Exceptions and Visibility in CI/CD
The base process, approval authorities, mandatory fields, chain of authority and lifecycle are defined in Ch. 14 -
addon/12-processo-excecoes.md. This file defines only the specifics of this domain.
Scope
Exceptions to security gates, pipeline policies and CI/CD controls - temporary bypass of validations, disabling of tools or deviation from execution policies.
Triggers specific to this domain
- a blocking security gate in the context of a critical incident with a need for an urgent, documented deploy;
- a validation tool unavailable with an impact on the release cycle;
- a legacy application integrated into the pipeline without technical support for the required controls;
- an exception window during a pipeline migration with a bounded deadline.
Mandatory visibility in the pipeline
Every active exception must be explicitly flagged in the logs, execution artefacts or pipeline metadata. An exception that is invisible in the pipeline is equivalent to an uncontrolled bypass.
Flagging mechanisms by tool:
| Tool | Suggested mechanism |
|---|---|
| GitHub Actions | bypass-security-gate label on the PR; approval visible in the execution history |
| GitLab CI | exception.yaml file in the MR; review by Security Approval |
| Azure DevOps | Override on a release associated with a Work Item referencing the exception record |
| Jenkins | bypass=true flag commented in the Jenkinsfile; integration with Jira or ServiceNow |
Associated metrics
CI/CD exceptions contribute directly to the maturity KPIs (see Ch. 14 - kpis-governanca.md):
- % of pipelines with active security gates;
- no. of active exceptions by category (SAST, SBOM, signing, deploy gates);
- L3 applications with enforcement disabled or under exception.
These indicators must be reported in the governance cycle.
Cross-references
| Document | Relation |
|---|---|
addon/06-politicas-gates-pipeline.md | Pipeline gates and policies that may be subject to exception |
addon/07-validacoes-seguranca-integradas.md | Integrated validations and bypass conditions |
Ch. 14 - addon/12-processo-excecoes.md | Canonical exception management process |
Ch. 14 - kpis-governanca.md | Compliance indicators and active exceptions |