quality

Source directory to check.

Languages to include: go, node, python, dotnet (repeatable, optional).

Minimum severity that fails the pipeline: CRITICAL|HIGH|MEDIUM|LOW|NONE

Git commit SHA for evidence provenance.

Git branch name for evidence provenance.

Repository URL for evidence provenance.

Internal npm registry URL.

How the npm feed is applied: “registry” (default) makes it the registry for every package; “npmrc” binds only its token and leaves routing to the project’s .npmrc, for a feed with no upstream to the public registry.

Auth token for internal npm registry.

Internal NuGet feed URL.

Auth token for internal NuGet feed.

Minimum coverage percentage (0–100) to pass the gate. 0 disables the check.

Skip the coverage gate for a language that has fewer coverable lines/statements than this.

Run lint only — skip the per-language test step entirely. For repos that execute their own test command via Test (BYO test, ADR-002), this keeps the vanilla lint baseline without a redundant test run.

node or dotnet; the language whose linter uses prepared dependencies.

“registry” (default) or “npmrc”; see quality.Check.

“registry” (default) or “npmrc”; see quality.Check.

Source directory to test.

Single test command, run via sh -c in one toolchain container (always explicit, never auto-detected). Mutually exclusive with testLegs; exactly one of the two is required.

Witnessed test legs as a JSON array — one object per leg, each with keys label, language (go|node|python|dotnet), cmd, and optionally coveragePath and toolchainImage. Supersedes testCmd / coveragePath / toolchainImage, which it carries per leg. Mutually exclusive with testCmd.

Path of the coverage report the test command writes — absolute, or relative to the source root. A filename pattern is accepted too (any of * ? [ makes it one), for a command that cannot be made to write a fixed name: Microsoft.Testing.Platform guid-names every test application’s report. The search descends from the pattern’s directory, duplicate documents are dropped, and the evidence states how many documents were merged. Applies to testCmd only; a leg names its own.

Baseline coverage document for the ratchet: a prior combined-evidence.json / evidence envelope, or a bare {“coverageByLanguage”: {…}} map (sniffed).

Allowed per-language coverage drop (percentage points) before the ratchet trips.

Ratchet mode: “gate” fails the envelope on a tripped ratchet, “warn” only warns.

Toolchain container image override — the only digest-pinnable level (ADR-004). Applies to testCmd only; a leg names its own.

Languages to include: go, node, python, dotnet (repeatable, optional).

Git commit SHA for evidence provenance.

Git branch name for evidence provenance.

Repository URL for evidence provenance.

Internal npm registry URL. When set with npmToken, the BYO test command can restore from a private npm feed. Mirrors quality.Check.

“registry” (default) or “npmrc”; see quality.Check.

Auth token for the internal npm registry (Dagger secret, never plaintext).

Internal NuGet feed URL. When set with nugetToken, the BYO test command can restore private NuGet packages. Mirrors quality.Check.

Auth token for the internal NuGet feed (Dagger secret, never plaintext).

Optional app source view for detection and scope accounting. Commands still run in src. Named coverage output is mandatory and freshly produced.

Shared prepared container; only the selected test leg uses it.

Label of the test leg sharing preparation; test-cmd for the single command.

Image used to produce prepared. Must agree with any explicit leg image.