bypassed_checks

Schema reference for the bypassed_checks SQL view — one row per check masked by a bypass, with the first and last time it happened and a count.

bypassed_checks

The bypassed_checks view provides information about the checks that each bypass has masked, with one row for each check a bypass masked on a given commit.

The bypasses view records what a bypass was scoped to, while this view records what it actually masked. The two can differ, because a bypass with a NULL policy covers every blocking check on its gate, including checks from policies added to the manifest after the bypass was created.

Schema

Column	Type	Description
bypass_id	TEXT	The identifier of the bypass that masked the check. Join to bypasses.id
component_id	TEXT	The identifier for the component whose check was masked - e.g. github.com/foo/bar/buz
gate	TEXT	The block the check was masked in. Can be one of pr or release
sha	TEXT	The Git commit SHA the masking happened on
pr	BIGINT	The pull request number the masking happened on. Set to NULL outside a pull request
check_name	TEXT	The fully qualified name of the check - e.g. sbom.no-critical-vulns
first_masked_at	TIMESTAMP	The UTC timestamp when this bypass first masked this check on this commit
last_masked_at	TIMESTAMP	The UTC timestamp when it most recently did
mask_count	BIGINT	The number of evaluations this bypass has masked this check on this commit

Notes

• Rows are deduplicated rather than appended. The unique key is (bypass_id, sha, check_name), so masking the same check again on the same commit increments mask_count and updates last_masked_at instead of adding a row.
• The mask_count column counts evaluations, not distinct problems. Gates are re-evaluated whenever new results arrive, so a high count on a single commit mostly reflects how often the gate ran.
• Rows are written when a gate is evaluated, so a bypass that was never exercised has no rows in this view.

Usage examples

Retrieve the checks that a given bypass has masked.

SELECT check_name, sha, first_masked_at, last_masked_at, mask_count
FROM bypassed_checks
WHERE bypass_id = '00000000-0000-0000-0000-000000000000'
ORDER BY first_masked_at;

Retrieve the active bypasses that have masked at least one check, along with who created them.

SELECT b.component_id, b.actor, b.reason, bc.check_name, bc.mask_count, b.expires_at
FROM bypassed_checks bc
JOIN bypasses b ON b.id = bc.bypass_id
WHERE b.active
ORDER BY bc.last_masked_at DESC;

Retrieve the bypasses that never masked anything.

SELECT b.component_id, b.actor, b.reason, b.created_at, b.expires_at
FROM bypasses b
LEFT JOIN bypassed_checks bc ON bc.bypass_id = b.id
WHERE bc.bypass_id IS NULL
ORDER BY b.created_at DESC;

Retrieve the checks that were first masked more than two days after their bypass was created, which indicates a bypass that started covering something new.

SELECT b.component_id, bc.check_name, b.reason,
       bc.first_masked_at - b.created_at AS granted_to_first_mask
FROM bypassed_checks bc
JOIN bypasses b ON b.id = bc.bypass_id
WHERE bc.first_masked_at > b.created_at + INTERVAL '2 days'
ORDER BY granted_to_first_mask DESC;

Retrieve the most frequently masked checks across all components.

SELECT check_name, count(DISTINCT bypass_id) AS bypasses, sum(mask_count) AS total_maskings
FROM bypassed_checks
GROUP BY check_name
ORDER BY bypasses DESC;