- Task
- Version · 6.0
- Improve
Investigate a policy check failure
Last updated: September 29, 2026
A failing policy check is governance doing its job. The pipeline stopped a change instead of the database stopping it later. This guide goes from the blocked pipeline to a passing change, or, when the rule itself is wrong for the case, to a corrected rule.
Before you begin
Contact us to enable Change Intelligence.
The failed
checks runwas reported to the server. Onlychecks runoperations are captured; other checks subcommands are not reported.You can edit the changelog and rerun the checks before pushing back through the pipeline.
Procedure
Find the failed check run
In the web app's sidebar, select Policy Checks under Monitor. Each row is one checks run operation. The Severity column shows the violations as counts per severity, from Info through Minor, Major, Critical, and Blocker, before you open anything. Use the Filter operations search bar and the Status dropdown to narrow the list.
Read the findings
Select the operation to open its detail page. The Outcome Breakdown card gives the totals, such as how many checks were evaluated and how many violations they raised. The Findings section is the detail, organized into tabs:
By Severity: Every violation, worst first. Each row names the check that fired, its description, its severity, and the exact target, either a changeset shown as
filepath :: changesetId :: authoror a database object, with the source location asfile:line.By Check: One row per rule, with its scope (Changelog or Database) and how many changesets and objects it flagged. Expand a row to see each flagged item.
By Changeset and By Database: The same findings grouped by target, so you can see everything one changeset or one database tripped.
Understand what the check protects
Before editing anything, know what the rule is for. A deleteWithoutWhere hit protects data. A naming-convention hit protects operability. The severity the check carries maps to an exit code, which is what actually stopped the pipeline. Each check's behavior and parameters are documented in the policy check reference.
Fix the change or fix the rule
Fix the changeset: This is the usual path. The finding points at the exact pattern. Correct it and rerun the checks locally before pushing back through the pipeline.
Be sure to:
Replace
your_changelog.xmlwith the changelog the failed run evaluated
liquibase checks run --changelog-file=your_changelog.xmlFix the rule: If the check fires on things your organization considers acceptable, that is a governance decision, not a developer workaround. Adjust the check's parameters or severity, or scope it with checks targeting so it skips the changesets it should not judge. Policy changes belong to whoever owns governance.
Note: Liquibase Secure 6.0 has no exemption mechanism. There is no way to waive a check for one change while leaving it enforced. If a rule should not apply, the options are the two above.
Rerun and verify
Rerun the checks, confirm the pipeline passes, and confirm the new operation appears in Policy Checks with the outcome you expect. The failed run stays in the record as evidence the control worked.