Repository: datreeio/datree
Pull request #784 (2022-09-11 18:08:42)

fix: same $HOME between install and uninstall
fixes issue https://github.com/datreeio/datree/issues/783.

hadar-co: hey @netanel-haber! thanks for the PR, left some comments:)
netanel-haber: > hey @netanel-haber! thanks for the PR, left some comments:)

I don't see any comments?
hadar-co: > > hey @netanel-haber! thanks for the PR, left some comments:)
> 
> I don't see any comments?

My bad, try now:)

Patch:
diff --git a/.github/workflows/files_existence.yml b/.github/workflows/files_existence.yml
index 8a680c1..7985f54 100644
--- a/.github/workflows/files_existence.yml
+++ b/.github/workflows/files_existence.yml
@@ -2,7 +2,7 @@ name: Files existence
 
 on:
   pull_request:
-    types: [opened, edited, synchronize, reopened]
+    types: [ opened, edited, synchronize, reopened ]
 
 jobs:
   file_existence:
@@ -15,5 +15,5 @@ jobs:
         id: check_files
         uses: andstor/file-existence-action@v1.1.0
         with:
-          files: "pkg/defaultRules/defaultRules.yaml"
+          files: "pkg/defaultRules/defaultRules.yaml, pkg/defaultPolicies/defaultPolicies.yaml"
           allow_failure: true
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
new file mode 100644
index 0000000..d8e6a46
--- /dev/null
+++ b/.github/workflows/pull_request.yml
@@ -0,0 +1,10 @@
+name: Pull Request Workflow
+
+on:
+  pull_request:
+
+jobs:
+  go_build_and_test:
+    uses: ./.github/workflows/reusable_go_build.yml
+    with:
+      goBuildTag: staging
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d45be50..e9b1532 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,8 +7,14 @@ on:
         required: true
 
 jobs:
+  go_build_and_test:
+    uses: ./.github/workflows/reusable_go_build.yml
+    with:
+      goBuildTag: main
+
   define_version_job:
     runs-on: ubuntu-latest
+    needs: [go_build_and_test]
     steps:
       - uses: actions/checkout@v2
       - id: define_version
@@ -21,17 +27,20 @@ jobs:
       version: ${{ steps.define_version.outputs.version }}
 
   release:
+    env:
+      GITHUB_ACTION_RUN_ID: ${{ github.run_id }}
+      GORELEASER_VERSION: 0.155.1
+      GITHUB_TOKEN: ${{ secrets.GIT_TOKEN }}
+      CLOUDFRONT_DISTRIBUTION_ID: ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID }}
     runs-on: ubuntu-latest
-    needs: define_version_job
+    needs: [ go_build_and_test, define_version_job ]
     steps:
       - uses: actions/checkout@v2
       - name: Extract branch name
         shell: bash
         run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/})"
         id: extract_branch
-      - env:
-          TRAVIS_API_TOKEN: ${{ secrets.TRAVIS_API_TOKEN }}
-        run: |
+      - run: |
           echo "Triggered by: ${{ github.actor }}!"
           branch_name=${{ steps.extract_branch.outputs.branch }}
           commit_sha=${{ github.sha }}
@@ -41,30 +50,42 @@ jobs:
               echo "Release should build only from main branch"
               exit 1
           fi
-          if [ -z "$TRAVIS_API_TOKEN" ]; then
-              echo "TRAVIS_API_TOKEN is empty"
-              exit 1
-          fi
+      - name: Setup Go environment
+        uses: actions/setup-go@v2.1.4
+        with:
+          go-version: 1.18
+      - name: GitHub Config Identity
+        run: |
+          git config --global user.email "ci@datree.io"
+          git config --global user.name "datree-ci"
+      - name: Set AWS credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: us-east-1
+      - name: Run deploy prod release file
+        env:
+          RELEASE_VERSION: ${{ needs.define_version_job.outputs.version }}
+        run: bash ./scripts/release.sh
+        shell: bash
 
-          REQUEST_BUILD_BODY="
-          {
-            \"request\": {
-              \"branch\": \"$branch_name\",
-              \"sha\": \"$commit_sha\",
-              \"merge_mode\": \"deep_merge_append\",
-              \"config\": {
-                \"env\": {
-                  \"global\": [
-                    \"RELEASE_DATREE_PROD=true\",
-                    \"RELEASE_VERSION=${{ needs.define_version_job.outputs.version }}\"
-                  ]
-                }
-              }
-            }
-          }
-          "
+  brew_push_formula:
+    name: Brew push formula
+    runs-on: ubuntu-latest
+    needs: [ release, define_version_job ]
+    env:
+      RELEASE_VERSION: ${{ needs.define_version_job.outputs.version }}
+      GITHUB_TOKEN: ${{ secrets.GIT_TOKEN }}
+    steps:
+      - uses: actions/checkout@v2
+      - name: GitHub Config Identity
+        run: |
+          git config --global user.email "ci@datree.io"
+          git config --global user.name "datree-ci"
+      - run: bash ./scripts/brew_push_formula.sh production ${{ env.RELEASE_VERSION }}
+        shell: bash
 
-          REQUEST_BUILD_BODY=$REQUEST_BUILD_BODY ./.github/workflows/request-travis-build-and-wait-until-finished.sh
   release-docker:
     env:
       REPO_NAME: datree
diff --git a/.github/workflows/release_candidate.yml b/.github/workflows/release_candidate.yml
new file mode 100644
index 0000000..26ee571
--- /dev/null
+++ b/.github/workflows/release_candidate.yml
@@ -0,0 +1,33 @@
+name: Release Candidate Workflow
+
+on:
+  push:
+    branches: ['main']
+env:
+  GITHUB_ACTION_RUN_ID: ${{ github.run_id }}
+  GITHUB_TOKEN: ${{ secrets.GIT_TOKEN }}
+  GORELEASER_VERSION: 0.155.1
+jobs:
+  go_build_and_test:
+    uses: ./.github/workflows/reusable_go_build.yml
+    with:
+      goBuildTag: staging
+
+  release_candidate:
+    name: Release candidate
+    runs-on: ubuntu-latest
+    needs: [go_build_and_test]
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup Go environment
+        uses: actions/setup-go@v2.1.4
+        with:
+          go-version: 1.18
+      - name: GitHub Config Identity
+        run: |
+          git config --global user.email "ci@datree.io"
+          git config --global user.name "datree-ci"
+      - name: Run deploy release candidate file
+        run: |
+          bash ./scripts/deploy_release_candidate.sh
+        shell: bash
diff --git a/.github/workflows/request-travis-build-and-wait-until-finished.sh b/.github/workflows/request-travis-build-and-wait-until-finished.sh
deleted file mode 100755
index 0f3bf9f..0000000
--- a/.github/workflows/request-travis-build-and-wait-until-finished.sh
+++ /dev/null
@@ -1,64 +0,0 @@
-#!/bin/bash
-
-GH_ORGANIZATION_NAME="datreeio"
-GH_REPOSITORY_NAME="datree"
-GH_SLUG=${GH_ORGANIZATION_NAME}%2F${GH_REPOSITORY_NAME}
-
-echo "Requesting a travis build..."
-
-request_build_response=$(curl -s -X POST \
-  -H "Content-Type: application/json" \
-  -H "Accept: application/json" \
-  -H "Travis-API-Version: 3" \
-  -H "Authorization: token ${TRAVIS_API_TOKEN}" \
-  -d "$REQUEST_BUILD_BODY" \
-  "https://api.travis-ci.com/repo/${GH_SLUG}/requests")
-
-REQUEST_ID=$(echo $request_build_response | jq '.request.id')
-
-echo "Travis request id: ${REQUEST_ID}"
-
-is_travis_build_already_created=false
-
-while true; do
-  sleep 10
-  echo "Polling travis build status..."
-
-  response=$(curl -s -X GET \
-    -H "Content-Type: application/json" \
-    -H "Accept: application/json" \
-    -H "Travis-API-Version: 3" \
-    -H "Authorization: token ${TRAVIS_API_TOKEN}" \
-    "https://api.travis-ci.com/repo/${GH_SLUG}/request/${REQUEST_ID}")
-
-  build_status=$(echo $response | jq '.builds[0].state')
-  build_request_state=$(echo $response | jq '.state')
-
-  if [ $build_request_state = "\"pending\"" ]; then
-    echo "Build request pending..."
-  elif [ $build_status = "\"passed\"" ]; then
-    echo "Travis build passed!"
-    exit 0
-  elif [ $build_status = "\"failed\"" ]; then
-    echo "Travis build failed!"
-    exit 1
-  elif [ $build_status = "\"canceled\"" ]; then
-    echo "Travis build canceled!"
-    exit 1
-  elif [ $build_status = "\"created\"" ]; then
-    if [ $is_travis_build_already_created = true ]; then
-      echo "Travis build queued..."
-    else
-      echo "Travis build created!"
-    fi
-    is_travis_build_already_created=true
-  elif [ $build_status = "\"started\"" ]; then
-    echo "Travis build in progress..."
-  else
-    echo "Travis build unknown state!"
-    echo "build_status:${build_status}"
-    echo "REQUEST_ID:${REQUEST_ID}"
-    echo "response:${response}"
-    exit 1
-  fi
-done
diff --git a/.github/workflows/reusable_go_build.yml b/.github/workflows/reusable_go_build.yml
new file mode 100644
index 0000000..534033e
--- /dev/null
+++ b/.github/workflows/reusable_go_build.yml
@@ -0,0 +1,23 @@
+name: Reusable Go Build Workflow
+
+on:
+  workflow_call:
+    inputs:
+      goBuildTag:
+        required: true
+        type: string
+
+jobs:
+  go_build_and_test:
+    name: Go build and test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup Go environment
+        uses: actions/setup-go@v2.1.4
+        with:
+          go-version: 1.18
+      - name: Go Build With Tags
+        run: go build -tags ${{ inputs.goBuildTag }}
+      - name: Go Test
+        run: go test ./...
diff --git a/.travis.yml b/.travis.yml
deleted file mode 100644
index 683495d..0000000
--- a/.travis.yml
+++ /dev/null
@@ -1,54 +0,0 @@
-language: go
-go:
-  - "1.18"
-
-dist: focal 
-
-before_script:
-  - pyenv install 3.6.10
-  - pyenv global 3.6.10
-  - pip install -U pip
-  - pip install --user awscli
-  - aws --version
-  - sudo apt-get -y install jq
-  - jq --version
-
-script:
-  - echo $RELEASE_DATREE_PROD
-  # - "travis_wait 60 sleep 3600 &"
-  - export GO_BUILD_TAG=$(bash ./scripts/define_build_tag.sh)
-  - go build -tags $GO_BUILD_TAG
-  - go test ./...
-
-before_deploy:
-  - jq --version
-  - curl -sfL https://git.io/goreleaser | VERSION=v$GORELEASER_VERSION sh -s -- check
-  - git config --global user.email "builds@travis-ci.com"
-  - git config --global user.name "Travis CI"
-  - git remote set-url origin https://datree-ci:$GITHUB_TOKEN@github.com/datreeio/datree.git
-
-deploy:
-  - provider: script
-    skip_cleanup: true
-    script: bash ./scripts/deploy_release_candidate.sh
-    on:
-      branch: main
-      condition: $RELEASE_DATREE_PROD != true
-  - provider: script
-    skip_cleanup: true
-    script: bash ./scripts/release.sh
-    on:
-      branch: main
-      condition: $RELEASE_DATREE_PROD = true
-
-env:
-  global:
-    #GITHUB_TOKEN
-    - secure: "OQTTfOMNYFxGNkizM7bhK3OJXUntazxaQ6rliRO327fRnMPacK/pswMIwUjjzwTwLV8nVIvACSIWmo/45SeJtLVcHsle3RBn0OZFmgMFjySkLldP71t/4HzV3ef24px9JNX/FO6kQ7tqzzS7SRwlekL4v/r6K8ro1kqmFDLQ2uibgSXqkI7rNwPP56L5+QTX46pA2113NnGpywAm/K33ky40Fb2QclDH41ax+Jm7zyDy1ry0d/T9db+GBOnBsfkqkuBiBDvJ2tp4n0KbvAIt870O8Ey9jB7MUkwdGKH/0ZlEFXihEmKIVn9pih5t8EFZzVxdPK+aJ3SHeqWAu9v0Iy1lsxs1je6fIkhA5hkHk9Hz4mgRrwiGRG1d25sBoNegnu0uA5Iowtwp4Rp7lTfDJSdazTW7W3L5+qzd9b1LA7GfIlATcSwDrPicf6RBX0r2eb0o2fiFi/B24X8J84CAmdnhlBjGYhoKdBZv3+ngopZAJNbbclD1YKMBhVEfjVGQMDOm6yVejIrPWq1asupX+JEpF4/myLXilooUKt2Znx01EG2UVZ31o6e5m3Hn/XWa5z5HR/zsYTozLUFe0kbJvBVwy4v/8YgUyoGGaxAifs6Eh3rmKzmQLa8eyZjIIUAibOd19uL7ZZSGAvKDr93N/8rlZnHA0PRsDNhNxVyCFu8="
-    - GORELEASER_VERSION="0.155.1"
-    # AWS_ACCESS_KEY_ID
-    - secure: "DoYHN09zYlwjaG9TpoKoNfEigFMmGzShCs6K40cwaTx3Ohr9W2NuiQZXO8eDIWJIh/x6C2cZpgCFGh/c08/OJw8F9F1gTGLgi1HFdLB7p3fwWV14Et3bUGKtVyV9aGnlBqr93u8t7bFPDdLc+GHl/8E9/f3qjuhpDUcGQbp5bamioWkxDmt3mampCfcJjFmLDgk/9ElWwAc4rF+K2uNPGAyxvXU5lvIHC9VYbHMiBgo49+qKtRRXOO85yFw4eIStGNeRKlsAqw7DdehUVvk4BqL4epU+itLqPe4QLE7RnVzMYLdtGuqebNzbvhJuGZiaYjcakrZcGyTlZKG1DfUPZoqUqZOC7/lAkafPq31uCFZnW+27EYdWy4SA1amQ1/DMkp226UDWho2Tu4kcT/0CTGq7VSFIqhuc3IyXQoO5V62cyLkD2e52lO5IPzqWkVXQoh4JOvn46qQFBfVgHp1ciEd6CJJ3HFOtEJZBtL/YqePQJgABkDtmyuE93ZaBh/FM7JaZOVKKTm9MzEi8QJbidk7kuKtH7j8lVhAU77bm84/2dcFDlyusEEvPtN5ufCfbpHzj9ypX4qfvp4y9NhlcTU9zEn0/ajjLc39Mbxfrcr+/gdt/+gj5yED1/Xyhdz+Uh9HIhPHQaWfWro21ya34oU01duk9AetXHaJ7owwvTrk="
-    # AWS_SECRET_ACCESS_KEY
-    - secure: "gerlCsh4HJidIo+srPAW7bFjPU5KDg/tErnjIKJWl0/rQs6Ai/E6AXDIK39QOzaGIKe6aObNaiIk0OqPucH9hRNZzkbaaRVq0/lfEEUJ8Uz+kJpmjcqhZb7cq8I3VNc8LULgGq+1CcjXzS7bdNK95fLzlvn9QATBORBsAgzH0k96FVF2jL6ND4nyQyW8vuKJS6gqoEK0Je0cb5Et3weG231hxOzXekA7mBf0sVvtCU6aLHpoUJiBO6Ll1mp4VJoOmD9C4K2naq/FrQF3q4rpGp6h2aNhNbC/PavCNITa8hl4GXAuWO4ffeS97VOMFB5NXckd4Dv3B4dFOQaQUNE6DLd+N+uQLqzsCKny6Cjbvm2L1W5J42MSG20dBXPcbSLE6LnkCw/Sz75Ga3/NLpzD89Letuj1MouiYmpRggRdwkICZCaaz1D9ZUsOaURCnNi+lXORE3RantHyuQimReByZQ29dCua1/JJfddW1AcJD5EcvPL/nSjiE7WfNrC0bDeCSZmAuzWSuYXJTgL2hwsGbsInZoZjv6oXYPKKmEJUig53Q9Jkh3ajEca5qU7KC8b9IpJ6XC2TBRxu//A9fzDGhWE6iR8Hw6GjaWimwWJ0DURP6isjv7uyi+uVeixXx0hu5BizvBERbB3I/AfygqGuWGdG8rRsjAwbft9dIQAhXD8="
-    #CLOUDFRONT_DISTRIBUTION_ID
-    - secure: "OPHm9ZF1qQ+yu1T5ecvOp8UVUX2AcIwbrQTJXKlz4DEANJKlX2gMzo9eLrLfaKQDqwFBmop9v721673qGjGXqyQCAwqf+OoRjX1ei/gIV8Rxx3ULV8jR/bn0oH33AllChhjpAX9nX/FDoSCWaUPJZSO1EIbvGBDKOipycxWOnGDvmNakfCWDBtezgU8yEafofuloALX+LreGoacd2ZtdcijSxZ+FjPJizJXOzJ3sdIh5cvAqu3sipKXUdCvsG1I2KsbTOV0wVj1TIBHvgCyIpjVuoMIo8lR32eYrjYQ1g9yiU37OZXCE+19ytj1N5RLpoNyWuIbZg6BAsWW3m8jasx3tSbrW8EN1jGc385faXV3k3LIy74ao7HMatxd8iFEZa8NLXlK4muLI7Y8dnTkzHf2xtT4gGTdhEhfulTj2SUzt6cWsN3fPFNXaXPj6KY44yqJQjA1BHlg8t4C2hnkYvUtYqhyLOCACqhhN2+jx+KkMRlc2cULzcwzJXB2+yzwySbkN5wlcL7DeUaK/C9ROxxKOSOOcMNDCT241eR1U3MQ1qVB4THalJ2T/eTv8W+dHzoeF/AnI7U4dOnJlCwf4t1patWB/K+2zOEhVYMd/C4RVyxc9BJ9ufgkvaM+X/laQ15vh9L23HRf6fIYv1v5Bf4AHqP8IpK0InMLtHwHc/Bw="
diff --git a/bl/policy/policy_factory.go b/bl/policy/policy_factory.go
index 8e466d5..b7b807f 100644
--- a/bl/policy/policy_factory.go
+++ b/bl/policy/policy_factory.go
@@ -3,8 +3,8 @@ package policy
 import (
 	"encoding/json"
 	"fmt"
+	"github.com/datreeio/datree/pkg/defaultPolicies"
 
