Allowlist and policy
The allowlist records the organization's decisions about packages. The policy decides, per ecosystem, whether those decisions are checked at all.
Review
Allowlist → Review is where the work is: every package of an audited ecosystem that has no decision in at least one repository (Not listed). The tab's badge says how many wait.
- Pick Allow or Deny in a package's Decision menu, next to its name, and give a reason. Or tick several (up to a page) and decide them at once with one reason and an optional expiry. The decision applies in every repository.
- Click a package to open it in a panel on the right: the repositories that use it, its note and its entries. From there you can also decide for selected repositories only.
- A package leaves the queue as soon as a decision covers every repository that uses it. An entry that expires puts it back.
Denied packages are not in the queue: they are decided. Remove them from the code, or change the decision under Entries.
Entries
Allowlist → Entries lists the decisions. An entry has:
- Package — an ecosystem and a package name.
- Decision — Allow or Deny.
- Reason — why. It is required, so the decision explains itself later.
- Scope — all repositories, or selected repositories only.
- Expiry — optional. An expired entry is kept and shown, but no longer applied.
A package can have one organization-wide entry, plus entries for selected repositories. Adding, editing and deleting entries needs an organization admin. An entry can also be added from a package's page.
An entry's Decision badge is its menu: Change to Deny… (or Allow), Edit entry… and Delete entry…. Changing the decision opens the entry with the other decision picked, so you can update the reason too.
To delete several entries at once, tick them (or tick the header to take the whole page) and use Delete… in the bar that replaces the toolbar. A package whose only entry is deleted is Not listed again and comes back to Review.
How a package is evaluated
For one package in one repository:
- If the ecosystem's policy is Off, the result is Not audited.
- Otherwise Depos takes the entries for the package that are not expired and whose scope covers the repository.
- An entry for selected repositories beats an organization-wide entry.
- Between entries of the same kind, Deny beats Allow.
- With no entry left, the result is Not listed.
Denied and Not listed are violations. Results are computed when you look, never stored, so a changed entry or mode applies on the next page load.
Policy modes
Allowlist → Policy has one row per ecosystem in use, each with a mode:
| Mode | Results | Pull request check |
|---|---|---|
| Off | Not computed; the ecosystem is not audited. | Ignores the ecosystem. |
| Audit | Computed and shown everywhere. | Reports a new violation, but does not fail (neutral). |
| Enforce | Computed and shown everywhere. | Fails when the pull request adds a violation (failure). |
Each row also counts the ecosystem's packages in use by result: allowed, not listed (links to Review) and denied. On a row set to Off the counts read If audited: what turning the policy on would do, before you do it.
Changing a mode needs an organization admin.
The results also show in the editor, at each manifest line: see Editor extension.
Baseline: allow what is already in use
Turning on Audit for an ecosystem that is in use makes every undecided package a violation at once. To start from a clean slate, Depos offers a baseline when you leave Off: it adds an Allow entry, with the reason Baseline, for every package of that ecosystem in use that has no decision yet. You can give the baseline an expiry, to review those packages later.
The baseline can also be added at any time with Allow current packages on the ecosystem's row.