The same package sits on your Testing branch, on your Production branch and in your other projects. Reviewing it once is enough. When a person approves a package, we remember that decision for your whole organization: the license, the license text, the steps that were ticked and who decided. Wherever the same package version turns up next, it arrives already decided, and the package says who reviewed it and when.
When it is used again
- It is the same package at the same version.
- What we found about its license is still the same: the same statement from the publisher, the same result and the same license files.
- The project it lands in allows it. If that project ships binaries and a step is open there, the license and the text are copied and you are left with that one step.
- A person made the decision. Packages approved automatically are not remembered, because each project chooses its own licenses for that.
A new version is a new decision. So is a package whose license file or publisher statement changed since you reviewed it. Your own saved text never ends the memory, so a teammate who pasted the right text on one branch still decides the untouched package on the other one.
Taking a decision back
Reopening a package, parking it for your legal team, changing its license or its text, or removing a tick all end the memory. The same package version on this project's other branches goes back to Needs review with it. Your other projects keep what they decided there, because each one decided in its own situation.