-	"github.com/datreeio/datree/pkg/cliClient"
 	"github.com/datreeio/datree/pkg/defaultRules"
 )
 
@@ -21,47 +21,53 @@ type RuleWithSchema struct {
 	MessageOnFailure string
 }
 
-func CreatePolicy(policies *cliClient.EvaluationPrerunPolicies, policyName string, registrationURL string, defaultRules *defaultRules.DefaultRulesDefinitions) (Policy, error) {
-	var err error
-
-	if policies == nil && policyName != "" && policyName != "Default" {
-		return Policy{}, fmt.Errorf("policy %s doesn't exist, sign in to the dashboard to customize your policies: %s", policyName, registrationURL)
+func CreatePolicy(policies *defaultPolicies.EvaluationPrerunPolicies, policyName string, registrationURL string, defaultRules *defaultRules.DefaultRulesDefinitions, isAnonymous bool) (Policy, error) {
+	if policies == nil {
+		// policies should never be nil because of the fallback of defaultPolicies.yaml
+		panic("policies is nil")
 	}
 
+	var err error
+
 	var rules []RuleWithSchema
 
-	if policies != nil {
-		var chosenPolicy *cliClient.Policy
+	var chosenPolicy *defaultPolicies.Policy
 
+	if policyName == "" {
 		for _, policy := range policies.Policies {
-			if policyName == "" && policy.IsDefault {
+			if policy.IsDefault {
 				chosenPolicy = policy
 				policyName = chosenPolicy.Name
 				break
-			} else if policy.Name == policyName {
+			}
+		}
+	} else {
+		for _, policy := range policies.Policies {
+			if policy.Name == policyName {
 				chosenPolicy = policy
 				break
 			}
 		}
+	}
 
-		if chosenPolicy == nil {
+	if chosenPolicy == nil {
+		if isAnonymous {
+			return Policy{}, fmt.Errorf("policy %s doesn't exist, sign in to the dashboard to customize your policies: %s", policyName, registrationURL)
+		} else {
 			return Policy{}, fmt.Errorf("policy %s doesn't exist", policyName)
 		}
+	}
 
-		rules, err = populateRules(chosenPolicy.Rules, policies.CustomRules, defaultRules.Rules)
+	rules, err = populateRules(chosenPolicy.Rules, policies.CustomRules, defaultRules.Rules)
 
-		if err != nil {
-			return Policy{}, err
-		}
-	} else {
-		policy := createDefaultPolicy(defaultRules)
-		return policy, nil
+	if err != nil {
+		return Policy{}, err
 	}
 
 	return Policy{policyName, rules}, nil
 }
 
-func populateRules(policyRules []cliClient.Rule, customRules []*cliClient.CustomRule, defaultRules []*defaultRules.DefaultRuleDefinition) ([]RuleWithSchema, error) {
+func populateRules(policyRules []defaultPolicies.Rule, customRules []*defaultPolicies.CustomRule, defaultRules []*defaultRules.DefaultRuleDefinition) ([]RuleWithSchema, error) {
 	var rules = []RuleWithSchema{}
 
 	if policyRules == nil {
@@ -107,7 +113,7 @@ func getDefaultRuleByIdentifier(defaultRules []*defaultRules.DefaultRuleDefiniti
 	return nil
 }
 
-func getCustomRuleByIdentifier(customRules []*cliClient.CustomRule, identifier string) *cliClient.CustomRule {
+func getCustomRuleByIdentifier(customRules []*defaultPolicies.CustomRule, identifier string) *defaultPolicies.CustomRule {
 	for _, customRule := range customRules {
 		if identifier == customRule.Identifier {
 			return customRule
@@ -116,15 +122,3 @@ func getCustomRuleByIdentifier(customRules []*cliClient.CustomRule, identifier s
 
 	return nil
 }
-
-func createDefaultPolicy(defaultRules *defaultRules.DefaultRulesDefinitions) Policy {
-	var rules []RuleWithSchema
-
-	for _, defaultRule := range defaultRules.Rules {
-		if defaultRule.EnabledByDefault {
-			rules = append(rules, RuleWithSchema{defaultRule.UniqueName, defaultRule.Name, defaultRule.DocumentationUrl, defaultRule.Schema, defaultRule.MessageOnFailure})
-		}
-	}
-
-	return Policy{"Default", rules}
-}
diff --git a/install.sh b/install.sh
index c71b666..0ac7eef 100755
--- a/install.sh
+++ b/install.sh
@@ -5,8 +5,8 @@ create_uninstall_script()
     UNINSTALL_SCRIPT="$HOME/.datree/uninstall.sh"
     touch $UNINSTALL_SCRIPT && chmod +x $UNINSTALL_SCRIPT
 
-    cat >> $UNINSTALL_SCRIPT << 'END'
-    if [ "$(id -u)" -ne 0 ] ; then
+    cat > $UNINSTALL_SCRIPT << END
+    if [ "\$(id -u)" -ne 0 ] ; then
     echo "This script must be executed with root privileges." && exit 1
     fi
     rm -f /usr/local/bin/datree
diff --git a/internal/fixtures/policyAsCode/prerun.json b/internal/fixtures/policyAsCode/prerun.json
index aecc1fd..e68e787 100644
--- a/internal/fixtures/policyAsCode/prerun.json
+++ b/internal/fixtures/policyAsCode/prerun.json
@@ -92,5 +92,6 @@
   },
   "isPolicyAsCodeMode": false,
   "registrationURL": "https://app.datree.io/login?t=gfdgdsteasgfsdgfdsfsd",
-  "promptRegistrationURL": "https://app.datree.io/promptLogin?t=gfdgdsteasgfsdgfdsfsd"
+  "promptRegistrationURL": "https://app.datree.io/promptLogin?t=gfdgdsteasgfsdgfdsfsd",
+  "isAnonymous": false
 }
diff --git a/pkg/cliClient/evaluation.go b/pkg/cliClient/evaluation.go
index d5e1f55..394238a 100644
--- a/pkg/cliClient/evaluation.go
+++ b/pkg/cliClient/evaluation.go
@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/datreeio/datree/pkg/ciContext"
+	"github.com/datreeio/datree/pkg/defaultPolicies"
 	"github.com/datreeio/datree/pkg/extractor"
 )
 
@@ -81,38 +82,14 @@ type EvaluationRequest struct {
 	Files        []*extractor.FileConfigurations `json:"files"`
 }
 
-type CustomRule struct {
-	Identifier              string      `json:"identifier"`
-	Name                    string      `json:"name"`
-	DefaultMessageOnFailure string      `json:"defaultMessageOnFailure"`
-	Schema                  interface{} `json:"schema"`
-	JsonSchema              string      `json:"jsonSchema"`
-}
-
-type Rule struct {
-	Identifier       string `json:"identifier"`
-	MessageOnFailure string `json:"messageOnFailure"`
-}
-
-type Policy struct {
-	Name      string `json:"name"`
-	IsDefault bool   `json:"isDefault,omitempty"`
-	Rules     []Rule `json:"rules"`
-}
-
-type EvaluationPrerunPolicies struct {
-	ApiVersion  string        `json:"apiVersion"`
-	CustomRules []*CustomRule `json:"customRules"`
-	Policies    []*Policy     `json:"policies"`
-}
-
 type EvaluationPrerunDataResponse struct {
-	PoliciesJson          *EvaluationPrerunPolicies `json:"policiesJson"`
-	DefaultK8sVersion     string                    `json:"defaultK8sVersion"`
-	RegistrationURL       string                    `json:"registrationURL"`
-	PromptRegistrationURL string                    `json:"promptRegistrationURL"`
-	IsPolicyAsCodeMode    bool                      `json:"isPolicyAsCodeMode"`
-	DefaultRulesYaml      string                    `json:"defaultRulesYaml"`
+	PoliciesJson          *defaultPolicies.EvaluationPrerunPolicies `json:"policiesJson"`
+	DefaultK8sVersion     string                                    `json:"defaultK8sVersion"`
+	RegistrationURL       string                                    `json:"registrationURL"`
+	PromptRegistrationURL string                                    `json:"promptRegistrationURL"`
+	IsPolicyAsCodeMode    bool                                      `json:"isPolicyAsCodeMode"`
+	DefaultRulesYaml      string                                    `json:"defaultRulesYaml"`
+	IsAnonymous           bool                                      `json:"isAnonymous"`
 }
 
 func (c *CliClient) RequestEvaluationPrerunData(tokenId string, isCi bool) (*EvaluationPrerunDataResponse, error) {
@@ -130,18 +107,24 @@ func (c *CliClient) RequestEvaluationPrerunData(tokenId string, isCi bool) (*Eva
 		}
 
 		if c.networkValidator.IsLocalMode() {
-			return &EvaluationPrerunDataResponse{IsPolicyAsCodeMode: true}, nil
+			return &EvaluationPrerunDataResponse{IsPolicyAsCodeMode: true, PoliciesJson: defaultPolicies.GetDefaultPoliciesStruct()}, nil
 		}
 
 		return &EvaluationPrerunDataResponse{}, err
 	}
 
 	var evaluationPrerunDataResponse = &EvaluationPrerunDataResponse{IsPolicyAsCodeMode: true}
+
 	err = json.Unmarshal(res.Body, &evaluationPrerunDataResponse)
 	if err != nil {
 		return &EvaluationPrerunDataResponse{}, err
 	}
 
