checks bulk-set

Last published July 28, 2025

Note: This is a Liquibase Pro feature, so you need a Liquibase Pro License Key to use it.

The checks bulk-set command sets all qualifying Policy checks to the same value. It helps you perform bulk management operations without running similar checks commands multiple times.

Uses

The checks bulk-set command allows you to modify all qualifying Policy checks at once using the --enable, --disable, and --severity flags.

Example Scenario

For example, in a few commands, you can disable all your Policy checks, set all severity exit codes to 0, and then pick a couple of them to enable and set the appropriate severity level. Let’s say you have 30 Policy checks with different priorities. However, you want to reset them all to have a severity of 0 and configure only a few to have a severity of 4, which you have set in your CI/CD tool as an exit code that stops your jobs. In this instance, you would run liquibase checks bulk-set --severity=0. to set them all to 0, then you would update the couple you want to severity 4 for with liquibase checks customize --checkname=<someCheckShortName1> and liquibase checks customize --checkname=<someCheckShortName2>.

Note: You cannot enable the checks that do not have the default value. You need to copy and customize them first.

Note: To view a list of available checks, run liquibase checks show.

Syntax

You can run the bulk-set command as follows:

liquibase checks bulk-set --disable liquibase checks bulk-set --enable liquibase checks bulk-set --severity=[INFO|MINOR|MAJOR|CRITICAL|BLOCKER] liquibase checks bulk-set --severity=[0|1|2|3|4]

Note: If you have a checks settings file customized for a specific environment or project, you need to pass that using the --checks-settings-file parameter. If you do not include this parameter, Liquibase uses the default settings file: liquibase.checks-settings.conf.

The command is interactive, so to skip the confirmation in automation, use the --force flag with another checks bulk-set flag.

liquibase checks bulk-set --severity=INFO --force

You can pass only one flag at a time. For example, to enable checks and set them to severity=MINOR, run two checks bulk-set commands, as follows.

Example: liquibase checks bulk-set --enable liquibase checks bulk-set --severity=MINOR

Parameters

Global parameters

Parameter

Definition

Requirement

--license-key=<string>

Your Liquibase Pro license key

Required

Command parameters

Parameter

Description

Requirement

--disable=<true|false>

Disable all qualifying checks in the checks settings file. Default: true.

Required

(either this or --enable must be true)

--enable=<true|false>

Enable all qualifying checks in the checks settings file. Default: false.

Required

(either this or --disable must be true)

--auto-enable-new-checks=<true|false>

Automatically enable new policy checks in liquibase.checks.conf file when they are available. Default: false.

Optional

--auto-update=<string>

Allows automatic backup and updating of the liquibase.checks-settings.conf file when new policy checks are available. Valid values are ON and OFF. Default: OFF.

Optional

--check-name=<string>

The name of the check(s) you want to target. Comma-separated list of one or more enabled checks. Checks to exclude can be prefixed with the ! character. If no checks are specified, all enabled checks are targeted. For example: --check-name=shortname1,shortname2,!shortname3

Optional

--checks-settings-file=<string>

Specifies the checks settings file to use with policy checks commands. Write the relative path of the settings file that you want to read from or modify.

Optional

--force=<true|false>

If true, Liquibase does not ask for confirmation when you run this command. Default: false.

Optional

--severity=<string>

Set the severity to return a code of 0–4 when the check is triggered. Default: 0.

