feat: scaffold deployment-policies monorepo

OPA/Rego deployment gateway policies: 5 rules (valid-environment, require-approvals, no-self-approval, block-weekends, freeze-window), a deploy-gate combining them, JSON schemas, scenario-driven tests, Gitea Actions CI (verify + publish to generic registry), changesets versioning, Makefile and scripts.
2026-09-15 19:05:03 +02:00
commit 59cacfdfab
48 changed files with 1703 additions and 0 deletions
@@ -0,0 +1,59 @@
+name: ci
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install npm deps
+        run: npm ci
+
+      - name: Install OPA
+        run: ./scripts/install-opa.sh
+
+      - name: Check, lint and test
+        run: ./scripts/check.sh
+
+      - name: Build bundles
+        run: ./scripts/build.sh
+
+  publish:
+    if: github.ref == 'refs/heads/main'
+    needs: verify
+    runs-on: ubuntu-latest
+    environment: release
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install npm deps
+        run: npm ci
+
+      - name: Install OPA
+        run: ./scripts/install-opa.sh
+
+      - name: Build bundles
+        run: ./scripts/build.sh
+
+      - name: Publish bundles to Gitea package registry
+        env:
+          GITEA_URL: https://gitea.devegamoreno.com
+          GITEA_OWNER: jdevega
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: ./scripts/publish.sh