pixi-policy

Write down what your pixi environments are allowed to contain, and check it everywhere pixi runs. One file, pixi-policy.toml, committed beside pixi.toml and pixi.lock; one command, pixi policy, that reports every package, source, license or manifest setting the policy does not allow, with the reason and a fix hint, and exits non-zero so CI can stop the merge.

pixi policy init     # write a policy the workspace passes today
pixi policy          # check it (the same as `pixi policy check`)
pixi policy explain  # every rule; `pixi policy explain <RULE>` for one, with its keys and defaults

It reads three files and nothing else: no server, no database, no network. Every check runs offline.

What it checks

# pixi-policy.toml
[sources]
allowed-channels = ["conda-forge"]
allowed-indexes = ["https://pypi.org/simple"]

[bans]
deny = [
  { name = "pycrypto", reason = "unmaintained", use-instead = "pycryptodome" },
  { name = "openssl", version = "<3", reason = "EOL" },
]

[licenses]
deny = ["GPL-3.0-*", "AGPL-*"]

[manifest]
required-platforms = ["linux-64", "osx-arm64", "win-64"]

[lock]

[[waivers]]
rule = "licenses.deny"
package = "readline"
reason = "dev only; LEGAL-1234"
expires = 2027-03-31

That policy, checked against one of the repository's example workspaces (an excerpt):

error[licenses.deny] ld_impl_linux-64 2.46.1: license GPL-3.0-only cannot be satisfied without a denied license
  --> pixi.lock: environment "default", linux-64
  = help: replace the package, or take the license off [licenses] deny

error[manifest.wildcard-spec] gh: is given as "*" in [dependencies]
  --> pixi.toml:11
  = help: give it a version range, for example the one `pixi add` writes

waived[licenses.deny] readline 8.3: license GPL-3.0-only cannot be satisfied without a denied license (pixi.lock: environment "default", linux-64); waiver: dev only; LEGAL-1234, expires 2027-03-31

4 errors, 0 warnings, 2 waived in 45 packages across 2 environment-platform pairs

Install

uv tool install pixi-policy     # or: pipx install pixi-policy, pip install pixi-policy

The wheel carries only the pixi-policy binary, for Linux (x86-64 and aarch64, glibc and musl), macOS and Windows. pixi runs any pixi-<name> executable on PATH as pixi <name>. Release archives with build provenance are on GitHub Releases.

In CI

The exit code is the verdict: 0 nothing failed, 1 a finding is an error, 2 an input could not be read. --format json writes a report with a published schema, and --format sarif one for GitHub code scanning:

- run: pixi run policy --format sarif --output policy.sarif
- uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: policy.sarif

Documentation

https://aesir-oss.github.io/pixi-ext-contrib/pixi-policy/: getting started, development and CI, every rule, every key, with its values and default, waivers and output formats.

Part of pixi-ext-contrib, with pixi-sbom. Apache-2.0. A community project, not affiliated with prefix.dev.