Skip to main content

​
Overview

Package and manifest policies help teams govern dependency usage. They use allow and deny rules scoped to the workspace, organizations, repositories, or applications. Package policies evaluate package and package version data. Manifest policies evaluate manifest file metadata.

​
Package allow and deny policies

Package policies support a default action and optional package rules. Package rules can match on:
  • Package URL (purl)
  • Package name
  • Namespace
  • Package type
  • Version range
Rules can also set an enforcement mode for their scope.

​
Package decisions

Package decisions are explicit package-level decisions for a policy. Supported decision values are: Package decisions can include a version range and reason.

​
Manifest allow and deny policies

Manifest policies support allow and deny rules for dependency files. Manifest rules can match on:
  • Manifest type
  • Language
  • Manifest file path
  • Lock file path
Manual review is available for package policies through the review default action. Manifest policies support allow and deny.

​
Scopes

Package and manifest rules can be scoped to:
  • Workspace
  • Organization
  • Repository
  • Application
More specific policy scopes can override broader policy defaults.

​
Current dependency evidence

Cysmiq evaluates package-version and manifest evidence separately for each repository. When repositories share an application or environment, each repository keeps its own violation state. Removing a manifest, reference, or dependency relationship resolves the affected repository’s violation without changing an active violation for the same target in another repository.