+	// for anonymous invocations, use the embedded defaultPolicies.yaml file
+	if evaluationPrerunDataResponse.PoliciesJson == nil {
+		evaluationPrerunDataResponse.PoliciesJson = defaultPolicies.GetDefaultPoliciesStruct()
+	}
+
 	return evaluationPrerunDataResponse, nil
 }
 
diff --git a/pkg/defaultPolicies/defaultPolicies.go b/pkg/defaultPolicies/defaultPolicies.go
new file mode 100644
index 0000000..81e330d
--- /dev/null
+++ b/pkg/defaultPolicies/defaultPolicies.go
@@ -0,0 +1,44 @@
+package defaultPolicies
+
+import (
+	_ "embed"
+
+	yamlConvertor "github.com/ghodss/yaml"
+)
+
+type EvaluationPrerunPolicies struct {
+	ApiVersion  string        `json:"apiVersion"`
+	CustomRules []*CustomRule `json:"customRules"`
+	Policies    []*Policy     `json:"policies"`
+}
+
+type CustomRule struct {
+	Identifier              string      `json:"identifier"`
+	Name                    string      `json:"name"`
+	DefaultMessageOnFailure string      `json:"defaultMessageOnFailure"`
+	Schema                  interface{} `json:"schema"`
+	JsonSchema              string      `json:"jsonSchema"`
+}
+
+type Rule struct {
+	Identifier       string `json:"identifier"`
+	MessageOnFailure string `json:"messageOnFailure"`
+}
+
+type Policy struct {
+	Name      string `json:"name"`
+	IsDefault bool   `json:"isDefault,omitempty"`
+	Rules     []Rule `json:"rules"`
+}
+
+//go:embed defaultPolicies.yaml
+var DefaultPoliciesFileContent string
+
+func GetDefaultPoliciesStruct() *EvaluationPrerunPolicies {
+	var defaultPolicies EvaluationPrerunPolicies
+	err := yamlConvertor.Unmarshal([]byte(DefaultPoliciesFileContent), &defaultPolicies)
+	if err != nil {
+		panic(err)
+	}
+	return &defaultPolicies
+}
diff --git a/pkg/defaultPolicies/defaultPolicies.yaml b/pkg/defaultPolicies/defaultPolicies.yaml
new file mode 100644
index 0000000..813e889
--- /dev/null
+++ b/pkg/defaultPolicies/defaultPolicies.yaml
@@ -0,0 +1,492 @@
+apiVersion: v1
+customRules: null
+policies:
+  - name: Default
+    isDefault: true
+    rules:
+      - identifier: CONTAINERS_MISSING_IMAGE_VALUE_VERSION
+        messageOnFailure: Incorrect value for key `image` - specify an image version to avoid unpleasant "version surprises" in the future
+      - identifier: CONTAINERS_MISSING_MEMORY_REQUEST_KEY
+        messageOnFailure: Missing property object `requests.memory` - value should be within the accepted boundaries recommended by the organization
+      - identifier: CONTAINERS_MISSING_CPU_REQUEST_KEY
+        messageOnFailure: Missing property object `requests.cpu` - value should be within the accepted boundaries recommended by the organization
+      - identifier: CONTAINERS_MISSING_MEMORY_LIMIT_KEY
+        messageOnFailure: Missing property object `limits.memory` - value should be within the accepted boundaries recommended by the organization
+      - identifier: CONTAINERS_MISSING_CPU_LIMIT_KEY
+        messageOnFailure: Missing property object `limits.cpu` - value should be within the accepted boundaries recommended by the organization
+      - identifier: INGRESS_INCORRECT_HOST_VALUE_PERMISSIVE
+        messageOnFailure: Incorrect value for key `host` - specify host instead of using a wildcard character ("*")
+      - identifier: SERVICE_INCORRECT_TYPE_VALUE_NODEPORT
+        messageOnFailure: Incorrect value for key `type` - `NodePort` will open a port on all nodes where it can be reached by the network external to the cluster
+      - identifier: CRONJOB_INVALID_SCHEDULE_VALUE
+        messageOnFailure: 'Incorrect value for key `schedule` - the (cron) schedule expressions is not valid and, therefore, will not work as expected'
+      - identifier: WORKLOAD_INVALID_LABELS_VALUE
+        messageOnFailure: Incorrect value for key(s) under `labels` - the vales syntax is not valid so the Kubernetes engine will not accept it
+      - identifier: WORKLOAD_INCORRECT_RESTARTPOLICY_VALUE_ALWAYS
+        messageOnFailure: Incorrect value for key `restartPolicy` - any other value than `Always` is not supported by this resource
+      - identifier: CONTAINERS_MISSING_LIVENESSPROBE_KEY
+        messageOnFailure: Missing property object `livenessProbe` - add a properly configured livenessProbe to catch possible deadlocks
+      - identifier: CONTAINERS_MISSING_READINESSPROBE_KEY
+        messageOnFailure: Missing property object `readinessProbe` - add a properly configured readinessProbe to notify kubelet your Pods are ready for traffic
+      - identifier: HPA_MISSING_MINREPLICAS_KEY
+        messageOnFailure: Missing property object `minReplicas` - the value should be within the accepted boundaries recommended by the organization
+      # - identifier: HPA_MISSING_MAXREPLICAS_KEY
+      #   messageOnFailure: Missing property object `maxReplicas` - the value should be within the accepted boundaries recommended by the organization
+      - identifier: WORKLOAD_INCORRECT_NAMESPACE_VALUE_DEFAULT
+        messageOnFailure: Incorrect value for key `namespace` - use an explicit namespace instead of the default one (`default`)
+      - identifier: DEPLOYMENT_INCORRECT_REPLICAS_VALUE
+        messageOnFailure: Incorrect value for key `replicas` - running 2 or more replicas will increase the availability of the service
+      - identifier: CRONJOB_MISSING_STARTINGDEADLINESECOND_KEY
+        messageOnFailure: Missing property object `startingDeadlineSeconds` - set a time limit to the cron execution to allow killing it if exceeded
+      - identifier: K8S_DEPRECATED_APIVERSION_1.16
+        messageOnFailure: Incorrect value for key `apiVersion` - the version you are trying to use is not supported by the Kubernetes cluster version (>=1.16)
+      - identifier: K8S_DEPRECATED_APIVERSION_1.17
+        messageOnFailure: Incorrect value for key `apiVersion` - the version you are trying to use is not supported by the Kubernetes cluster version (>=1.17)
+      - identifier: CONTAINERS_INCORRECT_PRIVILEGED_VALUE_TRUE
+        messageOnFailure: Incorrect value for key `privileged` - this mode will allow the container the same access as processes running on the host
+      # - identifier: WORKLOAD_MISSING_LABEL_OWNER_VALUE
+      #   messageOnFailure: Missing label object `owner` - add a proper owner label to know which person/team to ping when needed
+      # - identifier: DEPLOYMENT_MISSING_LABEL_ENV_VALUE
+      #   messageOnFailure: 'Missing label object `env` - add a proper environment description (e.g. "prod", "testing", etc.) to the Deployment config'
+      # - identifier: CONTAINERS_MISSING_IMAGE_VALUE_DIGEST
+      #   messageOnFailure: 'Incorrect value for key `image` - add a digest tag (starts with `@sha256:`) to represent an immutable version of the image'
+      - identifier: CRONJOB_MISSING_CONCURRENCYPOLICY_KEY
+        messageOnFailure: Missing property object `concurrencyPolicy` - the behavior will be more deterministic if jobs won't run concurrently
+      # - identifier: K8S_INCORRECT_KIND_VALUE_POD
+      #   messageOnFailure: Incorrect value for key `kind` - raw pod won't be rescheduled in the event of a node failure
+      # - identifier: CONTAINERS_INCORRECT_HOSTPID_VALUE_TRUE
+      #   messageOnFailure: Incorrect value for key `hostPID` - running on the host's PID namespace enables access to sensitive information from processes running outside the container
+      # - identifier: CONTAINERS_INCORRECT_HOSTIPC_VALUE_TRUE
+      #   messageOnFailure: Incorrect value for key `hostIPC` - running on the host`s IPC namespace can be (maliciously) used to interact with other processes running outside the container
+      # - identifier: CONTAINERS_INCORRECT_HOSTNETWORK_VALUE_TRUE
+      #   messageOnFailure: Incorrect value for key `hostNetwork` - running on the host's network namespace can allow a compromised container to sniff network traffic
+      # - identifier: CONTAINERS_INCORRECT_RUNASUSER_VALUE_LOWUID
+      #   messageOnFailure: Incorrect value for key `runAsUser` - value should be above 9999 to reduce the likelihood that the UID is already taken
+      # - identifier: CONTAINERS_INCORRECT_PATH_VALUE_DOCKERSOCKET
+      #   messageOnFailure: Incorrect value for key `path` - avoid mounting the docker.socket becasue it can allow container breakout
+      # - identifier: CONFIGMAP_CVE2021_25742_INCORRECT_SNIPPET_ANNOTATIONS_VALUE
+      #   messageOnFailure: Missing property object `allow-snippet-annotations` - set it to "false" to override default behaviour
+      # - identifier: INGRESS_CVE2021_25742_INCORRECT_SERVER_SNIPPET_KEY
+      #   messageOnFailure: Forbidden property object `server-snippet` - ingress-nginx custom snippets are not allowed
+      # - identifier: CONTAINER_CVE2021_25741_INCORRECT_SUBPATH_KEY
+      #   messageOnFailure: Forbidden property object `subPath` - malicious users can gain access to files & directories outside of the volume
+      # - identifier: ENDPOINTSLICE_CVE2021_25373_INCORRECT_ADDRESSES_VALUE
+      #   messageOnFailure: Incorrect value for key `addresses` - IP address is within vulnerable ranges (127.0.0.0/8 and 169.254.0.0/16)
+      # - identifier: ARGO_WORKFLOW_INCORRECT_FAILFAST_VALUE_FALSE
+      #   messageOnFailure: 'Incorrect value for key `failFast` - value should be `true` to prevent DAG from running on all branches, regardless of the failed outcomes of the DAG branches'
+      # - identifier: ARGO_WORKFLOW_INCORRECT_SERVICE_ACCOUNT_NAME_VALUE_DEFAULT
+      #   messageOnFailure: Incorrect value for key `serviceAccountName` - when set to `default` container is exposed to possible attacks
+      # - identifier: ARGO_CONFIGMAP_MISSING_PART_OF_LABEL_VALUE_ARGOCD
+      #   messageOnFailure: 'Incorrect value for annotation `app.kubernetes.io/part-of` - value should be `argocd`, or ArgoCD won''t recognize this resource'
+      # - identifier: ARGO_ROLLOUT_MISSING_PAUSE_DURATION
+      #   messageOnFailure: Missing the key `duration` - prevent the rollout from waiting indefinitely for the pause condition
+      # - identifier: ARGO_APP_PROJECT_INCORRECT_NAMESPACE_VALUE
+      #   messageOnFailure: Incorrect value for property `namespace` - Application and AppProject have to be installed on the argocd namespace
+      # - identifier: ARGO_WORKFLOW_INCORRECT_RETRY_STRATEGY_VALUE_EMPTY
+      #   messageOnFailure: 'Incorrect value for key `retryStrategy` - empty value (`{}`) can cause failed/errored steps to keep retrying, which can result in OOM issues'
+      # - identifier: ARGO_WORKFLOW_INCORRECT_REVISION_HISTORY_LIMIT_VALUE_0
+      #   messageOnFailure: Incorrect value for key `revisionHistoryLimit` - value above 0 is required to enable rolling back from a failed deployment
+      # - identifier: ARGO_ROLLOUT_INCORRECT_SCALE_DOWN_DELAY_VALUE_BELOW_30
+      #   messageOnFailure: Incorrect value for key `scaleDownDelaySeconds` - value should be at least 30 to prevent packets from being sent to a node that killed the pod
+      # - identifier: ARGO_ROLLOUT_INCORRECT_PROGRESS_DEADLINE_ABORT_VALUE_FALSE
+      #   messageOnFailure: Incorrect value for key `progressDeadlineAbort` - value should be `true` to prevent the rollout pod from retrying indefinitely
+      # - identifier: ARGO_WORKFLOW_ENSURE_RETRY_ON_BOTH_ERROR_AND_TRANSIENT_ERROR
+      #   messageOnFailure: Incorrect value for key `retryPolicy` - the expression should include retry on steps that failed either on transient or Argo controller errors
+      # - identifier: CONTAINERS_INCORRECT_READONLYROOTFILESYSTEM_VALUE
+      #   messageOnFailure: Incorrect value for key `readOnlyRootFilesystem` - set to 'true' to protect filesystem from potential attacks
+      # - identifier: CONTAINERS_INCORRECT_KEY_HOSTPATH
+      #   messageOnFailure: Invalid key `hostPath` - refrain from using this mount to prevent an attack on the underlying host
+      # - identifier: CONTAINERS_MISSING_KEY_ALLOWPRIVILEGEESCALATION
+      #   messageOnFailure: Missing key `allowPrivilegeEscalation` - set to false to prevent attackers from exploiting escalated container privileges
+      # - identifier: CONTAINERS_INCORRECT_RESOURCES_VERBS_VALUE
+      #   messageOnFailure: Incorrect value for key `resources` and/or `verbs` - allowing containers to run the exec command can be exploited by attackers
+      # - identifier: CONTAINERS_INVALID_CAPABILITIES_VALUE
+      #   messageOnFailure: Incorrect value for key `add` - refrain from using insecure capabilities to prevent access to sensitive components
+      # - identifier: CONTAINERS_INCORRECT_KEY_HOSTPORT
+      #   messageOnFailure: Incorrect key `hostPort` - refrain from using this key to prevent insecurely exposing your workload
+      # - identifier: CONTAINERS_INCORRECT_RUNASGROUP_VALUE_LOWGID
+      #   messageOnFailure: Invalid value for key `runAsGroup` - must be greater than 999 to ensure container is running with non-root group membership
+      # - identifier: CONTAINERS_INCORRECT_RUNASNONROOT_VALUE
+      #   messageOnFailure: Invalid value for key `runAsNonRoot` - must be set to `true` to prevent unnecessary privileges
+      # - identifier: SRVACC_INCORRECT_AUTOMOUNTSERVICEACCOUNTTOKEN_VALUE
+      #   messageOnFailure: Invalid value for key `automountServiceAccountToken` - must be set to `false` to prevent granting unnecessary access to the service account
