• Reference
  • Version · 6.0
  • Change Automation Reference

checks targeting

Last updated: September 29, 2026

Note: checks targeting requires Liquibase Secure 6.0 or later and a valid Liquibase Secure license.

The checks targeting command manages persistent targeting rules that control how individual policy checks treat specific changesets during checks run. It has three subcommands:

  • Use checks targeting add to add an exempt or restrict rule.

  • Use checks targeting list to show the current rules.

  • Use checks targeting remove to delete a rule.

For the concepts behind exempt and restrict rules, see What is Checks Targeting?. For the file these rules are written to, see Checks targeting file.

Uses

Use checks targeting to configure targeting rules from the command line instead of editing the targeting file by hand. Rules are written to the targeting file paired with your checks settings file, and they take effect on a checks run that names that file with --targeting-file.

checks targeting works against your changelog and targeting file only. It does not connect to a database.

Example scenario

Your team has a policy check that flags a pattern one application legitimately needs. Rather than disabling the check for everyone, you add an exempt rule so that only that application's changesets are exempt, with a reason and a review date:

liquibase checks targeting add --type=exempt --check-name=SqlGrantWarn --teams-filter=app01 --reason="Approved exception, see DevSecOps ticket 1234" --expiration=90d

The next checks run still inspects those changesets and lists them in the report, but they no longer fail the run. After 90 days the rule stops applying automatically.

Syntax

Run one of the following:

loading

Command parameters

checks targeting add

Parameter

Description

Requirement

--type

The rule type: exempt or restrict. With exempt, the check still runs against every changeset but a match never fails the build. With restrict, the check runs only against changesets matching this rule's filter, and everything else is skipped for that check. Default: exempt.

Optional

--check-name

The short name of the policy check the rule applies to.

Required

--id

A custom, stable ID for the rule, shown by checks targeting list and used by checks targeting remove. Defaults to the check name, or <check-name>-2, -3, and so on if the check already has a rule. Set it explicitly when a check has more than one rule, so each has an unambiguous name.

Optional

--teams-filter

Match changesets by their teams attribute.

Optional

--releases-filter

Match changesets by their releases attribute.

Optional

--keywords-filter

Match changesets by their keywords attribute.

Optional

--conditions-filter

Match changesets by their conditions attribute.

Optional

--labels-filter

Match changesets by their labels attribute. Alias: --label-filter.

Optional

--contexts-filter

Match changesets by their contexts attribute. Alias: --context-filter.

Optional

--reason

Free-text note stored with the rule and shown in checks targeting list. Use it to record why the exception was granted.

Optional

--expiration

When the rule stops applying. Accepts a duration made of <number><unit> segments where the unit is s, m, h, d, or w (for example 90d, 30m, or 24h30m), or an ISO-8601 date or date-time (2026-09-30 or 2026-09-30T16:15). A number with no unit suffix is not allowed. A duration is measured from the current time in UTC, and a bare date stays active through the end of that day in UTC. There is no default.

Optional

--checks-settings-file

Path to the checks settings file the rules are paired with. It determines the derived targeting file name. If omitted, the configured checks settings file is used.

Optional

--source-file

Only needs to be specified when --checks-settings-file is a checks package file that aggregates multiple checks settings files, and the same check name appears in more than one of them. Use --source-file to name the checks settings file that holds the check you are adding a rule for.

When the check name is unique across the package, Liquibase records the source file for you. When it is not, Liquibase reports an error that lists the files defining that check and asks you to set --source-file.

Optional

--targeting-file

Overrides the derived targeting file name and location. Defaults to the checks settings file name with its extension replaced by .targeting.yaml. A bare file name resolves next to the checks settings file's own directory; a path with its own directory is used as given.

Optional

The check named by --check-name must already exist in the checks settings file. If it does not, add fails with Check '<name>' does not exist. and no rule is written.

Provide at least one filter to scope the rule. If you omit all filters, the rule matches every changeset for the named check, and add prints a warning:

  • For an exempt rule with no filter, the rule exempts the check for every changeset. Liquibase suggests checks bulk-set --severity=0 or checks customize instead, since a filter is usually the point of targeting.

