Baseline, report-only, strict
Turning a gate on over an existing codebase in three stages: grandfather what is there today, report without blocking until a date you choose, then enforce on new findings only.
1. Capture a baseline
Run the wizard from the repository root. It scans, writes every current finding to .gatetest/baseline.json, and prints a count per module, a .gatetest.json snippet and the CI line below.
npx -p @gatetest/cli gatetest baseline --init- Baselined findings stay visible in every report. They are left out of the gate decision, not hidden.
- The count is kept per file, so a new problem cannot hide behind an old one: a second empty catch in a file that had one baselined blocks again.
- Fix a baselined finding and it is gone for good. Run the wizard again after paying down debt to refresh the snapshot, or delete
.gatetest/baseline.jsonto see everything again.
2. Report only, until a date
The wizard prints this snippet with a date 14 days out. Before that date a run reports what it found and passes; from that date it enforces, with no second change to remember.
{
"reportOnlyUntil": "YYYY-MM-DD"
}Dates are UTC calendar days, and the date itself already enforces. The same switch is a flag: --report-only-until YYYY-MM-DD. --strict overrides it on a single run.
3. Enforce on new findings
Commit the baseline file and the snippet, then add this line to your CI job. Once the date has passed, it fails the job only on findings that are not in the baseline.
npx -p @gatetest/cli gatetest --suite standard --sarif --junit --parallelThe GitHub App has its own switch. It posts an advisory check until .gatetest.json says:
{
"mode": "strict"
}Which switch each door reads
| Switch | CLI and CI line | GitHub App |
|---|---|---|
| .gatetest/baseline.json | Read. Findings in it never block. | Not read yet. Findings in files the pull request did not touch are labelled pre-existing and never fail its check. |
| reportOnlyUntil | Read. Before the date the run reports and passes; from the date it enforces. | Not read. The App starts in advisory mode instead. |
| "mode": "strict" | Not used. The CLI enforces unless it is in report-only. | Read. Advisory until it is set; then error findings in the change fail the check. |
Suppressing a single false positive is a different tool: configuration and suppression. New here? Start with the quickstart.