{"record":{"id":"efaae1584f4c71d5","repo":"anomalyco/sst","slug":"errpolicyconfigerror","errorCode":"ErrPolicyConfigError","errorMessage":"policy configuration error","messagePattern":"policy configuration error","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/project/stack.go","lineNumber":123,"sourceCode":"\tStage   string\n\tConfig  string\n\tCommand string\n\tVersion string\n}\n\ntype Error struct {\n\tMessage string   `json:\"message\"`\n\tURN     string   `json:\"urn\"`\n\tHelp    []string `json:\"help\"`\n}\n\nvar ErrStackRunFailed = fmt.Errorf(\"stack run had errors\")\nvar ErrStageNotFound = fmt.Errorf(\"stage not found\")\nvar ErrPassphraseInvalid = fmt.Errorf(\"passphrase invalid\")\nvar ErrProtectedStage = fmt.Errorf(\"cannot remove protected stage\")\nvar ErrProtectedDevStage = fmt.Errorf(\"cannot run sst dev on protected stage\")\nvar ErrPolicyViolation = fmt.Errorf(\"policy violations detected\")\nvar ErrPolicyConfigError = fmt.Errorf(\"policy configuration error\")\n\nfunc (p *Project) ResolvePolicyPackPath(policyPath string) (string, error) {\n\tvar resolvedPath string\n\tif filepath.IsAbs(policyPath) {\n\t\tresolvedPath = policyPath\n\t} else {\n\t\tresolvedPath = filepath.Join(p.PathRoot(), policyPath)\n\t}\n\n\tif _, err := os.Stat(resolvedPath); err != nil {\n\t\treturn \"\", fmt.Errorf(\"Policy pack not found in path: %v\", resolvedPath)\n\t}\n\n\treturn resolvedPath, nil\n}\n\nfunc (p *Project) Lock(command string) (*provider.Update, error) {\n\treturn provider.Lock(p.home, p.Version(), command, p.app.Name, p.app.Stage)","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/pkg/project/stack.go#L105-L141","documentation":"ErrPolicyConfigError is returned by Project.Run when a policy pack was requested via --policy-path but the policy engine produced no policy events and no stack errors, while the command still exited non-zero. It signals the policy setup itself is broken (e.g. the pack could not be loaded/executed), rather than actual violations.","triggerScenarios":"In Project.Run: hasPolicyFlag (input.PolicyPath != \"\") is true, hasPolicyEvents is false, len(errors) == 0, and cmd.ProcessState.ExitCode() > 0 (pkg/project/run.go:691-693). Also ResolvePolicyPackPath (pkg/project/stack.go:125-138) fails when the configured policyPath does not exist on disk after joining with the project root.","commonSituations":"Typo in the --policy-path argument or the pack folder moved/renamed; running sst from a different working directory so a relative policy path resolves to the wrong location; policy pack missing PulumiPolicy.yaml or an incompatible Node/Python runtime inside the pack.","solutions":["Fix the --policy-path value or move the policy pack so that <project-root>/<policyPath> exists (absolute paths are used as-is; relative paths resolve against the project root, see pkg/project/stack.go:127-131).","Verify the pack contains a valid PulumiPolicy.yaml and its runtime dependencies are installed (e.g. `bun install`/`npm install` inside the pack).","Test the pack standalone with `pulumi policy run` or a plain `sst deploy --policy-path <abs path>` to isolate the issue.","If the policy check is optional locally, omit --policy-path so the flag (and thus this error path) is not triggered."],"exampleFix":"// before\nsst deploy --policy-path ./policies/por\n// after — corrected path to the existing pack\nsst deploy --policy-path ./policies/pack","handlingStrategy":"validation","validationCode":"const fs = require(\"fs\");\nconst path = require(\"path\");\n// Mirror ResolvePolicyPackPath: absolute used as-is, relative joined to project root\nconst resolved = path.isAbsolute(policyPath)\n  ? policyPath\n  : path.join(projectRoot, policyPath);\nif (!fs.existsSync(resolved)) {\n  throw new Error(`Policy pack not found: ${resolved}`);\n}\nif (!fs.existsSync(path.join(resolved, \"PulumiPolicy.yaml\"))) {\n  throw new Error(`Missing PulumiPolicy.yaml in ${resolved}`);\n}","typeGuard":null,"tryCatchPattern":"err := project.Run(ctx, &project.StackInput{Command: \"deploy\", PolicyPath: policyPath})\nif errors.Is(err, project.ErrPolicyConfigError) {\n    log.Printf(\"policy pack configured but produced no events; check pack path '%s' and its PulumiPolicy.yaml\", policyPath)\n    return\n} else if err != nil {\n    return err\n}","preventionTips":["Commit the policy pack to the repo (or pin and download it in CI) so the path always exists.","Use absolute paths in CI invocations to avoid working-directory surprises.","Verify the pack loads by running a trivial diff with --policy-path after any pack change.","Never gitignore the policies directory used by deploy pipelines."],"tags":["sst","policy","configuration","path-resolution"],"backgroundTag":"policy-pack-not-found","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}