The flag action was added in 1.36.0 and allows policies, as an action, to set a flag that can be tested later in the policy. However, in some cases the flag data can leak across policy invocations.

This only happens if code invoking the policy check recycles the policy data that it passes in. In Koji, this can currently happen in the following places:

• in make_task, the same policy_data is used for the channel policy and priority policy checks
• in PolicyTest, the check passes its data through to the subpolicy
• in moveAllBuilds, the same policy_data dictionary is reused and updated for each build

All other policy checks appear to create fresh data for each check.