Build Security
A workspace's Build Security policy decides what Loha does with scanner evidence for each build. You set it under Settings → Code security.
| Mode | What happens |
|---|---|
| Off | No scanning evidence is checked. |
| Observe | Findings are recorded but never block a build. |
| Enforce | Builds without the required evidence, or with findings at or above a threshold, fail — so no Release is recorded and Loha Delivery does not roll them out. |
To let a known finding through for a limited time, see Security exceptions.
What Enforce does and does not guarantee
Enforce decides after your pipeline's steps have run: a platform-owned final gate is the last task of every enforced build. That placement defines its reach.
Enforce guarantees that:
- A build that fails the policy is marked failed, gets no Release, and is never rolled out by Loha Delivery. Delivery also re-checks the active policy before every rollout.
- On protected branches, pipelines that use Loha's deploy tasks are refused. Deploy with Loha Delivery instead.
- Loha's own deploy credentials (target SSH keys, GitOps connection tokens) are never exposed to your pipeline's code. Automated tests enforce this.
Enforce does not:
- Stop commands in your pipeline from contacting external systems (SSH hosts, clusters, registries, webhooks) using credentials you provide, before the scan completes. Don't store deploy credentials as pipeline secrets if you rely on Enforce.
- Hold back image pushes. Images may be pushed to your registry before the scan decides; a blocked build's image is not recorded as a Release. A deploy target that automatically pulls a mutable tag (for example
:latest) can still pick it up, so deploy by digest or through Loha Delivery.
The supported way to deploy under Enforce is Loha Delivery, because it acts only on builds the gate authorized.
See also: Image signing, SBOM and provenance.