The policy

shipvigil.policy.json at the repository root decides which lockfiles Shipvigil reads and what blocks a release. Without the file, Shipvigil uses the defaults below. Every field is optional, and a field you leave out keeps its default.

{
  "lockfiles": ["site/package-lock.json"],
  "deps": {
    "block": ["malicious", "exploited", "likely"],
    "warn": ["unknown", "routine"]
  },
  "live": {
    "production": { "blockExposure": ["high"], "requireIndexable": true },
    "review": { "blockExposure": ["high"], "requireIndexable": false }
  }
}

Lockfiles

lockfiles lists the lockfiles to check, relative to the repository root. When the list is empty, Shipvigil reads the lockfiles it finds at the root. --lockfile <path> on the command line overrides both.

Dependency priorities

The cve server gives each vulnerable package one priority, worst first:

Priority Meaning Default
malicious The release itself is malware (an OSV MAL- advisory). block
exploited A CVE of this version is in the CISA Known Exploited Vulnerabilities catalog. block
likely The highest FIRST EPSS score of its CVEs is 0.1 or more, which is a 10% or higher chance of exploitation in the next 30 days. block
unknown The advisory has no CVE, or its CVE has no EPSS score yet. warn
routine A known advisory with a low EPSS score and no KEV entry. warn

Put each priority in block or warn. An unknown name fails the run with exit code 2, so a typo never turns the gate off.

Live checks

Field What it does
blockExposure Exposure risks of these severities block (high, medium, low).
requireIndexable Blocks when the page says noindex in a meta tag or an x-robots-tag header. On for production, off for review apps, which the host marks noindex on purpose.

An unreachable page always blocks. The exposure scan runs for production only, and --no-exposure turns it off. Missing security headers are a warning.

Exit codes

Code Meaning
0 Pass, or pass with warnings.
1 The policy blocks.
2 A usage error, a bad policy file, or a server Shipvigil could not reach for the dependency check.

A live check whose server call fails turns that check into a warning with the reason, never a silent pass.