rorixrorix
sign in →

Policy Reference

Policies let you define security and compliance baselines for your .NET projects. Create a .rorix.yml file in your repository root to configure rules that are enforced during scans.

CI gate warning: the currently published Rorix.Cli 0.1.2 can return exit code 0 even when a scan finds a blocking vulnerability or policy violation, or no supported manifest. The CLI, the Action (which pins affected 0.1.1), and the Azure task (which pins affected 0.1.2) should be advisory-only until a corrected public package and failing-case integration checks are available. The CI examples below show the intended configuration after that release.

Recommended First Policy

If you are setting up your first CI gate, start with a policy that blocks only the highest-risk issues:

version: 1
policies:
  max-severity: critical
  fail-on-typosquat: true

Once the team is comfortable with the signal, add blocked licenses, score thresholds, or a stricter severity threshold.

Example Configuration

# .rorix.yml
version: 1
policies:
  max-severity: high
  max-vulnerability-count: 0
  block-licenses:
    - GPL-2.0
    - GPL-3.0
    - AGPL-3.0
  fail-on-typosquat: true
  fail-on-outdated-major: true
  min-score: 70

Rules

| Rule | Type | Default | Description | | --- | --- | --- | --- | | max-severity | string | critical | Highest allowed severity: low, moderate, high, or critical. Findings above it fail. | | max-vulnerability-count | number | — | Maximum number of vulnerabilities allowed. Set to 0 for zero tolerance. | | block-licenses | string[] | — | SPDX license identifiers that are not permitted. | | fail-on-typosquat | boolean | true | Fail when a dependency is flagged as a potential typosquat. | | fail-on-outdated-major | boolean | false | Fail when a dependency is behind by a major version. | | min-score | number | — | Minimum security score from 0 through 100. |

Using Policies in CI

The GitHub Action and Azure DevOps Marketplace task are available in public preview. Use the following CI examples as templates after their installed CLI versions are corrected and their blocking behavior is verified.

With the CLI

rorix scan --policy .rorix.yml --exit-code

In GitHub Actions

- name: Rorix Policy Check
  uses: rorix-io/rorix-scan-action@v1
  with:
    api-key: ${{ secrets.RORIX_API_KEY }}
    command: scan
    policy-file: .rorix.yml

In Azure DevOps

- task: RorixScan@0
  displayName: 'Rorix Policy Check'
  inputs:
    apiKey: $(RORIX_API_KEY)
    command: scan
    policyFile: .rorix.yml
    path: $(Build.SourcesDirectory)

Severity Levels

Severity levels are ordered from lowest to highest:

  1. low — informational findings with minimal risk
  2. medium — moderate risk, should be addressed in a reasonable timeframe
  3. high — significant risk, should be prioritized for remediation
  4. critical — severe risk, requires immediate attention

When max-severity is set to high, any critical vulnerability fails the policy check. Findings at high or below are allowed.

PentestSBOM Formats