feat: scaffold deployment-policies monorepo

OPA/Rego deployment gateway policies: 5 rules (valid-environment, require-approvals, no-self-approval, block-weekends, freeze-window), a deploy-gate combining them, JSON schemas, scenario-driven tests, Gitea Actions CI (verify + publish to generic registry), changesets versioning, Makefile and scripts.
2026-09-15 19:05:03 +02:00
commit 59cacfdfab
48 changed files with 1703 additions and 0 deletions
@@ -0,0 +1,107 @@
+{
+  "scenarios": {
+    "all_pass": {
+      "input": {
+        "deployment": {
+          "environment": "production",
+          "service": "payments-api",
+          "version": "1.2.3",
+          "requested_by": "alice",
+          "created_at": "2026-09-15T10:00:00Z"
+        },
+        "approvals": [
+          {"by": "bob", "at": "2026-09-15T09:00:00Z", "active": true},
+          {"by": "carol", "at": "2026-09-15T09:30:00Z", "active": true}
+        ]
+      },
+      "data": {
+        "config": {
+          "production": {"min_approvals": 2, "block_weekends": true}
+        },
+        "freeze_windows": [
+          {"environment": "production", "start": "2026-12-20T00:00:00Z", "end": "2026-12-31T23:59:59Z"}
+        ]
+      },
+      "expect": {
+        "allow": true,
+        "violations": []
+      }
+    },
+    "weekend_plus_no_approvals": {
+      "input": {
+        "deployment": {
+          "environment": "production",
+          "service": "payments-api",
+          "version": "1.2.3",
+          "requested_by": "alice",
+          "created_at": "2026-09-12T10:00:00Z"
+        },
+        "approvals": [
+          {"by": "bob", "at": "2026-09-12T09:00:00Z", "active": true}
+        ]
+      },
+      "data": {
+        "config": {
+          "production": {"min_approvals": 2, "block_weekends": true}
+        },
+        "freeze_windows": []
+      },
+      "expect": {
+        "allow": false,
+        "violations": ["weekend_deploy", "insufficient_approvals"]
+      }
+    },
+    "freeze_window_blocks": {
+      "input": {
+        "deployment": {
+          "environment": "production",
+          "service": "payments-api",
+          "version": "1.2.3",
+          "requested_by": "alice",
+          "created_at": "2026-12-24T10:00:00Z"
+        },
+        "approvals": [
+          {"by": "bob", "at": "2026-12-24T09:00:00Z", "active": true},
+          {"by": "carol", "at": "2026-12-24T09:30:00Z", "active": true}
+        ]
+      },
+      "data": {
+        "config": {
+          "production": {"min_approvals": 2, "block_weekends": false}
+        },
+        "freeze_windows": [
+          {"environment": "production", "start": "2026-12-20T00:00:00Z", "end": "2026-12-31T23:59:59Z"}
+        ]
+      },
+      "expect": {
+        "allow": false,
+        "violations": ["deploy_in_freeze"]
+      }
+    },
+    "self_approval": {
+      "input": {
+        "deployment": {
+          "environment": "production",
+          "service": "payments-api",
+          "version": "1.2.3",
+          "requested_by": "alice",
+          "created_at": "2026-09-15T10:00:00Z"
+        },
+        "approvals": [
+          {"by": "alice", "at": "2026-09-15T09:00:00Z", "active": true},
+          {"by": "carol", "at": "2026-09-15T09:30:00Z", "active": true}
+        ]
+      },
+      "data": {
+        "config": {
+          "production": {"min_approvals": 2, "block_weekends": true}
+        },
+        "freeze_windows": []
+      },
+      "expect": {
+        "allow": false,
+        "violations": ["self_approval"]
+      }
+    }
+  }
+}