From dcb83dd29506fa6c73500213819929ca25ee01cb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gr=C3=A1inne=20Jennings?= Date: Tue, 19 May 2026 18:27:28 +0100 Subject: [PATCH 1/4] Updates to EA cooldown policy content. --- .../supply-chain-security/epm/cooldown-policy.mdx | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/content/supply-chain-security/epm/cooldown-policy.mdx b/src/content/supply-chain-security/epm/cooldown-policy.mdx index dc0d486c..847c3bd0 100644 --- a/src/content/supply-chain-security/epm/cooldown-policy.mdx +++ b/src/content/supply-chain-security/epm/cooldown-policy.mdx @@ -54,7 +54,7 @@ You can configure the following fields in your cooldown policy Rego: | Field | Description | | :---------------------------------- | :---------------------------------------------------------------------------------------------- | | **Policy name** | A display name for the cooldown policy. The default policy name can be customized as needed.

For package managers where enhanced 403 error messaging is supported, the policy name is returned with any 403 error. | -| **Policy description** | A description of the cooldown policy. The default policy description can be customized as needed.

For package managers where enhanced 403 error messaging is supported, the policy name is returned with any 403 error.| +| **Policy description** | A description of the cooldown policy. The default policy description can be customized as needed.

For package managers where enhanced 403 error messaging is supported, the policy description is returned with any 403 error.| | **Enabled** | Enable or disable the cooldown policy. | | **Repositories** | The repositories that the cooldown policy applies to. By default, the cooldown policy applies to all repositories in a workspace unless configured otherwise. | | **Formats** | The package formats the policy applies to. Currently supported: `npm`, `python`. | @@ -64,7 +64,7 @@ You can configure the following fields in your cooldown policy Rego: A cooldown policy is always set to **Terminal**, which prevents the evaluation of any further policies if this policy matches. This setting cannot be edited. Precedence for a cooldown policy is always set to `0`. -Policies within an organization are ordered based on the precedence integer defined in each policy. The policy with the lowest number is evaluated first, then each remaining policy is evaluated in order of ascending precedence. +Policies within a workspace are ordered based on the precedence integer defined in each policy. The policy with the lowest number is evaluated first, then each remaining policy is evaluated in order of ascending precedence. This setting cannot be edited. ## The developer experience @@ -93,10 +93,10 @@ For supported package managers, Cloudsmith returns a customizable error message The message includes: - **Policy name**: The name of the cooldown policy that matched the package. -- **Policy description**: The policy description field, which you can use to include internal guidance — for example, who to contact, a link to the exemption process, or a link to internal documentation. +- **Policy description**: The policy description field, which you can use to include internal guidance — for example, who to contact, or a link to internal documentation. - **Policy ID**: The unique identifier for the policy action, for reference and troubleshooting. -#### Supported package managers: +#### Supported package managers - uv (Python) - npm @@ -119,7 +119,7 @@ When created from a template, your cooldown policy is disabled by default. 5. Customize the policy options. For guidance on which policy options are configurable, see [Policy configuration](#policy-configuration). 6. Click **Save policy** to save and apply your changes. -After the policy is created, it might take a few minutes to take effect on packages in your workspace. +After the policy is created, it might take a few minutes to take effect on packages that are already cached in your workspace. From 08723b27e7ce465e9b271c4bd770f36cc696d67d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gr=C3=A1inne=20Jennings?= Date: Tue, 19 May 2026 18:44:47 +0100 Subject: [PATCH 2/4] Removing white space. --- .../supply-chain-security/epm/cooldown-policy.mdx | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/content/supply-chain-security/epm/cooldown-policy.mdx b/src/content/supply-chain-security/epm/cooldown-policy.mdx index 847c3bd0..61891467 100644 --- a/src/content/supply-chain-security/epm/cooldown-policy.mdx +++ b/src/content/supply-chain-security/epm/cooldown-policy.mdx @@ -3,7 +3,7 @@ import hiddenPackageToast from '../images/hidden-pkg-explainer.png' import hiddenPackageSearch from '../images/view-hidden-packages.png' import cooldownPolicyView from '../images/cooldown-policy-view.png' -# Cooldown Policy +# Cooldown policy The cooldown policy feature is in early access. To try this feature, please [contact us](https://cloudsmith.com/company/contact-us). @@ -54,7 +54,7 @@ You can configure the following fields in your cooldown policy Rego: | Field | Description | | :---------------------------------- | :---------------------------------------------------------------------------------------------- | | **Policy name** | A display name for the cooldown policy. The default policy name can be customized as needed.

For package managers where enhanced 403 error messaging is supported, the policy name is returned with any 403 error. | -| **Policy description** | A description of the cooldown policy. The default policy description can be customized as needed.

