# SAMPLE — fictional supply-chain data. Every package, registry, version, hash, licence, advisory identifier and signature in this document is invented.

apiVersion: policy.orchard.example/v1
kind: AttestationPolicy
metadata:
  name: sample-release-policy

spec:
  requiredPredicates:
    - https://slsa.dev/provenance/v1
    - https://cyclonedx.org/bom
  builders:
    allowed: ["https://build.orchard.example/builders/hosted/v1"]
  slsa:
    minimumBuildLevel: 3
    requireVsa: true
  transparencyLog:
    required: true
    logIds: ["sample-rekor.orchard.example"]
  source:
    allowedRepositories: ["git+https://git.orchard.example/orchard/*"]
    requireTagProtection: true
  onFailure: block
  exceptions:
    - predicate: https://cyclonedx.org/bom
      until: 2026-04-01
      reason: SAMPLE grace period for the fictional pilot service