How the check works

What the checker reads and what it answers, for building your own integration.

The checker is a filter. Everything it needs comes in on standard input; everything it produces goes out on standard output. That is the whole interface, and it does not change within a major version.

What goes in

A JSON object describing what is about to change, either as your cloud tool wrote it or as a plain list of resources.

What comes out

{
  "result": "fail",
  "checked": 142,
  "passed": 141,
  "failures": [
    {
      "rule": "traffic is encrypted",
      "service": "checkout-api",
      "owner": "team:platform",
      "detail": "tls is 1.2, needs at least 1.3"
    }
  ],
  "record": "8f2c41d"
}

Exit codes

0 everything passed. 1 something failed. 2 the input could not be read. Anything else is a bug worth telling us about.