CI gates

Pre-merge gate

Score a rendered manifest before it ever reaches a cluster:

helm template ./chart | rtz risk check -f - --fail-on high

Stateless and cluster-free — it needs only a token, so it runs anywhere CI does. An empty manifest is refused rather than scored 0: a template step that silently produced nothing would otherwise be the greenest possible build.

See The deployment risk gate for what it checks, diff mode, and live checks against observed cluster behaviour.

Post-deploy gate

rtz risk --fail-on high

Exits 4 when anything reaches the threshold. An unrecognised severity is a usage error, not a silent pass — a typo must never turn the gate into a no-op that reports success.

Exit codes

Code	Meaning
0	Success
1	Runtime error
2	Usage error
3	Authentication required
4	Policy or threshold failure (--fail-on)