Restrict Unverified Orbs

Many customers do not use orbs because of the fear of malicious orbs running on their pipeline. With Config Policies, customers finely control which orbs an be used across an org.

Code Samples

Orb restriction policy

This policy will produce a hard fail if a user attempts to use an orb with a name not on an approved list.

Utilizing a policy like this can provide a number of benefits such as:

Controlling access to which orbs are used within an organization
Enabling customers to only use orbs from their own org (e.g private orbs)
Ensuring that orbs cannot be used from unverified sources

package org

import future.keywords
import data.circleci.config

# define policy name
policy_name["allowed_orbs"]

# checks for orbs with orgs that start with circleci or a client-org and fails any that doesn't meet the condition
use_allowed_orbs[orb] = reason {
    some orb, _ in config.orbs
    not startswith(orb, "circleci")
    not startswith(orb, "helix")
    reason := sprintf("%s is not an approved orb", [orb])
}

# https://circleci.com/docs/config-policy-management-overview/#enablement
# enables a rule and sets enforcement to hard_fail
enable_hard["use_allowed_orbs"]