version: POLICY_VERSION_V2
type: POLICY_TYPE_DENY
name: Example Deny Policy
labels:
- example
- default=deny
rules:
- name: Deny High or Critical Vulnerabilities
description: This policy denies packages with high or critical vulnerabilities
check: RULE_CHECK_VULNERABILITY
value: |
pkg.vulnerabilities.exists(vuln, vuln.severity in ['HIGH', 'CRITICAL'])
# - name: Direct Dependency Popularity
# description: Direct dependencies should have 100 or more stars
# check: RULE_CHECK_POPULARITY
# value: |
# (pkg.attributes.direct == true) &&
# pkg.projects.exists(p, p.project.type == ProjectSourceType.GITHUB && p.stars < 100)
