CI gates
Pre-merge gate
Section titled “Pre-merge gate”Score a rendered manifest before it ever reaches a cluster:
helm template ./chart | rtz risk check -f - --fail-on highStateless and cluster-free — it needs only a token, so it runs anywhere CI does. An empty manifest is refused rather than scored 0: a template step that silently produced nothing would otherwise be the greenest possible build.
Post-deploy gate
Section titled “Post-deploy gate”rtz risk --fail-on highExits 4 when anything reaches the threshold. An unrecognised severity is a usage error, not
a silent pass — a typo must never turn the gate into a no-op that reports success.
Exit codes
Section titled “Exit codes”| Code | Meaning |
|---|---|
0 |
Success |
1 |
Runtime error |
2 |
Usage error |
3 |
Authentication required |
4 |
Policy or threshold failure (--fail-on) |