dennisdoomen / packageguard / 36341330678

81%

Build Type

push

github

Committed by web-flow

Commit Message

Let policies gate on risk scores, package age, and other risk signals (#262)

* Let policies gate on risk scores, package age, and other risk signals

Adds risk-based deny rules (overall/legal/security/operational risk
thresholds, max OSV severity, deny-unsigned/deprecated/without-repository,
and per-ecosystem minimum package age), auto-triggering risk enrichment
when a policy needs it even without --report-risk. Risk exceptions let a
specific package (optionally version-pinned, with an optional expiry) be
excluded from risk-based denial without loosening the policy globally.

Also generalizes warn-only handling: a new warn list mirrors deny's
package/license/prerelease matching but only logs a warning, and
--treat-deny-as-warning (or PACKAGEGUARD_DENY_AS_WARNING) downgrades deny
violations to warnings at runtime. PolicyViolation now carries the
triggering rule's rationale. The explain command was updated so it stays
accurate for packages only affected by these new rules.

Closes #212

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Document risk-based policy gating, risk exceptions, and the warn list

Adds a "Gating on risk and package age" section to the configuration
docs covering the new deny fields, risk exceptions, the warn list, and
--treat-deny-as-warning, cross-links it from the risk metrics page,
mentions it in the README feature list, and removes the now-implemented
items from the roadmap.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Address InspectCode findings on the risk-gating changes

- Make RiskException, WarnList and DenyList.MinPackageAgeDays properties
  init-only/get-only where they're never reassigned after construction
- Actually surface RiskException.Reason/SourceFile (explain now describes
  why a package was excluded and from which config file), instead of
  leaving those accessors unused
- Rename a lambda parameter in ProjectAnalyzer that shadowed the method's
  own projectPath parameter
- Merge Pro... (continued)

Coverage Stats

2301 of 3072 branches covered (74.9%)

Branch coverage included in aggregate %.

315 of 378 new or added lines in 16 files covered. (83.33%)

6 existing lines in 2 files now uncovered.

7031 of 8269 relevant lines covered (85.03%)

1917.89 hits per line