Configure release policy

Create the repository policy

The file requires version: 1. Fendix loads .fendix.yaml from the current directory unless --config selects another file.

version: 1
fail_on: HIGH
scan:
  enable_active: false
  enforce_confidence: true

Understand precedence

Higher layers win. This keeps the reviewed repository policy as the default while allowing an explicit invocation to override it.

1. 01Built-in defaults
2. 02.fendix.yaml
3. 03Explicit CLI flags

Keep runtime requirements on the command

Strict coverage controls such as --fail-on-coverage-gap and --require-analyzers are intentionally not fields in schema version: 1. Targets, credentials, baselines, and output paths are also runtime concerns.

Why does this work this way?

Read Policy and confidence. Use Require coverage for coverage gates. The configuration reference and scan policy options define the exact contract.