Configuration
Validation policies
Before any patch reaches a merge request, Argus proves it against your build with Maven. How strict that proof must be is yours to choose.
The qualification gate
A version bump that fixes a vulnerability is worthless if it breaks the build. So every patched POM passes through a qualification gate: Argus runs Maven against it in isolation and only lets it become a merge request if Maven agrees. The strictness of that gate is set with ARGUS_VALIDATION_STRATEGY, and defaults to the cheapest meaningful check.
# Require the full test suite to pass before publishing
ARGUS_VALIDATION_STRATEGY=test
# Retry a validation that failed for an apparently transient reason
ARGUS_VALIDATION_RETRIES=3The three strategies
The strategy trades thoroughness against time. compile is fast and proves the sources still build. test is the strongest guarantee but pays for your whole test suite on every patch. test-or-compile is the pragmatic middle: it runs the tests, but if they fail while compilation still succeeds, it publishes anyway with a warning rather than blocking the fix.
| Property | Default | Description |
|---|---|---|
compiledefault | test-compile | Main and test sources must compile. Tests are not executed. |
test | test | Sources must compile and the application tests must pass. |
test-or-compile | test → test-compile | Tests are run; if they fail but compilation succeeds, the patch is published with a warning. |
Qualification statuses
Each patch ends qualification with one of four statuses. Three of them allow publication; only an outright failure blocks it. The distinction between “qualified” and “inconclusive” matters at review time: an inconclusive result means Argus could not reach a verdict, not that the patch is good.
| Property | Default | Description |
|---|---|---|
qualified | publish | The Maven phase passed cleanly. The patch is eligible. |
qualified_with_warning | publish | Only under test-or-compile: tests did not pass, but sources compiled. Eligible, flagged. |
validation_failed | block | Maven reported a genuine failure. The patch is not published. |
qualification_inconclusive | publish | Validation could not run to a verdict (e.g. a transient error). Eligible, but review the evidence. |
Transient failures
Not every Maven failure is the patch’s fault. A dropped connection to your artefact repository, a timeout, a momentary “service unavailable”: these are environmental, not evidence that the fix is broken. Argus recognises the tell-tale output of such failures and, when ARGUS_VALIDATION_RETRIES is set to a positive integer, retries before giving up. A genuine compilation or test error is never retried; only the transient ones are.
Isolation
Qualification never runs against your working tree. Argus copies the project into a temporary workspace (skipping .git, target, and the advisory cache), stages the patched POM there, and runs Maven in that copy. Whatever happens during validation, your real project is untouched.