  • For a restrict rule with no filter, the rule matches every changeset and narrows nothing, so the rule has no effect. checks targeting list also flags such a rule (see Output).

Values within one filter are a comma-separated OR list, and separate filters combine with AND. --teams-filter=frontend --releases-filter=v1,v2 matches changesets on the frontend team that are in either release. A filter always matches strictly, so a leading @ on a value is accepted but does nothing.

--labels-filter and --contexts-filter compare plain words rather than boolean logic, so they do not behave like --label-filter and --context-filter do on update and checks run. A changeset with contexts="(dev or test) and !prod" matches --contexts-filter=test and --contexts-filter='!prod', because Checks Targeting compares the words in the value and discards and, or, not, parentheses, and !. A value made only of those reserved words can never be matched.

checks targeting list

Parameter

Description

Requirement

--type

Limit output to exempt or restrict rules.

Optional

--check-name

Limit output to rules for one check.

Optional

--teams-filter, --releases-filter, --keywords-filter, --conditions-filter, --labels-filter, --contexts-filter

Limit output to rules with a matching filter.

Optional

--checks-settings-file

Path to the checks settings file the rules are paired with. It determines the derived targeting file name. If omitted, the configured checks settings file is used.

Optional

--targeting-file

Overrides the derived targeting file name and location. Defaults to the checks settings file name with its extension replaced by .targeting.yaml. A bare file name resolves next to the checks settings file's own directory; a path with its own directory is used as given.

Optional

checks targeting remove

Parameter

Description

Requirement

--id

The ID of the rule to remove, as shown in checks targeting list.

Required

--checks-settings-file

Path to the checks settings file the rules are paired with. It determines the derived targeting file name. If omitted, the configured checks settings file is used.

Optional

--targeting-file

Overrides the derived targeting file name and location. Defaults to the checks settings file name with its extension replaced by .targeting.yaml. A bare file name resolves next to the checks settings file's own directory; a path with its own directory is used as given.

Optional

Global parameters

checks targeting supports the standard global parameters (for example --log-level and --log-file). See Policy check and Flow commands and parameters and the global command parameters reference.

Syntax by configuration method

Like other commands, each parameter can be set on the CLI, in a Flow file, in liquibase.properties, as a JAVA_OPTS system property, or as an environment variable. The property and environment-variable forms are namespaced to the subcommand, for example:

loading

Note: Property and environment-variable keys are namespaced by the subcommand you are configuring (add, list, or remove).

Output

checks targeting add

Added checks targeting exempt rule 'SqlGrantWarn' for check 'SqlGrantWarn' to 'liquibase.checks-settings.targeting.yaml'.

If you set --expiration or --reason, they are appended to the same line:

loading

Each checks targeting add appends one rule to the targeting file. To add more exceptions, run checks targeting add again for each one. There is no separate append flag, and you do not create a new file per rule.

checks targeting list

Rules are shown in two sections, EXEMPT and RESTRICT, each a table with the same columns. A filter you did not set shows as * (matches any value), and a rule with no expiration shows never.

loading

If there are no rules to show, the command prints No checks targeting rules found. and reports where it looked, for example No checks targeting rules found. Looked in 'liquibase.checks-settings.targeting.yaml'. A --type or filter argument that excludes everything is noted too, for example No checks targeting rules found. (type=restrict) Looked in '...'.

A rule that cannot apply is annotated in the REASON column:

Annotation

Meaning

[EXPIRED -- not applied]

The rule's --expiration has passed. Expired rules are not applied by checks run.

[NO-OP: no filter -- doesn't narrow anything]

A restrict rule with no filter, which matches every changeset and narrows nothing.

[UNKNOWN check '<name>' -- not applied]

The rule names a check that is not in the checks settings file. Because add rejects an unknown check, you see this only when a rule was added to the file by hand, or the check was later deleted or renamed.

checks targeting remove

Removed checks targeting rule 'SqlGrantWarn' from 'liquibase.checks-settings.targeting.yaml'.