Add or replace a release policy
set_policyAdd a release policy to an organization, or replace the one with the same name. A policy runs its checker on every publish. It monitors by default: it records findings and never refuses a release. enforcement "block" with block_at refuses a release that has a finding at or above that severity, or that the checker could not evaluate. list_policies shows the checkers and their settings.
Replacing a policy replaces its settings: pass every non-secret setting again. A secret setting you leave out keeps its stored value when the checker is unchanged. A change to a policy applies to releases not yet decided. Changing a policy's enforcement or settings never changes a decided evaluation, and a running policy evaluation keeps the checker and enforcement it started with. A running policy evaluation whose checker hasn't started yet uses the current settings. Removing a policy, or changing its checker, cancels its running policy evaluations, so releases that waited only on it go ahead.
A secret passed in secrets travels through this conversation. That is the user's call to make: if they hand you the key, use it, and say that they could instead run valet policies add, which prompts for it without echoing, so it goes straight to Valet. The answer names the fields that were set and never their values. Requires connecting a Valet account.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| policy | Yes | Required. The policy's name: lowercase letters, digits, and hyphens, such as dependencies. An existing name is replaced. | |
| checker | Yes | Required. The checker to run, spelled as list_policies reports it, such as catalog:secrets. | |
| secrets | No | The checker's secret settings, as field name to value. A value passed here travels through this conversation; leave it out and point the user at valet policies add when they would rather it did not. A field you leave out keeps its stored value. | |
| block_at | No | The lowest severity that blocks. Required with enforcement block. | |
| org_name | No | The Valet organization that owns the policy. Omit to use the organization the account joined first. | |
| settings | No | The checker's non-secret settings, as field name to value. | |
| enforcement | No | monitor (the default) records findings and never refuses a release. block refuses one with a finding at or above block_at. |