+      - identifier: RESOURCE_MISSING_NAME
+        messageOnFailure: Missing key `name` or `generateName` - one of them must be set to apply resource to a cluster
+      # - identifier: CONTAINERS_INCORRECT_INITIALDELAYSECONDS_VALUE
+      #   messageOnFailure: Incorrect value for key `initialDelaySeconds` - set explicitly to control the start time before a probe is initiated (min 0)
+      # - identifier: CONTAINERS_INCORRECT_PERIODSECONDS_VALUE
+      #   messageOnFailure: Incorrect value for key `periodSeconds` - set explicitly to control how often a probe is performed (min 1)
+      # - identifier: CONTAINERS_INCORRECT_TIMEOUTSECONDS_VALUE
+      #   messageOnFailure: Incorrect value for key `timeoutSeconds` - set explicitly to control when a probe times out (min 1)
+      # - identifier: CONTAINERS_INCORRECT_SUCCESSTHRESHOLD_VALUE
+      #   messageOnFailure: Incorrect value for key `successThreshold` - set explicitly to control when a probe is considered successful after having failed
+      # - identifier: CONTAINERS_INCORRECT_FAILURETHRESHOLD_VALUE
+      #   messageOnFailure: Incorrect value for key `failureThreshold` - set explicitly to control the number of retries after a probe fails (min 1)
+      # - identifier: CONTAINERS_MISSING_PRESTOP_KEY
+      #   messageOnFailure: Missing property object `preStop` - set to ensure graceful shutdown of the container
+  - name: Argo
+    rules:
+      # - identifier: CONTAINERS_MISSING_IMAGE_VALUE_VERSION
+      #   messageOnFailure: Incorrect value for key `image` - specify an image version to avoid unpleasant "version surprises" in the future
+      # - identifier: CONTAINERS_MISSING_MEMORY_REQUEST_KEY
+      #   messageOnFailure: Missing property object `requests.memory` - value should be within the accepted boundaries recommended by the organization
+      # - identifier: CONTAINERS_MISSING_CPU_REQUEST_KEY
+      #   messageOnFailure: Missing property object `requests.cpu` - value should be within the accepted boundaries recommended by the organization
+      # - identifier: CONTAINERS_MISSING_MEMORY_LIMIT_KEY
+      #   messageOnFailure: Missing property object `limits.memory` - value should be within the accepted boundaries recommended by the organization
+      # - identifier: CONTAINERS_MISSING_CPU_LIMIT_KEY
+      #   messageOnFailure: Missing property object `limits.cpu` - value should be within the accepted boundaries recommended by the organization
+      # - identifier: INGRESS_INCORRECT_HOST_VALUE_PERMISSIVE
+      #   messageOnFailure: Incorrect value for key `host` - specify host instead of using a wildcard character ("*")
+      # - identifier: SERVICE_INCORRECT_TYPE_VALUE_NODEPORT
+      #   messageOnFailure: Incorrect value for key `type` - `NodePort` will open a port on all nodes where it can be reached by the network external to the cluster
+      # - identifier: CRONJOB_INVALID_SCHEDULE_VALUE
+      #   messageOnFailure: 'Incorrect value for key `schedule` - the (cron) schedule expressions is not valid and, therefore, will not work as expected'
+      # - identifier: WORKLOAD_INVALID_LABELS_VALUE
+      #   messageOnFailure: Incorrect value for key(s) under `labels` - the vales syntax is not valid so the Kubernetes engine will not accept it
+      # - identifier: WORKLOAD_INCORRECT_RESTARTPOLICY_VALUE_ALWAYS
+      #   messageOnFailure: Incorrect value for key `restartPolicy` - any other value than `Always` is not supported by this resource
+      # - identifier: CONTAINERS_MISSING_LIVENESSPROBE_KEY
+      #   messageOnFailure: Missing property object `livenessProbe` - add a properly configured livenessProbe to catch possible deadlocks
+      # - identifier: CONTAINERS_MISSING_READINESSPROBE_KEY
+      #   messageOnFailure: Missing property object `readinessProbe` - add a properly configured readinessProbe to notify kubelet your Pods are ready for traffic
+      # - identifier: HPA_MISSING_MINREPLICAS_KEY
+      #   messageOnFailure: Missing property object `minReplicas` - the value should be within the accepted boundaries recommended by the organization
+      # - identifier: HPA_MISSING_MAXREPLICAS_KEY
+      #   messageOnFailure: Missing property object `maxReplicas` - the value should be within the accepted boundaries recommended by the organization
+      # - identifier: WORKLOAD_INCORRECT_NAMESPACE_VALUE_DEFAULT
+      #   messageOnFailure: Incorrect value for key `namespace` - use an explicit namespace instead of the default one (`default`)
+      # - identifier: DEPLOYMENT_INCORRECT_REPLICAS_VALUE
+      #   messageOnFailure: Incorrect value for key `replicas` - running 2 or more replicas will increase the availability of the service
+      # - identifier: CRONJOB_MISSING_STARTINGDEADLINESECOND_KEY
+      #   messageOnFailure: Missing property object `startingDeadlineSeconds` - set a time limit to the cron execution to allow killing it if exceeded
+      # - identifier: K8S_DEPRECATED_APIVERSION_1.16
+      #   messageOnFailure: Incorrect value for key `apiVersion` - the version you are trying to use is not supported by the Kubernetes cluster version (>=1.16)
+      # - identifier: K8S_DEPRECATED_APIVERSION_1.17
+      #   messageOnFailure: Incorrect value for key `apiVersion` - the version you are trying to use is not supported by the Kubernetes cluster version (>=1.17)
+      # - identifier: CONTAINERS_INCORRECT_PRIVILEGED_VALUE_TRUE
+      #   messageOnFailure: Incorrect value for key `privileged` - this mode will allow the container the same access as processes running on the host
+      # - identifier: WORKLOAD_MISSING_LABEL_OWNER_VALUE
+      #   messageOnFailure: Missing label object `owner` - add a proper owner label to know which person/team to ping when needed
+      # - identifier: DEPLOYMENT_MISSING_LABEL_ENV_VALUE
+      #   messageOnFailure: 'Missing label object `env` - add a proper environment description (e.g. "prod", "testing", etc.) to the Deployment config'
+      # - identifier: CONTAINERS_MISSING_IMAGE_VALUE_DIGEST
+      #   messageOnFailure: 'Incorrect value for key `image` - add a digest tag (starts with `@sha256:`) to represent an immutable version of the image'
+      # - identifier: CRONJOB_MISSING_CONCURRENCYPOLICY_KEY
+      #   messageOnFailure: Missing property object `concurrencyPolicy` - the behavior will be more deterministic if jobs won't run concurrently
+      # - identifier: K8S_INCORRECT_KIND_VALUE_POD
+      #   messageOnFailure: Incorrect value for key `kind` - raw pod won't be rescheduled in the event of a node failure
+      # - identifier: CONTAINERS_INCORRECT_HOSTPID_VALUE_TRUE
+      #   messageOnFailure: Incorrect value for key `hostPID` - running on the host's PID namespace enables access to sensitive information from processes running outside the container
+      # - identifier: CONTAINERS_INCORRECT_HOSTIPC_VALUE_TRUE
+      #   messageOnFailure: Incorrect value for key `hostIPC` - running on the host`s IPC namespace can be (maliciously) used to interact with other processes running outside the container
+      # - identifier: CONTAINERS_INCORRECT_HOSTNETWORK_VALUE_TRUE
+      #   messageOnFailure: Incorrect value for key `hostNetwork` - running on the host's network namespace can allow a compromised container to sniff network traffic
+      # - identifier: CONTAINERS_INCORRECT_RUNASUSER_VALUE_LOWUID
+      #   messageOnFailure: Incorrect value for key `runAsUser` - value should be above 9999 to reduce the likelihood that the UID is already taken
+      # - identifier: CONTAINERS_INCORRECT_PATH_VALUE_DOCKERSOCKET
+      #   messageOnFailure: Incorrect value for key `path` - avoid mounting the docker.socket becasue it can allow container breakout
+      # - identifier: CONFIGMAP_CVE2021_25742_INCORRECT_SNIPPET_ANNOTATIONS_VALUE
+      #   messageOnFailure: Missing property object `allow-snippet-annotations` - set it to "false" to override default behaviour
+      # - identifier: INGRESS_CVE2021_25742_INCORRECT_SERVER_SNIPPET_KEY
+      #   messageOnFailure: Forbidden property object `server-snippet` - ingress-nginx custom snippets are not allowed
+      # - identifier: CONTAINER_CVE2021_25741_INCORRECT_SUBPATH_KEY
+      #   messageOnFailure: Forbidden property object `subPath` - malicious users can gain access to files & directories outside of the volume
+      # - identifier: ENDPOINTSLICE_CVE2021_25373_INCORRECT_ADDRESSES_VALUE
+      #   messageOnFailure: Incorrect value for key `addresses` - IP address is within vulnerable ranges (127.0.0.0/8 and 169.254.0.0/16)
+      - identifier: ARGO_WORKFLOW_INCORRECT_FAILFAST_VALUE_FALSE
+        messageOnFailure: 'Incorrect value for key `failFast` - value should be `true` to prevent DAG from running on all branches, regardless of the failed outcomes of the DAG branches'
+      - identifier: ARGO_WORKFLOW_INCORRECT_SERVICE_ACCOUNT_NAME_VALUE_DEFAULT
+        messageOnFailure: Incorrect value for key `serviceAccountName` - when set to `default` container is exposed to possible attacks
+      - identifier: ARGO_CONFIGMAP_MISSING_PART_OF_LABEL_VALUE_ARGOCD
+        messageOnFailure: 'Incorrect value for annotation `app.kubernetes.io/part-of` - value should be `argocd`, or ArgoCD won''t recognize this resource'
+      - identifier: ARGO_ROLLOUT_MISSING_PAUSE_DURATION
+        messageOnFailure: Missing the key `duration` - prevent the rollout from waiting indefinitely for the pause condition
+      - identifier: ARGO_APP_PROJECT_INCORRECT_NAMESPACE_VALUE
+        messageOnFailure: Incorrect value for property `namespace` - Application and AppProject have to be installed on the argocd namespace
+      - identifier: ARGO_WORKFLOW_INCORRECT_RETRY_STRATEGY_VALUE_EMPTY
+        messageOnFailure: 'Incorrect value for key `retryStrategy` - empty value (`{}`) can cause failed/errored steps to keep retrying, which can result in OOM issues'
+      - identifier: ARGO_WORKFLOW_INCORRECT_REVISION_HISTORY_LIMIT_VALUE_0
+        messageOnFailure: Incorrect value for key `revisionHistoryLimit` - value above 0 is required to enable rolling back from a failed deployment
+      - identifier: ARGO_ROLLOUT_INCORRECT_SCALE_DOWN_DELAY_VALUE_BELOW_30
+        messageOnFailure: Incorrect value for key `scaleDownDelaySeconds` - value should be at least 30 to prevent packets from being sent to a node that killed the pod
+      - identifier: ARGO_ROLLOUT_INCORRECT_PROGRESS_DEADLINE_ABORT_VALUE_FALSE
+        messageOnFailure: Incorrect value for key `progressDeadlineAbort` - value should be `true` to prevent the rollout pod from retrying indefinitely
+      - identifier: ARGO_WORKFLOW_ENSURE_RETRY_ON_BOTH_ERROR_AND_TRANSIENT_ERROR
+        messageOnFailure: Incorrect value for key `retryPolicy` - the expression should include retry on steps that failed either on transient or Argo controller errors
+      # - identifier: CONTAINERS_INCORRECT_READONLYROOTFILESYSTEM_VALUE
+      #   messageOnFailure: Incorrect value for key `readOnlyRootFilesystem` - set to 'true' to protect filesystem from potential attacks
+      # - identifier: CONTAINERS_INCORRECT_KEY_HOSTPATH
+      #   messageOnFailure: Invalid key `hostPath` - refrain from using this mount to prevent an attack on the underlying host
+      # - identifier: CONTAINERS_MISSING_KEY_ALLOWPRIVILEGEESCALATION
+      #   messageOnFailure: Missing key `allowPrivilegeEscalation` - set to false to prevent attackers from exploiting escalated container privileges
+      # - identifier: CONTAINERS_INCORRECT_RESOURCES_VERBS_VALUE
+      #   messageOnFailure: Incorrect value for key `resources` and/or `verbs` - allowing containers to run the exec command can be exploited by attackers
+      # - identifier: CONTAINERS_INVALID_CAPABILITIES_VALUE
+      #   messageOnFailure: Incorrect value for key `add` - refrain from using insecure capabilities to prevent access to sensitive components
+      # - identifier: CONTAINERS_INCORRECT_KEY_HOSTPORT
+      #   messageOnFailure: Incorrect key `hostPort` - refrain from using this key to prevent insecurely exposing your workload
+      # - identifier: CONTAINERS_INCORRECT_RUNASGROUP_VALUE_LOWGID
+      #   messageOnFailure: Invalid value for key `runAsGroup` - must be greater than 999 to ensure container is running with non-root group membership
+      # - identifier: CONTAINERS_INCORRECT_RUNASNONROOT_VALUE
+      #   messageOnFailure: Invalid value for key `runAsNonRoot` - must be set to `true` to prevent unnecessary privileges
+      # - identifier: SRVACC_INCORRECT_AUTOMOUNTSERVICEACCOUNTTOKEN_VALUE
+      #   messageOnFailure: Invalid value for key `automountServiceAccountToken` - must be set to `false` to prevent granting unnecessary access to the service account
+      # - identifier: RESOURCE_MISSING_NAME
+      #   messageOnFailure: Missing key `name` or `generateName` - one of them must be set to apply resource to a cluster
+      # - identifier: CONTAINERS_INCORRECT_INITIALDELAYSECONDS_VALUE
+      #   messageOnFailure: Incorrect value for key `initialDelaySeconds` - set explicitly to control the start time before a probe is initiated (min 0)
+      # - identifier: CONTAINERS_INCORRECT_PERIODSECONDS_VALUE