For package managers where enhanced 403 error messaging is supported, the policy description is returned with any 403 error.| +| **Policy description** | A description of the cooldown policy. The default policy description can be customized as needed.

For package managers where enhanced 403 error messaging is supported, the policy description is returned with any 403 error. | | **Enabled** | Enable or disable the cooldown policy. | | **Repositories** | The repositories that the cooldown policy applies to. By default, the cooldown policy applies to all repositories in a workspace unless configured otherwise. | | **Formats** | The package formats the policy applies to. Currently supported: `npm`, `python`. | @@ -63,8 +63,8 @@ You can configure the following fields in your cooldown policy Rego: A cooldown policy is always set to **Terminal**, which prevents the evaluation of any further policies if this policy matches. This setting cannot be edited. - Precedence for a cooldown policy is always set to `0`. -Policies within a workspace are ordered based on the precedence integer defined in each policy. The policy with the lowest number is evaluated first, then each remaining policy is evaluated in order of ascending precedence. + Precedence for a cooldown policy is always set to `0`. +Policies within a workspace are ordered based on the precedence integer defined in each policy. The policy with the lowest number is evaluated first, then each remaining policy is evaluated in order of ascending precedence. This setting cannot be edited. ## The developer experience @@ -183,6 +183,7 @@ A cooldown policy can also be created and managed via the Cloudsmith API by usin - [Partially update a policy](https://docs.cloudsmith.com/api/workspaces/policies/partial-update) - [List policies](https://docs.cloudsmith.com/api/workspaces/policies/list) - [Retrieve a policy](https://docs.cloudsmith.com/api/workspaces/policies/retrieve) +- [Delete a policy](https://docs.cloudsmith.com/api/workspaces/policies/destroy) As with the web app, only the fields listed in [Policy configuration](#policy-configuration) can be edited via the API. From 6bf1567af83ff1347f4ac125fe0cbf6b14c33528 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gr=C3=A1inne=20Jennings?= Date: Tue, 19 May 2026 18:51:46 +0100 Subject: [PATCH 3/4] Wording update for create policy. --- src/content/supply-chain-security/epm/cooldown-policy.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/supply-chain-security/epm/cooldown-policy.mdx b/src/content/supply-chain-security/epm/cooldown-policy.mdx index 61891467..44844aaa 100644 --- a/src/content/supply-chain-security/epm/cooldown-policy.mdx +++ b/src/content/supply-chain-security/epm/cooldown-policy.mdx @@ -119,7 +119,7 @@ When created from a template, your cooldown policy is disabled by default. 5. Customize the policy options. For guidance on which policy options are configurable, see [Policy configuration](#policy-configuration). 6. Click **Save policy** to save and apply your changes. -After the policy is created, it might take a few minutes to take effect on packages that are already cached in your workspace. +After the policy is created and enabled, it might take a few minutes to take effect on packages that are already cached in your workspace. From ab152530f4acaf2663b387fd96861ead93aa20da Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gr=C3=A1inne=20Jennings?= Date: Thu, 21 May 2026 10:20:19 +0100 Subject: [PATCH 4/4] In flight changes. --- src/content/supply-chain-security/epm/cooldown-policy.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/content/supply-chain-security/epm/cooldown-policy.mdx b/src/content/supply-chain-security/epm/cooldown-policy.mdx index 44844aaa..89c450e2 100644 --- a/src/content/supply-chain-security/epm/cooldown-policy.mdx +++ b/src/content/supply-chain-security/epm/cooldown-policy.mdx @@ -32,10 +32,10 @@ When a cooldown policy is enabled, packages that do not meet the configured age - Packages already cached in Cloudsmith are quarantined and hidden from the index until the cooldown period elapses. Once the cooldown period expires, the package is unquarantined and becomes available for download and visible in the index, provided it does not violate any other active policies. -You can exclude upstream packages that are already cached in your Cloudsmith workspace from the policy scope by unchecking the **Apply to packages already in use** option in the **Edit policy** view. +You can exclude packages that are already cached in your Cloudsmith workspace from the policy scope by unchecking the **Apply to packages already in use** option in the **Edit policy** view. -Decision logs for a cooldown policy are only generated for upstream packages that are already in your Cloudsmith workspace. They are accessible via the Cloudsmith web app and the Cloudsmith API. +Decision logs for a cooldown policy are only generated for packages that are already in your Cloudsmith workspace. They are accessible via the Cloudsmith web app and the Cloudsmith API. Cloudsmith determines a package's age by using metadata retrieved from the upstream source. Where package age metadata is not populated, the cooldown policy will fail open, meaning the package will not be hidden from the index.