Findings and policy
Blocking policy
Choose which findings stop a commit or a merge.
The blocking policy is the severity at which a scan stops your work. Every finding is still reported. The policy only decides which ones block.
Who can do this:Team adminsRepository maintainers
Options
| Option | Blocks when there is |
|---|---|
| Never | Nothing blocks. Findings are reported only. |
| Critical | A critical finding. This is the default. |
| High+ | A high or critical finding. |
| Medium+ | A medium, high, or critical finding. |
Low findings never block.
Commits and merges have separate policies
| Setting | Applies to |
|---|---|
| Block a commit when there is | Pre-commit scans |
| Block a merge when there is | Pull request scans. A failed check blocks a merge only if it's required on GitHub. |
A common setup is a looser policy for commits, so developers aren't interrupted mid-task, and a stricter one for merges.
Change it
Open the repository and go to Settings › Scan policy. When a value differs from your team default, the form shows Team default: next to it. Use team defaults resets the repository. To change the defaults for new repositories, see Team defaults.
How the outcome is decided
- Only a completed scan can block. If Lighthouse fails, times out, or your team is out of credits, nothing is blocked. See fail-open.
- A scan keeps the policy that applied when it started. Changing the policy doesn't change past scans.
- Marking a finding as a false positive makes Lighthouse decide the outcome again without it, so a blocked scan can become unblocked.
Still stuck after reading this page?