+      #   messageOnFailure: Incorrect value for key `periodSeconds` - set explicitly to control how often a probe is performed (min 1)
+      # - identifier: CONTAINERS_INCORRECT_TIMEOUTSECONDS_VALUE
+      #   messageOnFailure: Incorrect value for key `timeoutSeconds` - set explicitly to control when a probe times out (min 1)
+      # - identifier: CONTAINERS_INCORRECT_SUCCESSTHRESHOLD_VALUE
+      #   messageOnFailure: Incorrect value for key `successThreshold` - set explicitly to control when a probe is considered successful after having failed
+      # - identifier: CONTAINERS_INCORRECT_FAILURETHRESHOLD_VALUE
+      #   messageOnFailure: Incorrect value for key `failureThreshold` - set explicitly to control the number of retries after a probe fails (min 1)
+      # - identifier: CONTAINERS_MISSING_PRESTOP_KEY
+      #   messageOnFailure: Missing property object `preStop` - set to ensure graceful shutdown of the container
+  - name: NSA
+    rules:
+      # - identifier: CONTAINERS_MISSING_IMAGE_VALUE_VERSION
+      #   messageOnFailure: Incorrect value for key `image` - specify an image version to avoid unpleasant "version surprises" in the future
+      # - identifier: CONTAINERS_MISSING_MEMORY_REQUEST_KEY
+      #   messageOnFailure: Missing property object `requests.memory` - value should be within the accepted boundaries recommended by the organization
+      # - identifier: CONTAINERS_MISSING_CPU_REQUEST_KEY
+      #   messageOnFailure: Missing property object `requests.cpu` - value should be within the accepted boundaries recommended by the organization
+      # - identifier: CONTAINERS_MISSING_MEMORY_LIMIT_KEY
+      #   messageOnFailure: Missing property object `limits.memory` - value should be within the accepted boundaries recommended by the organization
+      # - identifier: CONTAINERS_MISSING_CPU_LIMIT_KEY
+      #   messageOnFailure: Missing property object `limits.cpu` - value should be within the accepted boundaries recommended by the organization
+      # - identifier: INGRESS_INCORRECT_HOST_VALUE_PERMISSIVE
+      #   messageOnFailure: Incorrect value for key `host` - specify host instead of using a wildcard character ("*")
+      # - identifier: SERVICE_INCORRECT_TYPE_VALUE_NODEPORT
+      #   messageOnFailure: Incorrect value for key `type` - `NodePort` will open a port on all nodes where it can be reached by the network external to the cluster
+      # - identifier: CRONJOB_INVALID_SCHEDULE_VALUE
+      #   messageOnFailure: 'Incorrect value for key `schedule` - the (cron) schedule expressions is not valid and, therefore, will not work as expected'
+      # - identifier: WORKLOAD_INVALID_LABELS_VALUE
+      #   messageOnFailure: Incorrect value for key(s) under `labels` - the vales syntax is not valid so the Kubernetes engine will not accept it
+      # - identifier: WORKLOAD_INCORRECT_RESTARTPOLICY_VALUE_ALWAYS
+      #   messageOnFailure: Incorrect value for key `restartPolicy` - any other value than `Always` is not supported by this resource
+      # - identifier: CONTAINERS_MISSING_LIVENESSPROBE_KEY
+      #   messageOnFailure: Missing property object `livenessProbe` - add a properly configured livenessProbe to catch possible deadlocks
+      # - identifier: CONTAINERS_MISSING_READINESSPROBE_KEY
+      #   messageOnFailure: Missing property object `readinessProbe` - add a properly configured readinessProbe to notify kubelet your Pods are ready for traffic
+      # - identifier: HPA_MISSING_MINREPLICAS_KEY
+      #   messageOnFailure: Missing property object `minReplicas` - the value should be within the accepted boundaries recommended by the organization
+      # - identifier: HPA_MISSING_MAXREPLICAS_KEY
+      #   messageOnFailure: Missing property object `maxReplicas` - the value should be within the accepted boundaries recommended by the organization
+      # - identifier: WORKLOAD_INCORRECT_NAMESPACE_VALUE_DEFAULT
+      #   messageOnFailure: Incorrect value for key `namespace` - use an explicit namespace instead of the default one (`default`)
+      # - identifier: DEPLOYMENT_INCORRECT_REPLICAS_VALUE
+      #   messageOnFailure: Incorrect value for key `replicas` - running 2 or more replicas will increase the availability of the service
+      # - identifier: CRONJOB_MISSING_STARTINGDEADLINESECOND_KEY
+      #   messageOnFailure: Missing property object `startingDeadlineSeconds` - set a time limit to the cron execution to allow killing it if exceeded
+      # - identifier: K8S_DEPRECATED_APIVERSION_1.16
+      #   messageOnFailure: Incorrect value for key `apiVersion` - the version you are trying to use is not supported by the Kubernetes cluster version (>=1.16)
+      # - identifier: K8S_DEPRECATED_APIVERSION_1.17
+      #   messageOnFailure: Incorrect value for key `apiVersion` - the version you are trying to use is not supported by the Kubernetes cluster version (>=1.17)
+      # - identifier: CONTAINERS_INCORRECT_PRIVILEGED_VALUE_TRUE
+      #   messageOnFailure: Incorrect value for key `privileged` - this mode will allow the container the same access as processes running on the host
+      # - identifier: WORKLOAD_MISSING_LABEL_OWNER_VALUE
+      #   messageOnFailure: Missing label object `owner` - add a proper owner label to know which person/team to ping when needed
+      # - identifier: DEPLOYMENT_MISSING_LABEL_ENV_VALUE
+      #   messageOnFailure: 'Missing label object `env` - add a proper environment description (e.g. "prod", "testing", etc.) to the Deployment config'
+      # - identifier: CONTAINERS_MISSING_IMAGE_VALUE_DIGEST
+      #   messageOnFailure: 'Incorrect value for key `image` - add a digest tag (starts with `@sha256:`) to represent an immutable version of the image'
+      # - identifier: CRONJOB_MISSING_CONCURRENCYPOLICY_KEY
+      #   messageOnFailure: Missing property object `concurrencyPolicy` - the behavior will be more deterministic if jobs won't run concurrently
+      # - identifier: K8S_INCORRECT_KIND_VALUE_POD
+      #   messageOnFailure: Incorrect value for key `kind` - raw pod won't be rescheduled in the event of a node failure
+      # - identifier: CONTAINERS_INCORRECT_HOSTPID_VALUE_TRUE
+      #   messageOnFailure: Incorrect value for key `hostPID` - running on the host's PID namespace enables access to sensitive information from processes running outside the container
+      # - identifier: CONTAINERS_INCORRECT_HOSTIPC_VALUE_TRUE
+      #   messageOnFailure: Incorrect value for key `hostIPC` - running on the host`s IPC namespace can be (maliciously) used to interact with other processes running outside the container
+      # - identifier: CONTAINERS_INCORRECT_HOSTNETWORK_VALUE_TRUE
+      #   messageOnFailure: Incorrect value for key `hostNetwork` - running on the host's network namespace can allow a compromised container to sniff network traffic
+      - identifier: CONTAINERS_INCORRECT_RUNASUSER_VALUE_LOWUID
+        messageOnFailure: Incorrect value for key `runAsUser` - value should be above 9999 to reduce the likelihood that the UID is already taken
+      # - identifier: CONTAINERS_INCORRECT_PATH_VALUE_DOCKERSOCKET
+      #   messageOnFailure: Incorrect value for key `path` - avoid mounting the docker.socket becasue it can allow container breakout
+      # - identifier: CONFIGMAP_CVE2021_25742_INCORRECT_SNIPPET_ANNOTATIONS_VALUE
+      #   messageOnFailure: Missing property object `allow-snippet-annotations` - set it to "false" to override default behaviour
+      # - identifier: INGRESS_CVE2021_25742_INCORRECT_SERVER_SNIPPET_KEY
+      #   messageOnFailure: Forbidden property object `server-snippet` - ingress-nginx custom snippets are not allowed
+      # - identifier: CONTAINER_CVE2021_25741_INCORRECT_SUBPATH_KEY
+      #   messageOnFailure: Forbidden property object `subPath` - malicious users can gain access to files & directories outside of the volume
+      # - identifier: ENDPOINTSLICE_CVE2021_25373_INCORRECT_ADDRESSES_VALUE
+      #   messageOnFailure: Incorrect value for key `addresses` - IP address is within vulnerable ranges (127.0.0.0/8 and 169.254.0.0/16)
+      # - identifier: ARGO_WORKFLOW_INCORRECT_FAILFAST_VALUE_FALSE
+      #   messageOnFailure: 'Incorrect value for key `failFast` - value should be `true` to prevent DAG from running on all branches, regardless of the failed outcomes of the DAG branches'
+      # - identifier: ARGO_WORKFLOW_INCORRECT_SERVICE_ACCOUNT_NAME_VALUE_DEFAULT
+      #   messageOnFailure: Incorrect value for key `serviceAccountName` - when set to `default` container is exposed to possible attacks
+      # - identifier: ARGO_CONFIGMAP_MISSING_PART_OF_LABEL_VALUE_ARGOCD
+      #   messageOnFailure: 'Incorrect value for annotation `app.kubernetes.io/part-of` - value should be `argocd`, or ArgoCD won''t recognize this resource'
+      # - identifier: ARGO_ROLLOUT_MISSING_PAUSE_DURATION
+      #   messageOnFailure: Missing the key `duration` - prevent the rollout from waiting indefinitely for the pause condition
+      # - identifier: ARGO_APP_PROJECT_INCORRECT_NAMESPACE_VALUE
+      #   messageOnFailure: Incorrect value for property `namespace` - Application and AppProject have to be installed on the argocd namespace
+      # - identifier: ARGO_WORKFLOW_INCORRECT_RETRY_STRATEGY_VALUE_EMPTY
+      #   messageOnFailure: 'Incorrect value for key `retryStrategy` - empty value (`{}`) can cause failed/errored steps to keep retrying, which can result in OOM issues'
+      # - identifier: ARGO_WORKFLOW_INCORRECT_REVISION_HISTORY_LIMIT_VALUE_0
+      #   messageOnFailure: Incorrect value for key `revisionHistoryLimit` - value above 0 is required to enable rolling back from a failed deployment
+      # - identifier: ARGO_ROLLOUT_INCORRECT_SCALE_DOWN_DELAY_VALUE_BELOW_30
+      #   messageOnFailure: Incorrect value for key `scaleDownDelaySeconds` - value should be at least 30 to prevent packets from being sent to a node that killed the pod
+      # - identifier: ARGO_ROLLOUT_INCORRECT_PROGRESS_DEADLINE_ABORT_VALUE_FALSE
+      #   messageOnFailure: Incorrect value for key `progressDeadlineAbort` - value should be `true` to prevent the rollout pod from retrying indefinitely
+      # - identifier: ARGO_WORKFLOW_ENSURE_RETRY_ON_BOTH_ERROR_AND_TRANSIENT_ERROR
+      #   messageOnFailure: Incorrect value for key `retryPolicy` - the expression should include retry on steps that failed either on transient or Argo controller errors
+      - identifier: CONTAINERS_INCORRECT_READONLYROOTFILESYSTEM_VALUE
+        messageOnFailure: Incorrect value for key `readOnlyRootFilesystem` - set to 'true' to protect filesystem from potential attacks
+      - identifier: CONTAINERS_INCORRECT_KEY_HOSTPATH
+        messageOnFailure: Invalid key `hostPath` - refrain from using this mount to prevent an attack on the underlying host
+      - identifier: CONTAINERS_MISSING_KEY_ALLOWPRIVILEGEESCALATION
+        messageOnFailure: Missing key `allowPrivilegeEscalation` - set to false to prevent attackers from exploiting escalated container privileges
+      - identifier: CONTAINERS_INCORRECT_RESOURCES_VERBS_VALUE
+        messageOnFailure: Incorrect value for key `resources` and/or `verbs` - allowing containers to run the exec command can be exploited by attackers
+      - identifier: CONTAINERS_INVALID_CAPABILITIES_VALUE
+        messageOnFailure: Incorrect value for key `add` - refrain from using insecure capabilities to prevent access to sensitive components
+      - identifier: CONTAINERS_INCORRECT_KEY_HOSTPORT
+        messageOnFailure: Incorrect key `hostPort` - refrain from using this key to prevent insecurely exposing your workload
+      - identifier: CONTAINERS_INCORRECT_RUNASGROUP_VALUE_LOWGID
+        messageOnFailure: Invalid value for key `runAsGroup` - must be greater than 999 to ensure container is running with non-root group membership
+      - identifier: CONTAINERS_INCORRECT_RUNASNONROOT_VALUE
+        messageOnFailure: Invalid value for key `runAsNonRoot` - must be set to `true` to prevent unnecessary privileges
+      - identifier: SRVACC_INCORRECT_AUTOMOUNTSERVICEACCOUNTTOKEN_VALUE
+        messageOnFailure: Invalid value for key `automountServiceAccountToken` - must be set to `false` to prevent granting unnecessary access to the service account
+      # - identifier: RESOURCE_MISSING_NAME
+      #   messageOnFailure: Missing key `name` or `generateName` - one of them must be set to apply resource to a cluster
+      # - identifier: CONTAINERS_INCORRECT_INITIALDELAYSECONDS_VALUE
+      #   messageOnFailure: Incorrect value for key `initialDelaySeconds` - set explicitly to control the start time before a probe is initiated (min 0)
+      # - identifier: CONTAINERS_INCORRECT_PERIODSECONDS_VALUE
+      #   messageOnFailure: Incorrect value for key `periodSeconds` - set explicitly to control how often a probe is performed (min 1)
+      # - identifier: CONTAINERS_INCORRECT_TIMEOUTSECONDS_VALUE
+      #   messageOnFailure: Incorrect value for key `timeoutSeconds` - set explicitly to control when a probe times out (min 1)
+      # - identifier: CONTAINERS_INCORRECT_SUCCESSTHRESHOLD_VALUE
+      #   messageOnFailure: Incorrect value for key `successThreshold` - set explicitly to control when a probe is considered successful after having failed
