Pipeline configuration
The CI/CD docs cover pipeline wiring: secrets, runner inputs, provider snippets and how the job turns a Mankinds gate result into a CI exit code.
The quality gate itself lives on the agent. The pipeline only needs the agent UUID and an API key.
Required Inputs
| Input | Where it lives | Description |
|---|---|---|
MANKINDS_API_KEY | CI secret or variable | API key used by the runner. Use a key created for CI access. |
| Agent UUID | Workflow file or CI variable | The agent to trigger from the pipeline. |
| Base URL | Optional runner option | Defaults to https://app.mankinds.io. |
| Timeout | Optional runner option | Maximum time the CI job waits for the Mankinds run. |
Gate Fields
| Field | Required | Default | Description |
|---|---|---|---|
| Minimum overall score | yes | 0.85 | The run fails when the scorecard's overall score is strictly below this value (0 to 1). |
| Blocking dimensions | no | [] | List of dimension keys (security, privacy, ...). Each must individually pass for the gate to pass. |
| Max failed criteria | no | unset | Caps the total number of failed criteria across the scorecard. Leave empty to disable. |
| Warning band | no | unset | Soft floor below the overall minimum. When the score lands in [warning_band, overall_min), the gate passes (exit 0) but the run is flagged as a warning. |
Decision Flow
The backend evaluates the gate after the run has a scorecard:
- Overall score must meet the configured minimum.
- Every blocking dimension must pass.
- Failed criteria must stay below the configured cap, when a cap exists.
- The warning band can mark a run as warning without failing the CI job.
The run response exposes the decision under results.gate, including passed, is_warning, scores, and failure messages when the gate fails.
Editing Without Touching CI
Because the gate lives on the agent (not in the repo), you can tighten or loosen the rule without redeploying anything:
- Open the agent in Mankinds.
- CI / CD → Quality Gate.
- Adjust the values.
- Save.
The next CI run picks up the new gate automatically. Each change is recorded on the agent config version history.
Frequently asked questions
What dimensions can I require?
Require only dimensions that are evaluated by the agent's selected criteria. If a required dimension has no score for that agent, the gate cannot pass reliably.
Can I have different gates for different branches?
The gate is per agent. Use separate agents when different environments or branches need different rules.
Can I override the gate in a one-off CI run?
No. The CI snippet carries the agent UUID and the API key; the gate remains the source of truth on the agent.
See also
- Getting started: set up the integration end-to-end.
- GitHub Actions and GitLab CI: provider-specific guides.
- Agents and Gates: SDK methods for triggering agents and managing gates programmatically.