Enforce dependency policy

Open Dependencies (SCA) → Reports → Policy & Compliance. The Security Policy tab manages repository rules; the Compliance Mapping tab maps the latest dependency evidence to supported framework controls.

Evaluate the latest dependency scan

Select a repository with a completed SCA scan, then choose Run Policy Check. CodeStax evaluates the repository’s active rules against the latest SCA findings and dependency inventory.

The corresponding API is:


GET /api/sca/policy-check/{repository_id}

The response reports passed, blocking violations, advisory warnings, passed or disabled rules, the evaluated scan_id, and the policy name. The route returns JSON; it does not use an HTTP 403 response to represent a policy violation.

Manage rules through the API


GET /api/sca/policy/{repository_id}
POST /api/sca/policy/{repository_id}

Each rule has these fields:

Field	Purpose
`id`	Stable identifier used for merging policy-as-code rules
`name` and `description`	Customer-facing context
`condition_type`	`severity`, `license`, `age`, `epss`, `kev`, `package`, `cvss`, `outdated_pct`, or `direct_vuln`
`operator`	Comparison such as `==`, `>`, `>=`, `in`, or `contains`
`value`	Threshold or match value
`action`	`block`, `warn`, or `allow`
`enabled`	Whether the rule is evaluated

The default policy blocks critical vulnerabilities, CISA Known Exploited Vulnerabilities, high CVSS scores, and selected licenses; it warns on high EPSS scores and high outdated-dependency percentages. Review the current API response rather than assuming defaults have not been customized.

Store dependency policy in the repository

CodeStax recognizes .codestax-policy.yml and .codestax-policy.yaml at the repository root. File rules replace matching database rules by id and append new IDs.


# .codestax-policy.yml
name: Repository dependency policy
fail_on_violation: true
rules:
  - id: critical-vulnerabilities
    name: Block critical vulnerabilities
    description: Do not accept critical dependency findings
    condition_type: severity
    operator: "=="
    value: critical
    action: block
    enabled: true
  - id: high-epss
    name: Warn on high exploit probability
    description: Review vulnerabilities with EPSS above 0.5
    condition_type: epss
    operator: ">"
    value: 0.5
    action: warn
    enabled: true

Validate the checked-out policy file with:


POST /api/sca/policy-file/{repository_id}/validate

The dependency policy file is distinct from .codestax/quality_gate.yaml, which controls the code-quality gate. Use the filename and schema for the product area you intend to govern.

Use the CI/CD policy check

The SCA CI/CD gate uses its own organization policy routes:


GET /api/sca/cicd/policy
PUT /api/sca/cicd/policy
POST /api/sca/cicd/check

Use POST /api/sca/cicd/check when a pipeline needs an explicit pass/fail evaluation. Use the badge route to display the latest SCA state:


![CodeStax dependency status](https://codestax.co/api/sca/cicd/badge/<repository_id>)

Interpret compliance mapping

The compliance tab calls GET /api/sca/compliance/{repository_id} and shows evidence-derived control status. It is supporting audit evidence, not certification or an independent compliance opinion. For organization-wide framework configuration and reports, see Compliance dashboard.