+      # - identifier: CONTAINERS_INCORRECT_FAILURETHRESHOLD_VALUE
+      #   messageOnFailure: Incorrect value for key `failureThreshold` - set explicitly to control the number of retries after a probe fails (min 1)
+      # - identifier: CONTAINERS_MISSING_PRESTOP_KEY
+      #   messageOnFailure: Missing property object `preStop` - set to ensure graceful shutdown of the container
+  - name: cdk8s
+    rules:
+      # - identifier: K8S_DEPRECATED_APIVERSION_1.16
+      #   messageOnFailure: Incorrect value for key `apiVersion` - the version you are trying to use is not supported by the Kubernetes cluster version (>=1.16)
+      - identifier: CONTAINERS_MISSING_IMAGE_VALUE_VERSION
+        messageOnFailure: Incorrect value for key `image` - specify an image version to avoid unpleasant "version surprises" in the future
+      - identifier: INGRESS_INCORRECT_HOST_VALUE_PERMISSIVE
+        messageOnFailure: Incorrect value for key `host` - specify host instead of using a wildcard character ("*")
+      # - identifier: SERVICE_INCORRECT_TYPE_VALUE_NODEPORT
+      #   messageOnFailure: Incorrect value for key `type` - `NodePort` will open a port on all nodes where it can be reached by the network external to the cluster
+      # - identifier: CONTAINERS_MISSING_CPU_REQUEST_KEY
+      #   messageOnFailure: Missing property object `requests.cpu` - value should be within the accepted boundaries recommended by the organization
+      # - identifier: CONTAINERS_MISSING_CPU_LIMIT_KEY
+      #   messageOnFailure: Missing property object `limits.cpu` - value should be within the accepted boundaries recommended by the organization
+      # - identifier: CONTAINERS_MISSING_MEMORY_REQUEST_KEY
+      #   messageOnFailure: Missing property object `requests.memory` - value should be within the accepted boundaries recommended by the organization
+      - identifier: WORKLOAD_INVALID_LABELS_VALUE
+        messageOnFailure: Incorrect value for key(s) under `labels` - the vales syntax is not valid so the Kubernetes engine will not accept it
+      - identifier: WORKLOAD_INCORRECT_RESTARTPOLICY_VALUE_ALWAYS
+        messageOnFailure: Incorrect value for key `restartPolicy` - any other value than `Always` is not supported by this resource
+      # - identifier: HPA_MISSING_MAXREPLICAS_KEY
+      #   messageOnFailure: Missing property object `maxReplicas` - the value should be within the accepted boundaries recommended by the organization
+      - identifier: WORKLOAD_INCORRECT_NAMESPACE_VALUE_DEFAULT
+        messageOnFailure: Incorrect value for key `namespace` - use an explicit namespace instead of the default one (`default`)
+      - identifier: DEPLOYMENT_INCORRECT_REPLICAS_VALUE
+        messageOnFailure: Incorrect value for key `replicas` - running 2 or more replicas will increase the availability of the service
+      # - identifier: WORKLOAD_MISSING_LABEL_OWNER_VALUE
+      #   messageOnFailure: Missing label object `owner` - add a proper owner label to know which person/team to ping when needed
+      # - identifier: DEPLOYMENT_MISSING_LABEL_ENV_VALUE
+      #   messageOnFailure: 'Missing label object `env` - add a proper environment description (e.g. "prod", "testing", etc.) to the Deployment config'
+      # - identifier: CONTAINERS_MISSING_IMAGE_VALUE_DIGEST
+      #   messageOnFailure: 'Incorrect value for key `image` - add a digest tag (starts with `@sha256:`) to represent an immutable version of the image'
+      # - identifier: CONTAINERS_INCORRECT_HOSTPID_VALUE_TRUE
+      #   messageOnFailure: Incorrect value for key `hostPID` - running on the host's PID namespace enables access to sensitive information from processes running outside the container
+      # - identifier: CONTAINERS_INCORRECT_HOSTIPC_VALUE_TRUE
+      #   messageOnFailure: Incorrect value for key `hostIPC` - running on the host`s IPC namespace can be (maliciously) used to interact with other processes running outside the container
+      # - identifier: CONTAINERS_INCORRECT_HOSTNETWORK_VALUE_TRUE
+      #   messageOnFailure: Incorrect value for key `hostNetwork` - running on the host's network namespace can allow a compromised container to sniff network traffic
+      # - identifier: CONTAINERS_INCORRECT_RUNASUSER_VALUE_LOWUID
+      #   messageOnFailure: Incorrect value for key `runAsUser` - value should be above 9999 to reduce the likelihood that the UID is already taken
+      # - identifier: CONTAINERS_INCORRECT_PATH_VALUE_DOCKERSOCKET
+      #   messageOnFailure: Incorrect value for key `path` - avoid mounting the docker.socket becasue it can allow container breakout
+      # - identifier: CONFIGMAP_CVE2021_25742_INCORRECT_SNIPPET_ANNOTATIONS_VALUE
+      #   messageOnFailure: Missing property object `allow-snippet-annotations` - set it to "false" to override default behaviour
+      # - identifier: INGRESS_CVE2021_25742_INCORRECT_SERVER_SNIPPET_KEY
+      #   messageOnFailure: Forbidden property object `server-snippet` - ingress-nginx custom snippets are not allowed
+      # - identifier: CONTAINERS_MISSING_READINESSPROBE_KEY
+      #   messageOnFailure: Missing property object `readinessProbe` - add a properly configured readinessProbe to notify kubelet your Pods are ready for traffic
+      # - identifier: CRONJOB_MISSING_STARTINGDEADLINESECOND_KEY
+      #   messageOnFailure: Missing property object `startingDeadlineSeconds` - set a time limit to the cron execution to allow killing it if exceeded
+      # - identifier: HPA_MISSING_MINREPLICAS_KEY
+      #   messageOnFailure: Missing property object `minReplicas` - the value should be within the accepted boundaries recommended by the organization
+      # - identifier: K8S_DEPRECATED_APIVERSION_1.17
+      #   messageOnFailure: Incorrect value for key `apiVersion` - the version you are trying to use is not supported by the Kubernetes cluster version (>=1.17)
+      # - identifier: CONTAINERS_INCORRECT_PRIVILEGED_VALUE_TRUE
+      #   messageOnFailure: Incorrect value for key `privileged` - this mode will allow the container the same access as processes running on the host
+      - identifier: K8S_INCORRECT_KIND_VALUE_POD
+        messageOnFailure: Incorrect value for key `kind` - raw pod won't be rescheduled in the event of a node failure
+      # - identifier: CONTAINER_CVE2021_25741_INCORRECT_SUBPATH_KEY
+      #   messageOnFailure: Forbidden property object `subPath` - malicious users can gain access to files & directories outside of the volume
+      # - identifier: ENDPOINTSLICE_CVE2021_25373_INCORRECT_ADDRESSES_VALUE
+      #   messageOnFailure: Incorrect value for key `addresses` - IP address is within vulnerable ranges (127.0.0.0/8 and 169.254.0.0/16)
+      # - identifier: ARGO_WORKFLOW_INCORRECT_FAILFAST_VALUE_FALSE
+      #   messageOnFailure: 'Incorrect value for key `failFast` - value should be `true` to prevent DAG from running on all branches, regardless of the failed outcomes of the DAG branches'
+      # - identifier: ARGO_WORKFLOW_INCORRECT_SERVICE_ACCOUNT_NAME_VALUE_DEFAULT
+      #   messageOnFailure: Incorrect value for key `serviceAccountName` - when set to `default` container is exposed to possible attacks
+      # - identifier: ARGO_CONFIGMAP_MISSING_PART_OF_LABEL_VALUE_ARGOCD
+      #   messageOnFailure: 'Incorrect value for annotation `app.kubernetes.io/part-of` - value should be `argocd`, or ArgoCD won''t recognize this resource'
+      # - identifier: ARGO_ROLLOUT_MISSING_PAUSE_DURATION
+      #   messageOnFailure: Missing the key `duration` - prevent the rollout from waiting indefinitely for the pause condition
+      # - identifier: ARGO_APP_PROJECT_INCORRECT_NAMESPACE_VALUE
+      #   messageOnFailure: Incorrect value for property `namespace` - Application and AppProject have to be installed on the argocd namespace
+      # - identifier: ARGO_WORKFLOW_INCORRECT_RETRY_STRATEGY_VALUE_EMPTY
+      #   messageOnFailure: 'Incorrect value for key `retryStrategy` - empty value (`{}`) can cause failed/errored steps to keep retrying, which can result in OOM issues'
+      # - identifier: ARGO_WORKFLOW_INCORRECT_REVISION_HISTORY_LIMIT_VALUE_0
+      #   messageOnFailure: Incorrect value for key `revisionHistoryLimit` - value above 0 is required to enable rolling back from a failed deployment
+      # - identifier: ARGO_ROLLOUT_INCORRECT_SCALE_DOWN_DELAY_VALUE_BELOW_30
+      #   messageOnFailure: Incorrect value for key `scaleDownDelaySeconds` - value should be at least 30 to prevent packets from being sent to a node that killed the pod
+      # - identifier: ARGO_ROLLOUT_INCORRECT_PROGRESS_DEADLINE_ABORT_VALUE_FALSE
+      #   messageOnFailure: Incorrect value for key `progressDeadlineAbort` - value should be `true` to prevent the rollout pod from retrying indefinitely
+      # - identifier: ARGO_WORKFLOW_ENSURE_RETRY_ON_BOTH_ERROR_AND_TRANSIENT_ERROR
+      #   messageOnFailure: Incorrect value for key `retryPolicy` - the expression should include retry on steps that failed either on transient or Argo controller errors
+      - identifier: CONTAINERS_INCORRECT_READONLYROOTFILESYSTEM_VALUE
+        messageOnFailure: Incorrect value for key `readOnlyRootFilesystem` - set to 'true' to protect filesystem from potential attacks
+      - identifier: CONTAINERS_INCORRECT_KEY_HOSTPATH
+        messageOnFailure: Invalid key `hostPath` - refrain from using this mount to prevent an attack on the underlying host
+      # - identifier: CONTAINERS_INCORRECT_RESOURCES_VERBS_VALUE
+      #   messageOnFailure: Incorrect value for key `resources` and/or `verbs` - allowing containers to run the exec command can be exploited by attackers
+      # - identifier: CONTAINERS_INVALID_CAPABILITIES_VALUE
+      #   messageOnFailure: Incorrect value for key `add` - refrain from using insecure capabilities to prevent access to sensitive components
+      # - identifier: CONTAINERS_INCORRECT_RUNASGROUP_VALUE_LOWGID
+      #   messageOnFailure: Invalid value for key `runAsGroup` - must be greater than 999 to ensure container is running with non-root group membership
+      # - identifier: CONTAINERS_INCORRECT_RUNASNONROOT_VALUE
+      #   messageOnFailure: Invalid value for key `runAsNonRoot` - must be set to `true` to prevent unnecessary privileges
+      # - identifier: SRVACC_INCORRECT_AUTOMOUNTSERVICEACCOUNTTOKEN_VALUE
+      #   messageOnFailure: Invalid value for key `automountServiceAccountToken` - must be set to `false` to prevent granting unnecessary access to the service account
+      - identifier: RESOURCE_MISSING_NAME
+        messageOnFailure: Missing key `name` or `generateName` - one of them must be set to apply resource to a cluster
+      # - identifier: CONTAINERS_INCORRECT_INITIALDELAYSECONDS_VALUE
+      #   messageOnFailure: Incorrect value for key `initialDelaySeconds` - set explicitly to control the start time before a probe is initiated (min 0)
+      # - identifier: CONTAINERS_INCORRECT_PERIODSECONDS_VALUE
+      #   messageOnFailure: Incorrect value for key `periodSeconds` - set explicitly to control how often a probe is performed (min 1)
+      # - identifier: CONTAINERS_INCORRECT_TIMEOUTSECONDS_VALUE
+      #   messageOnFailure: Incorrect value for key `timeoutSeconds` - set explicitly to control when a probe times out (min 1)
+      # - identifier: CONTAINERS_INCORRECT_SUCCESSTHRESHOLD_VALUE
+      #   messageOnFailure: Incorrect value for key `successThreshold` - set explicitly to control when a probe is considered successful after having failed
+      # - identifier: CONTAINERS_INCORRECT_FAILURETHRESHOLD_VALUE
+      #   messageOnFailure: Incorrect value for key `failureThreshold` - set explicitly to control the number of retries after a probe fails (min 1)
+      # - identifier: CONTAINERS_MISSING_PRESTOP_KEY
+      #   messageOnFailure: Missing property object `preStop` - set to ensure graceful shutdown of the container
+      - identifier: CONTAINERS_INCORRECT_KEY_HOSTPORT
+        messageOnFailure: Incorrect key `hostPort` - refrain from using this key to prevent insecurely exposing your workload
+      # - identifier: CONTAINERS_MISSING_LIVENESSPROBE_KEY
+      #   messageOnFailure: Missing property object `livenessProbe` - add a properly configured livenessProbe to catch possible deadlocks
+      - identifier: CRONJOB_INVALID_SCHEDULE_VALUE
+        messageOnFailure: 'Incorrect value for key `schedule` - the (cron) schedule expressions is not valid and, therefore, will not work as expected'
+      # - identifier: CRONJOB_MISSING_CONCURRENCYPOLICY_KEY
+      #   messageOnFailure: Missing property object `concurrencyPolicy` - the behavior will be more deterministic if jobs won't run concurrently
+      # - identifier: CONTAINERS_MISSING_MEMORY_LIMIT_KEY
+      #   messageOnFailure: Missing property object `limits.memory` - value should be within the accepted boundaries recommended by the organization
+      - identifier: CONTAINERS_MISSING_KEY_ALLOWPRIVILEGEESCALATION
+        messageOnFailure: Missing key `allowPrivilegeEscalation` - set to false to prevent attackers from exploiting escalated container privileges
diff --git a/pkg/policy/policy.go b/pkg/policy/policy.go
index 3f4397e..c545451 100644
--- a/pkg/policy/policy.go
+++ b/pkg/policy/policy.go
@@ -1,14 +1,14 @@
 package policy
 
