Add the step to the pipeline

The Security Gate is an Azure DevOps steps template. It runs right after the scan, in the same job, and before the image push and the deploy. That way, in fail mode, an image past its deadline never reaches the registry.

1. Generate the template

In the Workspace: AppSec → Config Stack → Pipeline → Security Gate tab.

Field	What it’s for	Default
Application name	The application name. It becomes the appName parameter and shows up in the step name: [<appName>] Leavory Security Gate.	my-application
Trivy report source	Where the step reads the report from (see below).	Leavory Trivy manifest
Trivy JSON report path	Only with the Custom option. Path of the JSON on the agent. Accepts several comma-separated files.	$(Build.ArtifactStagingDirectory)/trivy.json
Max days for CRITICAL	Limit in days for CRITICAL. -1 turns it off.	7
Max days for HIGH	Limit in days for HIGH. -1 turns it off.	30
When over the limit	Fail the pipeline stops the build. Warn only turns the build yellow (Succeeded with issues).	Fail the pipeline
Only count vulnerabilities with a fix available	Ignores what doesn’t have a fixed version yet.	Unchecked

Trivy report source:

Option	When to use
Leavory Trivy manifest (same job)	You use the scan steps generated in the Manifest generator tab. The Security Gate finds the reports on its own, by the same appName.
Custom path to a Trivy JSON report	You already produce the JSON report some other way. Enter the file path.

Click Download .yml (or Copy) to get security-gate-steps.yml.

2. Save it in the repository

Put the file in the application repository, for example at templates/security-gate-steps.yml, and make sure the LEAVORY_TOKEN secret variable exists in the pipeline.

3. Call the template

With the Leavory scan manifest:

steps:
  # ... image build and scan
  - template: templates/security-gate-steps.yml
    parameters:
      appName: 'my-application'   # the same appName as the scan template
  # then: image push, deploy...

With a JSON report your pipeline already produces:

steps:
  # ... the step that produces $(Build.ArtifactStagingDirectory)/trivy.json
  - template: templates/security-gate-steps.yml
    parameters:
      appName: 'my-application'
      trivyReport: '$(Build.ArtifactStagingDirectory)/trivy.json'

Template parameters

Any parameter can be overridden in the call, without generating the file again.

Parameter	What it is
appName	The application name
trivyReport	Only with the Custom option: path(s) of the JSON report
maxDaysCritical / maxDaysHigh	Limits in days (-1 turns it off)
mode	fail or warn
onlyWithFix	true to count only what has a fix
image	The Security Gate image. latest is always the newest; use a version tag (e.g. v20261013.2) to pin it

A different rule for one pipeline only:

  - template: templates/security-gate-steps.yml
    parameters:
      appName: 'my-application'
      maxDaysCritical: 3
      maxDaysHigh: 15
      mode: warn

Run it daily too

An image that passed yesterday can be over the limit today, because the vulnerability got older. A daily schedules: in the pipeline catches that even without a new commit.

When the check is skipped

In these cases the step shows a warning and the build continues:

Warning	Cause
LEAVORY_TOKEN secret variable not set, check skipped.	The variable doesn’t exist, or isn’t a secret with that name
no Trivy JSON report found, check skipped.	The report wasn’t generated or the path is wrong
could not run the check (exit 2), skipped.	Token rejected (invalid or revoked) or database unavailable
could not run the check (exit 125), skipped.	The agent couldn’t pull or start the image