Optional

Bulk-set example output

Liquibase Version: 4.28.0 Liquibase Pro 4.28.0 by Liquibase licensed to Liquibase_QA until Tue Dec 02 01:59:59 UYT 2025 WARNING: Additional checks have been added to 'liquibase.checks-settings.conf' and are disabled. To auto-enable new checks on upgrades, set '--auto-enable-new-checks=true'. Learn more at https://docs.liquibase.com/policy-checks IMPORTANT: Are you sure you want to set all checks to severity <'MINOR'> <(1)>? (Y/N) [N]: y All qualifying checks have been set to severity 'MINOR'. +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | Short Name | Scope | Status | Severity | Customization | Description | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | SqlGrantWarn | changelog | enabled | 1 | <None> | This check warns a user when | | | | | | | SQL contains 'GRANT' | | | | | | | statements so that they can | | | | | | | ensure that the privilege | | | | | | | being granted won't lead to | | | | | | | security issues. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | SqlRevokeWarn | changelog | enabled | 1 | <None> | This check warns a user when | | | | | | | SQL contains 'REVOKE' | | | | | | | statements so that they can | | | | | | | ensure that the privilege | | | | | | | being revoked won't lead to | | | | | | | data access and dependency | | | | | | | issues. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | WarnOnUseDatabase | changelog | enabled | 1 | <None> | This check warns a user when | | | | | | | generated or raw SQL contains | | | | | | | 'USE DATABASE' directive. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | ChangeDropTableWarn | changelog | enabled | 1 | <None> | This check warns a user when a | | | | | | | table is being dropped so that | | | | | | | they can ensure that dropping | | | | | | | the table won't lead to | | | | | | | unintentional loss of data. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | ChangeDropColumnWarn | changelog | enabled | 1 | <None> | This check warns a user when a | | | | | | | column is being dropped so | | | | | | | that they can ensure that | | | | | | | dropping the column won't lead | | | | | | | to unintentional loss of data. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | ModifyDataTypeWarn | changelog | enabled | 1 | <None> | This check warns a user when a | | | | | | | change will result in | | | | | | | modification of a data type so | | | | | | | they can ensure that modifying | | | | | | | the data type won't lead to | | | | | | | unintentional loss of data | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | SqlSelectStarWarn | changelog | enabled | 1 | <None> | This check warns a user when | | | | | | | generated or raw SQL contains | | | | | | | 'SELECT *' statements so that | | | | | | | they can ensure selecting all | | | | | | | fields from a table in a query | | | | | | | is safe and necessary | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | SqlUserDefinedPatternCheck | changelog | disabled | 1 | SEARCH_STRING = null | This check scans SQL for the | | | | | | MESSAGE = A match for regular | presence of specific patterns | | | | | | expression <SEARCH_STRING> was | in specified changelog paths, | | | | | | detected in Changeset | and warns the user when they | | | | | | <CHANGESET> in changelog path | are found. | | | | | | <PATH_FILTER_REGEX>. | | | | | | | STRIP_COMMENTS = true | | | | | | | PATH_FILTER_REGEX = null | | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | EndDelimiterExistsWhenPatternExists | changelog | disabled | 1 | SEARCH_STRING = null | This check triggers when a | | | | | | CASE_SENSITIVE = true | changeset contains the | | | | | | STRIP_COMMENTS = true | supplied pattern string or | | | | | | MESSAGE = The pattern | regex, but does not have an | | | | | | '<SEARCH_STRING>' was found | end delimiter set specifically | | | | | | without an end delimiter in | in the changeset or via | | | | | | Changeset '<CHANGESET>'. | options such as | | | | | | | 'pro-global-end-delimiter' or | | | | | | | 'endDelimiter' attribute in a | | | | | | | modifyChangesets tag. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | PatternAFollowedByPatternB | changelog | disabled | 1 | PRIMARY_SEARCH_STRING = null | Check triggers if the | | | | | | LOOKAHEAD_SEARCH_STRING = null | user-supplied regex pattern A | | | | | | CASE_SENSITIVE = true | is followed by the | | | | | | LOOKAHEAD_MESSAGE = Match | user-supplied regex pattern B | | | | | | found: | | | | | | | '<PRIMARY_SEARCH_STRING>' is | | | | | | | followed by | | | | | | | '<LOOKAHEAD_SEARCH_STRING>' in | | | | | | | Changeset '<CHANGESET>'. | | | | | | | STRIP_COMMENTS = true | | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | PatternAPrecededByPatternB | changelog | disabled | 1 | PRIMARY_SEARCH_STRING = null | Check triggers if the | | | | | | LOOKBEHIND_SEARCH_STRING = | user-supplied regex pattern A | | | | | | null | is preceded by the | | | | | | CASE_SENSITIVE = true | user-supplied regex pattern B | | | | | | LOOKBEHIND_MESSAGE = Match | | | | | | | found: | | | | | | | '<LOOKBEHIND_SEARCH_STRING>' | | | | | | | is preceded by | | | | | | | '<PRIMARY_SEARCH_STRING>' in | | | | | | | Changeset '<CHANGESET>'. | | | | | | | STRIP_COMMENTS = true | | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | PatternANotFollowedByPatternB | changelog | disabled | 1 | PRIMARY_SEARCH_STRING = null | Check triggers if the | | | | | | LOOKAHEAD_SEARCH_STRING = null | user-supplied regex pattern A | | | | | | CASE_SENSITIVE = true | is NOT followed by the | | | | | | NEGATIVE_LOOKAHEAD_MESSAGE = | user-supplied regex pattern B | | | | | | Match found: | | | | | | | '<PRIMARY_SEARCH_STRING>' is | | | | | | | not followed by | | | | | | | '<LOOKAHEAD_SEARCH_STRING>' in | | | | | | | Changeset '<CHANGESET>'. | | | | | | | STRIP_COMMENTS = true | | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | PatternANotPrecededByPatternB | changelog | disabled | 1 | PRIMARY_SEARCH_STRING = null | Check triggers if the | | | | | | LOOKBEHIND_SEARCH_STRING = | user-supplied regex pattern A | | | | | | null | is NOT preceded by the | | | | | | CASE_SENSITIVE = true | user-supplied regex pattern B | | | | | | NEGATIVE_LOOKBEHIND_MESSAGE = | | | | | | | Match found: | | | | | | | '<LOOKBEHIND_SEARCH_STRING>' | | | | | | | is not preceded by | | | | | | | '<PRIMARY_SEARCH_STRING>' in | | | | | | | Changeset '<CHANGESET>'. | | | | | | | STRIP_COMMENTS = true | | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | TableColumnLimit | changelog, | enabled | 1 | MAX_COLUMNS = 50 | Ensures that no table has more | | | database | | | | than a threshold number of | | | | | | | columns. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | MaxAffectedRowsAllowedDelete | changelog | enabled | 1 | MAX_ROWS = 50 | This checks triggers when the | | | | | | MESSAGE = <AFFECTED_ROWS> rows | Max Affected Rows Allowed | | | | | | will be affected, which is | value is exceeded by the | | | | | | more than the allowed | number of rows DELETED by a | | | | | | '<THRESHOLD>' rows. The SQL | SQL statement. The SQL | | | | | | statement is '<STATEMENT>' in | statement is executed against | | | | | | '<CHANGESET>'. | the database, and then rolled | | | | | | | back. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | MaxAffectedRowsAllowedInsert | changelog | enabled | 1 | MAX_ROWS = 50 | This checks triggers when the | | | | | | MESSAGE = <AFFECTED_ROWS> rows | Max Affected Rows Allowed | | | | | | will be affected, which is | value is exceeded by the | | | | | | more than the allowed | number of rows INSERTED by a | | | | | | '<THRESHOLD>' rows. The SQL | SQL statement. The SQL | | | | | | statement is '<STATEMENT>' in | statement is executed against | | | | | | '<CHANGESET>'. | the database, and then rolled | | | | | | | back. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | MaxAffectedRowsAllowedUpdate | changelog | enabled | 1 | MAX_ROWS = 50 | This checks triggers when the | | | | | | MESSAGE = <AFFECTED_ROWS> rows | Max Affected Rows Allowed | | | | | | will be affected, which is | value is exceeded by the | | | | | | more than the allowed | number of rows UPDATED by a | | | | | | '<THRESHOLD>' rows. The SQL | SQL statement. The SQL | | | | | | statement is '<STATEMENT>' in | statement is executed against | | | | | | '<CHANGESET>'. | the database, and then rolled | | | | | | | back. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | ObjectNameMustMatch | changelog, | disabled | 1 | OPERATOR = STARTS_WITH | This check confirms the listed | | | database | | | SEARCH_STRING = null | object names conform to the | | | | | | OBJECT_TYPES = null | supplied pattern. | | | | | | CASE_SENSITIVE = true | | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | ObjectNameMustNotMatch | changelog, | disabled | 1 | OPERATOR = STARTS_WITH | This check confirms the listed | | | database | | | SEARCH_STRING = null | object names do not match the | | | | | | OBJECT_TYPES = null | supplied pattern. | | | | | | CASE_SENSITIVE = true | | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | SqlGrantSpecificPrivsWarn | changelog | disabled | 1 | PRIVILEGE_LIST = null | This check warns a user when | | | | | | STRIP_COMMENTS = true | changeset includes or | | | | | | | generates sql that grants | | | | | | | specific privileges to a user | | | | | | | or role | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | CheckRunInTransactionValue | changelog | enabled | 1 | RUN_IN_TRANSACTION_VALUE = | This check triggers when a | | | | | | false | changeset contains the | | | | | | MESSAGE = A match for regular | user-specified | | | | | | expression <SEARCH_STRING> was | runInTransactions value of | | | | | | detected in Changeset | 'true' or 'false'. Note: | | | | | | <CHANGESET>. | Changesets without a | | | | | | | runInTransactions value are | | | | | | | not checked. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | ChangeTruncateTableWarn | changelog | enabled | 1 | <None> | This check warns a user when a | | | | | | | table is being truncated so | | | | | | | that they can ensure that | | | | | | | truncating the table won't | | | | | | | lead to unintentional loss of | | | | | | | data. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | SqlGrantOptionWarn | changelog | enabled | 1 | <None> | This check warns a user when | | | | | | | SQL contains 'GRANT' | | | | | | | statements that include the | | | | | | | 'WITH GRANT OPTION' clause so | | | | | | | that they can ensure that the | | | | | | | privilege being granted won't | | | | | | | lead to security issues | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | OracleReservedKeywords | changelog, | disabled | 1 | OBJECT_TYPES = null | Disallow Oracle reserved | | | database | | | ALLOWED_LIST = null | keywords from being used in | | | | | | CASE_SENSITIVE = true | database object names. See | | | | | | | https://docs.oracle.com/cd/B19 | | | | | | | 306_01/em.102/b40103/app_oracl | | | | | | | e_reserved_words.htm for | | | | | | | complete list of keywords. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | SQLServerReservedKeywords | changelog, | disabled | 1 | OBJECT_TYPES = null | Disallow SQL Server reserved | | | database | | | ALLOWED_LIST = null | keywords from being used in | | | | | | CASE_SENSITIVE = true | database object names. See | | | | | | | https://docs.microsoft.com/en- | | | | | | | us/sql/t-sql/language-elements | | | | | | | /reserved-keywords-transact-sq | | | | | | | l?view=sql-server-ver16 for | | | | | | | complete list of keywords. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | SQLServerFutureReservedKeywords | changelog, | disabled | 1 | OBJECT_TYPES = null | Disallow SQL Server's future | | | database | | | ALLOWED_LIST = null | reserved keywords from being | | | | | | CASE_SENSITIVE = true | used in database object names. | | | | | | | See | | | | | | | https://docs.microsoft.com/en- | | | | | | | us/sql/t-sql/language-elements | | | | | | | /reserved-keywords-transact-sq | | | | | | | l?view=sql-server-ver16 for | | | | | | | complete list of keywords. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | PostgresReservedKeywords | changelog, | disabled | 1 | OBJECT_TYPES = null | Disallow Postgres reserved | | | database | | | ALLOWED_LIST = null | keywords from being used in | | | | | | CASE_SENSITIVE = true | database object names. See | | | | | | | https://www.postgresql.org/doc | | | | | | | s/14/sql-keywords-appendix.htm | | | | | | | l for complete list of | | | | | | | keywords. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | SQLServerODBCReservedKeywords | changelog, | disabled | 1 | OBJECT_TYPES = null | Disallow SQL Server's ODBC | | | database | | | ALLOWED_LIST = null | reserved keywords from being | | | | | | CASE_SENSITIVE = true | used in database object names. | | | | | | | See | | | | | | | https://docs.microsoft.com/en- | | | | | | | us/sql/t-sql/language-elements | | | | | | | /reserved-keywords-transact-sq | | | | | | | l?view=sql-server-ver16 for | | | | | | | complete list of keywords. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | PostgresNonReservedKeywords | changelog, | disabled | 1 | OBJECT_TYPES = null | Disallow Postgres non-reserved | | | database | | | ALLOWED_LIST = null | keywords from being used in | | | | | | CASE_SENSITIVE = true | database object names. See | | | | | | | https://www.postgresql.org/doc | | | | | | | s/14/sql-keywords-appendix.htm | | | | | | | l for complete list of | | | | | | | keywords. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | SqlGrantAdminWarn | changelog | enabled | 1 | <None> | This check warns a user when | | | | | | | SQL contains 'GRANT' | | | | | | | statements that include the | | | | | | | 'WITH ADMIN OPTION' clause so | | | | | | | that they can ensure that the | | | | | | | privilege being granted won't | | | | | | | lead to security issues | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | DetectChangeType | changelog | enabled | 1 | CHANGE_TYPE_LIST = | This check warns a user when a | | | | | | dropTable,dropColumn | ChangeSet includes a | | | | | | | ChangeType listed by the user | | | | | | | as forbidden | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | RollbackRequired | changelog | enabled | 1 | <None> | This check triggers when a | | | | | | | changeset does not have a | | | | | | | rollback defined. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | ChangesetLabelCheck | changelog | enabled | 1 | <None> | This check enforces the | | | | | | | Liquibase recommendation that | | | | | | | labels be assigned to each | | | | | | | changeset to provide better | | | | | | | deployment control and to | | | | | | | enhance traceability of | | | | | | | efforts across changesets. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | ChangesetContextCheck | changelog | enabled | 1 | <None> | This check enforces the | | | | | | | Liquibase recommendation that | | | | | | | contexts be assigned to each | | | | | | | changeset to provide better | | | | | | | deployment control and to | | | | | | | enhance traceability of | | | | | | | efforts across changesets. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | ChangesetCommentCheck | changelog | enabled | 1 | <None> | This check enforces the | | | | | | | Liquibase recommendation that | | | | | | | comments be added to each | | | | | | | changeset to document the | | | | | | | purpose of a changeset for | | | | | | | other/future consumers of this | | | | | | | changelog | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | OneChangePerChangeset | changelog | enabled | 1 | <None> | This check enforces the | | | | | | | Liquibase Best Practice of | | | | | | | keeping individual changesets | | | | | | | small by limiting them to one | | | | | | | statement or change. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | UserDefinedLabelCheck | changelog | disabled | 1 | OPERATOR = STARTS_WITH | This check confirms that a | | | | | | SEARCH_STRING = null | specific label or a label that | | | | | | | matches a specific pattern is | | | | | | | present on all changesets. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | UserDefinedContextCheck | changelog | disabled | 1 | OPERATOR = STARTS_WITH | This check confirms that a | | | | | | SEARCH_STRING = null | specific context or a context | | | | | | | that matches a specific | | | | | | | pattern is present on all | | | | | | | changesets. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | PrimaryKeyOnCreateTable | changelog | enabled | 1 | EXCEPTIONS_LIST = | This check warns when a create | | | | | | CASE_SENSITIVE = true | table action doesn't also | | | | | | | include a primary key. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | CheckTablesForIndex | database | enabled | 1 | <None> | This check scans your target | | | | | | | URL database tables to find | | | | | | | tables which do not have an | | | | | | | associated index. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | TableCommentCheck | changelog, | enabled | 1 | <None> | With database-scope, this | | | database | | | | check flags any table which | | | | | | | does not have a comment. With | | | | | | | changelog-scope, this check | | | | | | | triggers on changesets with a | | | | | | | CREATE table changetype that | | | | | | | does not also add a comment | | | | | | | for the table in that same | | | | | | | changeset. (Note: This is not | | | | | | | a check for a Liquibase | | | | | | | changelog comment.) | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | TableCommentPatternCheck | changelog, | disabled | 1 | OPERATOR = CONTAINS | This check triggers when | | | database | | | SEARCH_STRING = null | specific user-supplied | | | | | | MESSAGE = A match for regular | patterns are found in Table | | | | | | expression <SEARCH_STRING> was | Comments. | | | | | | detected in <IDENTIFIER>. | | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | ChainedChecksTemplate | changelog, | disabled | 1 | LOGIC_CONDITIONAL = null | This check triggers when the | | | database | | | MESSAGE = The conditions in | logic conditional evaluates to | | | | | | '<chained checks shortname>' | true | | | | | | were met for '<logic | | | | | | | conditional>'. The chained | | | | | | | checks include <checknames>. | | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | ConstraintMustExist | database | disabled | 1 | CONSTRAINT_OPERATOR = | Check for and alert when | | | | | | STARTS_WITH | specified table does not | | | | | | TABLE_NAME = null | contain the required | | | | | | COLUMN_NAME = null | constraint(s). | | | | | | CONSTRAINT = PRIMARYKEY | | | | | | | CASE_SENSITIVE = true | | | | | | | MESSAGE = The specified table | | | | | | | '<TABLE_NAME>' does not | | | | | | | contain the required | | | | | | | '<CONSTRAINT>' constraint. | | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ | RequireChangesetIDisUUID | changelog | enabled | 1 | <None> | Alerts when a changeset ID | | | | | | | does not follow the 8-4-4-4-12 | | | | | | | pattern of UUID or GUID. | +-------------------------------------+------------+----------+----------+--------------------------------+--------------------------------+ Liquibase command 'checks bulk-set' was executed successfully.