 import (
+	"github.com/datreeio/datree/pkg/defaultPolicies"
 	"github.com/datreeio/datree/pkg/validatePoliciesYaml"
 
-	"github.com/datreeio/datree/pkg/cliClient"
 	"github.com/datreeio/datree/pkg/fileReader"
 	"github.com/ghodss/yaml"
 )
 
-func GetPoliciesFileFromPath(path string) (*cliClient.EvaluationPrerunPolicies, error) {
+func GetPoliciesFileFromPath(path string) (*defaultPolicies.EvaluationPrerunPolicies, error) {
 	fileReader := fileReader.CreateFileReader(nil)
 	policiesStr, err := fileReader.ReadFileContent(path)
 	if err != nil {
@@ -22,7 +22,7 @@ func GetPoliciesFileFromPath(path string) (*cliClient.EvaluationPrerunPolicies,
 		return nil, err
 	}
 
-	var policies *cliClient.EvaluationPrerunPolicies
+	var policies *defaultPolicies.EvaluationPrerunPolicies
 	policiesBytes, err := yaml.YAMLToJSON(policiesStrBytes)
 	if err != nil {
 		return nil, err
diff --git a/pkg/validatePoliciesYaml/validatePoliciesYaml.go b/pkg/validatePoliciesYaml/validatePoliciesYaml.go
index 25b734f..62abd5f 100644
--- a/pkg/validatePoliciesYaml/validatePoliciesYaml.go
+++ b/pkg/validatePoliciesYaml/validatePoliciesYaml.go
@@ -4,8 +4,8 @@ import (
 	_ "embed"
 	"encoding/json"
 	"fmt"
+	"github.com/datreeio/datree/pkg/defaultPolicies"
 
-	"github.com/datreeio/datree/pkg/cliClient"
 	"github.com/datreeio/datree/pkg/defaultRules"
 	"github.com/datreeio/datree/pkg/jsonSchemaValidator"
 	"github.com/ghodss/yaml"
@@ -44,7 +44,7 @@ func ValidatePoliciesYaml(content []byte, policyYamlPath string) error {
 
 func validatePoliciesContent(content []byte) error {
 	// unmarshal the content
-	var schema *cliClient.EvaluationPrerunPolicies
+	var schema *defaultPolicies.EvaluationPrerunPolicies
 	err := json.Unmarshal(content, &schema)
 	if err != nil {
 		return err
@@ -67,7 +67,7 @@ func validatePoliciesContent(content []byte) error {
 	return err
 }
 
-func validateIdentifier(policies []*cliClient.Policy, customRules []*cliClient.CustomRule) error {
+func validateIdentifier(policies []*defaultPolicies.Policy, customRules []*defaultPolicies.CustomRule) error {
 
 	err := checkIdentifierInPolicy(policies, customRules)
 	if err != nil {
@@ -78,7 +78,7 @@ func validateIdentifier(policies []*cliClient.Policy, customRules []*cliClient.C
 	return err
 }
 
-func checkIdentifierInPolicy(policies []*cliClient.Policy, customRules []*cliClient.CustomRule) error {
+func checkIdentifierInPolicy(policies []*defaultPolicies.Policy, customRules []*defaultPolicies.CustomRule) error {
 	err := checkIdentifierUniquenessInPolicy(policies)
 	if err != nil {
 		return err
@@ -91,7 +91,7 @@ func checkIdentifierInPolicy(policies []*cliClient.Policy, customRules []*cliCli
 	return nil
 }
 
-func checkIdentifierExistence(policies []*cliClient.Policy, customRules []*cliClient.CustomRule) error {
+func checkIdentifierExistence(policies []*defaultPolicies.Policy, customRules []*defaultPolicies.CustomRule) error {
 	defaultRules, err := defaultRules.GetDefaultRules()
 	if err != nil {
 		return err
@@ -127,7 +127,7 @@ func checkIdentifierExistence(policies []*cliClient.Policy, customRules []*cliCl
 	return nil
 }
 
-func checkIdentifierUniquenessInPolicy(policies []*cliClient.Policy) error {
+func checkIdentifierUniquenessInPolicy(policies []*defaultPolicies.Policy) error {
 	for index, policy := range policies {
 		propertyValuesExistenceMap := make(map[string]bool)
 		rules := policy.Rules
@@ -142,7 +142,7 @@ func checkIdentifierUniquenessInPolicy(policies []*cliClient.Policy) error {
 	return nil
 }
 
-func checkCustomRulesIdentifiersUniqueness(customRules []*cliClient.CustomRule) error {
+func checkCustomRulesIdentifiersUniqueness(customRules []*defaultPolicies.CustomRule) error {
 	defaultRules, err := defaultRules.GetDefaultRules()
 	if err != nil {
 		return err
@@ -169,7 +169,7 @@ func checkCustomRulesIdentifiersUniqueness(customRules []*cliClient.CustomRule)
 	return nil
 }
 
-func validateSingleDefaultPolicy(policies []*cliClient.Policy) error {
+func validateSingleDefaultPolicy(policies []*defaultPolicies.Policy) error {
 	sawDefault := false
 	for _, policy := range policies {
 
@@ -187,7 +187,7 @@ func validateSingleDefaultPolicy(policies []*cliClient.Policy) error {
 	return nil
 }
 
-func validateSchemaField(customRules []*cliClient.CustomRule) error {
+func validateSchemaField(customRules []*defaultPolicies.CustomRule) error {
 	for index, rule := range customRules {
 		var err error
 		var jsonContent string
diff --git a/scripts/define_release_version.sh b/scripts/define_release_version.sh
index e98bdf3..1cae7c4 100644
--- a/scripts/define_release_version.sh
+++ b/scripts/define_release_version.sh
@@ -2,6 +2,7 @@
 set -e
 
 if test -z "$1"; then
+    git fetch --prune --unshallow --tags # needed for getting list of tags
     latestRcTag=$(git tag --sort=-version:refname | grep "\-rc$" | head -n 1)
 else
     latestRcTag="$1"
diff --git a/scripts/deploy_release_candidate.sh b/scripts/deploy_release_candidate.sh
index ac2d00d..014f2a6 100644
--- a/scripts/deploy_release_candidate.sh
+++ b/scripts/deploy_release_candidate.sh
@@ -4,6 +4,7 @@ set -ex
 MAJOR_VERSION=1
 MINOR_VERSION=6
 
+git fetch --prune --unshallow --tags # needed for getting list of tags
 latestRcTag=$(git tag --sort=-version:refname | grep -E "^${MAJOR_VERSION}\.${MINOR_VERSION}.[0-9]+-rc" | head -n 1 | grep --only-matching "^${MAJOR_VERSION}\.${MINOR_VERSION}.[0-9]\+" || true)
 
 if [ "$latestRcTag" == "" ]; then
@@ -17,8 +18,8 @@ echo $DATREE_BUILD_VERSION
 
 v_release_tag=v$DATREE_BUILD_VERSION
 
-git tag $DATREE_BUILD_VERSION -a -m "Generated tag from TravisCI for build $TRAVIS_BUILD_NUMBER"
-git tag $v_release_tag -a -m "Generated tag with v from TravisCI for build $TRAVIS_BUILD_NUMBER"
+git tag $DATREE_BUILD_VERSION -a -m "Generated tag from GH action for build $GITHUB_ACTION_RUN_ID"
+git tag $v_release_tag -a -m "Generated tag with v from GH action for build $GITHUB_ACTION_RUN_ID"
 git push --tags
 
 curl -sL https://git.io/goreleaser | GORELEASER_CURRENT_TAG=$DATREE_BUILD_VERSION GO_BUILD_TAG=staging VERSION=v$GORELEASER_VERSION bash
diff --git a/scripts/release.sh b/scripts/release.sh
index d2917d5..d94b07b 100644
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -4,11 +4,11 @@ set -ex
 release_tag=$RELEASE_VERSION
 v_release_tag=v$release_tag
 
+git fetch
 git checkout "$release_tag-rc"
 
-
-git tag $release_tag -a -m "Generated tag from manual TravisCI for production build $TRAVIS_BUILD_NUMBER"
-git tag $v_release_tag -a -m "Generated tag with v from manual TravisCI for production build $TRAVIS_BUILD_NUMBER"
+git tag $release_tag -a -m "Generated tag from manual GH action production build $GITHUB_ACTION_RUN_ID"
+git tag $v_release_tag -a -m "Generated tag with v from manual GH action for production build $GITHUB_ACTION_RUN_ID"
 
 git push origin $release_tag
 git push origin $v_release_tag
@@ -22,7 +22,5 @@ curl -sL https://git.io/goreleaser | GORELEASER_CURRENT_TAG=$DATREE_BUILD_VERSIO
 
 bash ./scripts/upload_install_scripts.sh
 
-bash ./scripts/brew_push_formula.sh production $DATREE_BUILD_VERSION
-
 git checkout -b "release/${release_tag}"
 git push origin "release/${release_tag}"


Test patch:
diff --git a/bl/policy/policy_factory_test.go b/bl/policy/policy_factory_test.go
index ccea3f5..350ac9f 100644
--- a/bl/policy/policy_factory_test.go
+++ b/bl/policy/policy_factory_test.go
@@ -6,6 +6,8 @@ import (
 	"os"
 	"testing"
 
+	"github.com/datreeio/datree/pkg/defaultPolicies"
+
 	"github.com/datreeio/datree/pkg/defaultRules"
 	"github.com/datreeio/datree/pkg/fileReader"
 
@@ -30,7 +32,7 @@ func TestCreatePolicy(t *testing.T) {
 			panic(err)
 		}
 
-		policy, _ := CreatePolicy(preRunData.PoliciesJson, "", preRunData.RegistrationURL, defaultRules)
+		policy, _ := CreatePolicy(preRunData.PoliciesJson, "", preRunData.RegistrationURL, defaultRules, preRunData.IsAnonymous)
 		var expectedRules []RuleWithSchema
 
 		for _, defaultRule := range defaultRules.Rules {
@@ -62,7 +64,7 @@ func TestCreatePolicy(t *testing.T) {
 			panic(err)
 		}
 
-		policy, err := CreatePolicy(preRunData.PoliciesJson, "labels_best_practices2", preRunData.RegistrationURL, defaultRules)
+		policy, err := CreatePolicy(preRunData.PoliciesJson, "labels_best_practices2", preRunData.RegistrationURL, defaultRules, preRunData.IsAnonymous)
 		var expectedRules []RuleWithSchema
 
 		if err != nil {
@@ -89,7 +91,7 @@ func TestCreatePolicy(t *testing.T) {
 			panic(err)
 		}
 
