SOOS allows you to create policies or rules around the packages and licenses you want (or don't want) included in your code.  Once a policy is created, a policy violation warning will be generated any time a scan detects a package that violates the policy.  Manage your open source risk by creating restrictions on the packages and licenses your team is pulling in through the SOOS policy engine. 

  • From your SOOS dashboard, select Governance from the left navigation.
  • Select Create a Policy.
  • In the Add a Policy modal, select the Policy Type you would like to create. 
  • For example - To create a policy that will generate violations when packages associated with particular licenses are detected, use the License Name policy type.
    • Select the license identifiers you want to prevent from being included in your project.
      • Each license name provides an external link to allow you to read the full text of the corresponding license.
  • Provide a name for the policy, and indicate the desired behavior for when the policy is violated.
    • You have the option to Fail on missing data (such as a missing license) or Fail scan if the policy is violated.
    • You can also opt not to fail, which is the default selection.
  • Finally, you will assign the policy to one or more projects, or set it as a global policy across all projects.
  • Saving a policy will add it to your Governance list.  From there, you can always edit or delete the policy.
  • Once a policy is created, SOOS will start to alert you of any policy violations found during subsequent project scans.