feat: scaffold deployment-policies monorepo

OPA/Rego deployment gateway policies: 5 rules (valid-environment, require-approvals, no-self-approval, block-weekends, freeze-window), a deploy-gate combining them, JSON schemas, scenario-driven tests, Gitea Actions CI (verify + publish to generic registry), changesets versioning, Makefile and scripts.
2026-09-15 19:05:03 +02:00
commit 59cacfdfab
48 changed files with 1703 additions and 0 deletions
@@ -0,0 +1,107 @@
+{
+  "scenarios": {
+    "weekday_ok": {
+      "input": {
+        "deployment": {
+          "environment": "production",
+          "service": "payments-api",
+          "version": "1.2.3",
+          "requested_by": "alice",
+          "created_at": "2026-09-15T10:00:00Z"
+        },
+        "approvals": []
+      },
+      "data": {
+        "config": {
+          "production": {"block_weekends": true}
+        }
+      },
+      "expect": {
+        "allow": true,
+        "violations": []
+      }
+    },
+    "saturday_blocked": {
+      "input": {
+        "deployment": {
+          "environment": "production",
+          "service": "payments-api",
+          "version": "1.2.3",
+          "requested_by": "alice",
+          "created_at": "2026-09-12T10:00:00Z"
+        },
+        "approvals": []
+      },
+      "data": {
+        "config": {
+          "production": {"block_weekends": true}
+        }
+      },
+      "expect": {
+        "allow": false,
+        "violations": ["weekend_deploy"]
+      }
+    },
+    "sunday_blocked": {
+      "input": {
+        "deployment": {
+          "environment": "production",
+          "service": "payments-api",
+          "version": "1.2.3",
+          "requested_by": "alice",
+          "created_at": "2026-09-13T10:00:00Z"
+        },
+        "approvals": []
+      },
+      "data": {
+        "config": {
+          "production": {"block_weekends": true}
+        }
+      },
+      "expect": {
+        "allow": false,
+        "violations": ["weekend_deploy"]
+      }
+    },
+    "weekend_not_blocked_when_disabled": {
+      "input": {
+        "deployment": {
+          "environment": "development",
+          "service": "payments-api",
+          "version": "1.2.3",
+          "requested_by": "alice",
+          "created_at": "2026-09-12T10:00:00Z"
+        },
+        "approvals": []
+      },
+      "data": {
+        "config": {
+          "development": {"block_weekends": false}
+        }
+      },
+      "expect": {
+        "allow": true,
+        "violations": []
+      }
+    },
+    "weekend_ignored_when_config_missing": {
+      "input": {
+        "deployment": {
+          "environment": "production",
+          "service": "payments-api",
+          "version": "1.2.3",
+          "requested_by": "alice",
+          "created_at": "2026-09-12T10:00:00Z"
+        },
+        "approvals": []
+      },
+      "data": {
+        "config": {}
+      },
+      "expect": {
+        "allow": true,
+        "violations": []
+      }
+    }
+  }
+}