vulkro gate

Fail a build only on findings that are new compared with a git branch or commit, so existing debt never blocks a change.

vulkro gate --base origin/main

It scans the working tree and the base ref, and reports only findings in the working tree that are not in the base.

gate or scan --gate-vs

• vulkro gate --base <ref> compares the full findings of both trees. It catches a new caller that makes an old sink reachable.
• vulkro scan --gate-vs <ref> only looks at changed lines. It is cheaper but misses that case.

A new finding marked Not checked (a class Vulkro flags but cannot decide offline, such as object-level authorization) is reported but never fails the gate. Set VULKRO_GATE_SEVERITY_ONLY=1 to let them fail it again.

Flags

Flag	Description
[PATH]	Project root. Default ..
--base <REF>	Ref to compare against (main, origin/main, a SHA). Required unless VULKRO_GATE_BASE is set.
--format <FMT>	table (default), json (totals plus new findings) or sarif (new findings only).

GitHub Actions

- uses: actions/checkout@v4
  with:
    fetch-depth: 0   # the base ref must be in history
- run: vulkro gate --base origin/${{ github.base_ref }}

Exit codes

Code	Meaning
0	No new findings that fail the gate.
1	New findings that fail the gate, or no active licence (license_required).
2	Bad ref, git not available, or scan failure. Also 2 when no source file could be read.

Inside a git hook, a machine without a licence is never blocked: the gate exits 0 with a notice.

See also: vulkro install-hook, CI/CD integration.