Release gate for VibeControls
OPA-backed release-gate at promote.prod — block on policy, evidence-required deploys.
vibe plugin install @vibecontrols/vibe-plugin-security-release-gate
About this plugin
OPA-backed release gate for the promote.prod lifecycle stage in VibeControls. Does not shell out — it calls the backend's securityPolicyDecision(scanRunId) GraphQL resolver, which in turn POSTs to the existing opa-wspace:8181 ACA sidecar with the appropriate Rego bundle.
Registers as a security.release provider (name opa-release-gate) with the @vibecontrols/vibe-plugin-security meta plugin.
Decision input
The backend resolver loads:
- the scan run's
summary(severity counts) - open
SecurityFinding[](joined to activeSecurityException[]) - the workspace + per-vibe
SecurityPolicy(level:advisory/warn/block) - artifact metadata (signed? SBOM present? pinned by digest?)
It POSTs the document to POST {OPA_URL}/v1/data/vibecontrols/security/release/allow and caches the decision in Valkey for 5 minutes keyed by (scanRunId, policyVersion).
Provider output
NormalizedFinding[]— one row perdeny[]entry withcategory: "policy"and severity derived from the policy expression- Evidence: a single
opa-decisionJSON document containing the input + decision (uploaded to S3 for the audit trail)
Use it in 30 seconds
- Make sure the agent is running:
vibe start - Install the meta first:
vibe plugin install @vibecontrols/vibe-plugin-security - Install this plugin:
vibe plugin install @vibecontrols/vibe-plugin-security-release-gate - List installed plugins:
vibe plugin list
Other Security plugins
Archive Offboard
Writes tombstone.json evidence at archive.offboard for SOC2/ISO retention proofs.
@vibecontrols/vibe-plugin-security-archiveDAST (preview)
OWASP ZAP baseline DAST scan against alpha preview URLs at deploy.preview.
@vibecontrols/vibe-plugin-security-dast-previewDeploy alpha smoke
TLS / HSTS / CSP smoke checks for alpha environment URLs at deploy.alpha.
@vibecontrols/vibe-plugin-security-deploy-alphaDeveloper local
Local pre-commit secrets scanner (gitleaks protect) — runs on the developer machine.
@vibecontrols/vibe-plugin-security-developer-localIncident response
Targeted incident-response scanner for incident.response lifecycle stage.
@vibecontrols/vibe-plugin-security-incidentRepo onboard
Repo profile detector — picks the right policy bundle on repo.onboard.
@vibecontrols/vibe-plugin-security-onboard