than allowed.

No. A missing report is not a clean result, it is an absent one. A gate needs three outcomes — pass, fail, and no usable evidence — and the third must never be folded silently into the first.

A required-metadata rule checks only that named fields exist in the catalog entry and hold a value from an allowed set. It proves the entry is well-formed and names an owner, not that the values are true.

The build job is the thing being gated, so a report it wrote about itself is a claim, not a check. Anything that skips, misconfigures or compromises the build can also produce a passing file.

Green means nothing failed, not that something ran. A skipped job, a path filter or a check nobody required all look successful. Without a record asserting an evaluation happened, passed and never invoked are indistinguishable.

A timeout means the rule produced no decision at all, not that the change is compliant. Recording it as a pass turns an overload into a silent approval, and that happens most often exactly when the system is busiest.

A severity threshold is the rule that collapses a scan report into pass or fail: block when a finding sits at or above a chosen severity, such as critical. It decides what stops a change, not what is genuinely risky.

Only the admission controller, and only for objects sent to the cluster API it fronts. A pull request check and a deploy job step both live inside a pipeline, so an engineer applying the change directly skips both.

Split acquiring the external data from deciding on it. One step fetches and pins the registry and discovery facts, the rule then evaluates that pinned document offline, and a failed fetch is reported as an error, never as a verdict.

Blocking on total findings fails every build until the entire backlog is clean. Blocking on new findings compares each report against a recorded baseline of what already existed and fails only on what the current change added.

That someone committed a file saying pass. A record the gated party can write, edit, regenerate or delete carries almost no weight about whether the gate ran, and a missing file cannot be told apart from a deleted one.

Make the override cheap to pull and expensive to hide. A ticket-priced bypass nobody can reach at 02:00 gets routed around; a one-click bypass that names the user, alerts others and covers one change keeps the event visible.

It surfaces on the reconciler: a failed sync condition and a degraded or unhealthy status carrying the rejection message, plus the agent logs. It never reaches the pull request, which closed green before the apply was attempted.

Most CI systems read the pipeline definition from the commit under review, so one change can disable, rename or narrow the very job that would have judged it — and can equally edit a policy file vendored beside the code the rule inspects.

Because a rule bound to one tool's schema must be rewritten for every other tool and breaks when that schema changes. A normaliser maps each report into one record shape, so policy is written once against stable fields.

The rule reads two inputs: licence class per component from the build's inventory, and the service's distribution context from its catalog entry. Applicability comes from the catalog, so one component passes internally and fails in a shipped binary.

A field read out of the evidence says whatever its producer wanted it to say. Pinning the accepted builder identity in the rule is the step that compares the claim against a value the gated team cannot edit.

Decide whether the rule is right about this change, not whether the incident is urgent. Grant the narrowest override that restores service, record it as you grant it, and book the review that either reverts the loosening or changes the rule.

Stop adding checks and start closing routes. Inventory every identity that can write to the surface, reduce standing write access so the deploy identity is effectively the only one, and put detection on whatever routes you choose to leave open.

Not at the cluster gate. Every change from every team arrives under the same reconciler identity, so a rule keyed on the requester either allows everyone or denies everyone. Enforce who-rules in the repository, where a human identity exists.

Resolve the rule and the decision from somewhere the gated change cannot rewrite, record the requirement outside the repository content, and make a missing or errored decision block the merge instead of passing silently.

Join on the image digest. A tag is a mutable pointer and a package URL is a naming convention, so resolve every report's reference to a digest when the evidence is produced, and treat an unresolvable reference as unknown rather than approved.

A scaffold stamp records origin, not current state: this repo was created from that template version. Later edits never change it, so gating on the stamp certifies history and says nothing about whether the files still conform.

Tier the inputs by who could have produced them. Evidence the gated job controls may only warn; evidence from a producer the gated team cannot write to, attributed to an identity policy pinned, may block promotion.

Make an explicit, time-boxed decision instead of letting timeouts make it. Use the gate's telemetry to find the slow rule and its dependency, narrow that one rule under a named owner and expiry, and record what shipped un-evaluated.

Rescope the rule from the absolute state to what the change introduced: fail on findings absent from a recorded baseline, and move the pre-existing critical into owned, dated backlog work. Do not simply raise the threshold until the pain stops.

The identity of what was judged and what judged it: the input the engine actually saw, the rule set version in force, and an explicit decision. Passed means little unless you know which rule passed it.