-		policy, err := CreatePolicy(preRunData.PoliciesJson, "labels_best_practices3", preRunData.RegistrationURL, defaultRules)
+		policy, err := CreatePolicy(preRunData.PoliciesJson, "labels_best_practices3", preRunData.RegistrationURL, defaultRules, preRunData.IsAnonymous)
 		var expectedRules []RuleWithSchema
 		if err != nil {
 			panic(err)
@@ -108,21 +110,23 @@ func TestCreatePolicy(t *testing.T) {
 	})
 	t.Run("Test Create Policy for anonymous user with --policy flag Default", func(t *testing.T) {
 		defaultRules, err := defaultRules.GetDefaultRules()
+		defaultPolicies := defaultPolicies.GetDefaultPoliciesStruct()
 		if err != nil {
 			panic(err)
 		}
 
-		_, err = CreatePolicy(nil, "Default", preRunData.RegistrationURL, defaultRules)
+		_, err = CreatePolicy(defaultPolicies, "Default", preRunData.RegistrationURL, defaultRules, true)
 
 		assert.Equal(t, nil, err)
 	})
 	t.Run("Test Create Policy for anonymous user with --policy flag not default", func(t *testing.T) {
 		defaultRules, err := defaultRules.GetDefaultRules()
+		defaultPolicies := defaultPolicies.GetDefaultPoliciesStruct()
 		if err != nil {
 			panic(err)
 		}
 
-		policy, err := CreatePolicy(nil, "my-policy", preRunData.RegistrationURL, defaultRules)
+		policy, err := CreatePolicy(defaultPolicies, "my-policy", preRunData.RegistrationURL, defaultRules, true)
 
 		assert.Equal(t, fmt.Errorf("policy my-policy doesn't exist, sign in to the dashboard to customize your policies: %s", preRunData.RegistrationURL), err)
 		assert.Equal(t, Policy{}, policy)
diff --git a/cmd/test/main.go b/cmd/test/main.go
index 275123c..a846a88 100644
--- a/cmd/test/main.go
+++ b/cmd/test/main.go
@@ -12,14 +12,14 @@ import (
 	"sync"
 	"time"
 
-	"github.com/datreeio/datree/pkg/defaultRules"
-
 	"github.com/datreeio/datree/bl/files"
 	"github.com/datreeio/datree/bl/messager"
 	policy_factory "github.com/datreeio/datree/bl/policy"
 	"github.com/datreeio/datree/bl/validation"
 	"github.com/datreeio/datree/pkg/ciContext"
 	"github.com/datreeio/datree/pkg/cliClient"
+	"github.com/datreeio/datree/pkg/defaultPolicies"
+	"github.com/datreeio/datree/pkg/defaultRules"
 	"github.com/datreeio/datree/pkg/evaluation"
 	"github.com/datreeio/datree/pkg/policy"
 	"github.com/pkg/errors"
@@ -254,7 +254,7 @@ func GenerateTestCommandData(testCommandFlags *TestCommandFlags, localConfigCont
 		k8sVersion = "1.20.0"
 	}
 
-	var policies *cliClient.EvaluationPrerunPolicies
+	var policies *defaultPolicies.EvaluationPrerunPolicies
 	var err error
 
 	if testCommandFlags.PolicyConfig != "" {
@@ -275,7 +275,7 @@ func GenerateTestCommandData(testCommandFlags *TestCommandFlags, localConfigCont
 		return nil, err
 	}
 
-	policy, err := policy_factory.CreatePolicy(policies, testCommandFlags.PolicyName, evaluationPrerunDataResp.RegistrationURL, defaultRules)
+	policy, err := policy_factory.CreatePolicy(policies, testCommandFlags.PolicyName, evaluationPrerunDataResp.RegistrationURL, defaultRules, evaluationPrerunDataResp.IsAnonymous)
 	if err != nil {
 		return nil, err
 	}
diff --git a/cmd/test/main_test.go b/cmd/test/main_test.go
index f62c4f3..e08fc4a 100644
--- a/cmd/test/main_test.go
+++ b/cmd/test/main_test.go
@@ -358,7 +358,7 @@ func test_all_k8s_resources_tested() *TestFlowTestCase {
 		panic(err)
 	}
 
-	policy, _ := policy_factory.CreatePolicy(preRunData.PoliciesJson, "", preRunData.RegistrationURL, defaultRules)
+	policy, _ := policy_factory.CreatePolicy(preRunData.PoliciesJson, "", preRunData.RegistrationURL, defaultRules, preRunData.IsAnonymous)
 	close(invalidFilesChan)
 
 	return &TestFlowTestCase{
@@ -495,7 +495,7 @@ func test_no_k8s_resources_found() *TestFlowTestCase {
 		panic(err)
 	}
 
-	policy, _ := policy_factory.CreatePolicy(preRunData.PoliciesJson, "", preRunData.RegistrationURL, defaultRules)
+	policy, _ := policy_factory.CreatePolicy(preRunData.PoliciesJson, "", preRunData.RegistrationURL, defaultRules, preRunData.IsAnonymous)
 	paths := []string{root + "/docker-compose-config.yaml", root + "/simple.json", root + "/simple.yaml"}
 	filesConfigurationsChan := make(chan *extractor.FileConfigurations, 3)
 	go func() {
@@ -733,7 +733,7 @@ func setup() {
 		panic(err)
 	}
 
-	testingPolicy, _ = policy_factory.CreatePolicy(prerunData.PoliciesJson, "", prerunData.RegistrationURL, defaultRules)
+	testingPolicy, _ = policy_factory.CreatePolicy(prerunData.PoliciesJson, "", prerunData.RegistrationURL, defaultRules, prerunData.IsAnonymous)
 }
 
 func TestTestCommandFlagsValidation(t *testing.T) {
diff --git a/pkg/cliClient/cliClient_test.go b/pkg/cliClient/cliClient_test.go
index fcc091c..b8fb829 100644
--- a/pkg/cliClient/cliClient_test.go
+++ b/pkg/cliClient/cliClient_test.go
@@ -6,15 +6,12 @@ import (
 	"net/http"
 	"testing"
 
-	"github.com/datreeio/datree/pkg/networkValidator"
-
+	"github.com/datreeio/datree/bl/files"
 	"github.com/datreeio/datree/pkg/ciContext"
-
+	"github.com/datreeio/datree/pkg/defaultPolicies"
 	"github.com/datreeio/datree/pkg/fileReader"
-
-	"github.com/datreeio/datree/bl/files"
-
 	"github.com/datreeio/datree/pkg/httpClient"
+	"github.com/datreeio/datree/pkg/networkValidator"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 )
@@ -132,6 +129,7 @@ type PublishPoliciesTestCase struct {
 func TestRequestEvaluationPrerunDataSuccess(t *testing.T) {
 	tests := []*RequestEvaluationPrerunDataTestCase{
 		test_requestEvaluationPrerunData_success(),
+		test_requestEvaluationPrerunData_anonymousSuccess(),
 	}
 
 	httpClientMock := mockHTTPClient{}
@@ -437,6 +435,65 @@ func test_requestEvaluationPrerunData_success() *RequestEvaluationPrerunDataTest
 	}
 }
 
+func test_requestEvaluationPrerunData_anonymousSuccess() *RequestEvaluationPrerunDataTestCase {
+	preRunDataServerResponse := mockGetPreRunData()
+	preRunDataServerResponse.IsAnonymous = true
+	preRunDataServerResponse.PoliciesJson = nil
+
+	preRunDataExpectedOutput := mockGetPreRunData()
+	preRunDataExpectedOutput.IsAnonymous = true
+	preRunDataExpectedOutput.PoliciesJson = defaultPolicies.GetDefaultPoliciesStruct()
+
+	return &RequestEvaluationPrerunDataTestCase{
+		name: "success - get prerun data for anonymous evaluation",
+		args: struct {
+			token   string
+			offline string
+		}{
+			token: "internal_test_token",
+		},
+		mock: struct {
+			response struct {
+				status int
+				body   *EvaluationPrerunDataResponse
+				error  error
+			}
+		}{
+			response: struct {
+				status int
+				body   *EvaluationPrerunDataResponse
+				error  error
+			}{
+				status: http.StatusOK,
+				body:   preRunDataServerResponse,
+			},
+		},
+		expected: struct {
+			request struct {
+				method  string
+				uri     string
+				body    interface{}
+				headers map[string]string
+			}
+			responseErr error
+			response    *EvaluationPrerunDataResponse
+		}{
+			request: struct {
+				method  string
+				uri     string
+				body    interface{}
+				headers map[string]string
+			}{
+				method:  http.MethodGet,
+				uri:     "/cli/evaluation/tokens/internal_test_token/prerun?isCi=false",
+				body:    nil,
+				headers: nil,
+			},
+			response: preRunDataExpectedOutput,
+		},
+	}
+}
+
 func test_requestEvaluationPrerunData_error() *RequestEvaluationPrerunDataTestCase {
 	return &RequestEvaluationPrerunDataTestCase{
 		name: "fail - get prerun data for evaluation",
@@ -494,10 +551,11 @@ func test_requestEvaluationPrerunData_network_error(offlineMode string, expected
 	emptyRes := &EvaluationPrerunDataResponse{}
 	if offlineMode == "local" {
 		emptyRes.IsPolicyAsCodeMode = true
+		emptyRes.PoliciesJson = defaultPolicies.GetDefaultPoliciesStruct()
 	}
 
 	return &RequestEvaluationPrerunDataTestCase{
-		name: "fail - get prerun data for evaluation",
+		name: "fail - get prerun data for evaluation network error",
 		args: struct {
 			token   string
 			offline string
diff --git a/pkg/defaultPolicies/defaultPolicies_test.go b/pkg/defaultPolicies/defaultPolicies_test.go
new file mode 100644
index 0000000..4a1d4bb
--- /dev/null
+++ b/pkg/defaultPolicies/defaultPolicies_test.go
@@ -0,0 +1,17 @@
+package defaultPolicies_test
+
+import (
+	_ "embed"
+	"testing"
+
+	"github.com/datreeio/datree/pkg/defaultPolicies"
+
+	"github.com/datreeio/datree/pkg/validatePoliciesYaml"
+)
+
+func TestMain(m *testing.M) {
+	err := validatePoliciesYaml.ValidatePoliciesYaml([]byte(defaultPolicies.DefaultPoliciesFileContent), "./defaultPolicies.yaml")
+	if err != nil {
+		panic(err)
+	}
+}
diff --git a/pkg/evaluation/evaluator_test.go b/pkg/evaluation/evaluator_test.go
index 8ca96bb..568e617 100644
--- a/pkg/evaluation/evaluator_test.go
+++ b/pkg/evaluation/evaluator_test.go
@@ -135,7 +135,7 @@ func TestEvaluate(t *testing.T) {
 		panic(err)
 	}
 
-	policy, _ := policy_factory.CreatePolicy(prerunData.PoliciesJson, "", prerunData.RegistrationURL, defaultRules)
+	policy, _ := policy_factory.CreatePolicy(prerunData.PoliciesJson, "", prerunData.RegistrationURL, defaultRules, prerunData.IsAnonymous)
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -215,7 +215,7 @@ func request_evaluation_all_valid() *evaluateTestCase {
 		panic(err)
 	}
 
-	policy, _ := policy_factory.CreatePolicy(prerunData.PoliciesJson, "", prerunData.RegistrationURL, defaultRules)
+	policy, _ := policy_factory.CreatePolicy(prerunData.PoliciesJson, "", prerunData.RegistrationURL, defaultRules, prerunData.IsAnonymous)
 
 	return &evaluateTestCase{
 		name: "should request validation without invalid files",
@@ -266,7 +266,7 @@ func request_evaluation_all_invalid() *evaluateTestCase {
 		panic(err)
 	}
 
-	policy, _ := policy_factory.CreatePolicy(prerunData.PoliciesJson, "", prerunData.RegistrationURL, defaultRules)
+	policy, _ := policy_factory.CreatePolicy(prerunData.PoliciesJson, "", prerunData.RegistrationURL, defaultRules, prerunData.IsAnonymous)
 
 	return &evaluateTestCase{
 		name: "should not request validation if there are no valid files",
diff --git a/pkg/policy/policy_test.go b/pkg/policy/policy_test.go
index e9609e4..7bebe68 100644
--- a/pkg/policy/policy_test.go
+++ b/pkg/policy/policy_test.go
@@ -9,7 +9,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/datreeio/datree/pkg/cliClient"
+	"github.com/datreeio/datree/pkg/defaultPolicies"
+
 	"github.com/datreeio/datree/pkg/defaultRules"
 	"github.com/datreeio/datree/pkg/fileReader"
 	"github.com/datreeio/datree/pkg/jsonSchemaValidator"
@@ -128,11 +129,11 @@ func getFileData(filename string) (int, bool) {
 	return id, isPass
 }
 
-func expectedPoliciesContent(t *testing.T, path string) *cliClient.EvaluationPrerunPolicies {
+func expectedPoliciesContent(t *testing.T, path string) *defaultPolicies.EvaluationPrerunPolicies {
 	fileReader := fileReader.CreateFileReader(nil)
 	policiesStr, _ := fileReader.ReadFileContent(path)
 
-	var policiesJson *cliClient.EvaluationPrerunPolicies
+	var policiesJson *defaultPolicies.EvaluationPrerunPolicies
 	policiesBytes, _ := yaml.YAMLToJSON([]byte(policiesStr))
 
 	err := yaml.Unmarshal(policiesBytes, &policiesJson)