feat: scaffold deployment-policies monorepo

OPA/Rego deployment gateway policies: 5 rules (valid-environment, require-approvals, no-self-approval, block-weekends, freeze-window), a deploy-gate combining them, JSON schemas, scenario-driven tests, Gitea Actions CI (verify + publish to generic registry), changesets versioning, Makefile and scripts.
2026-09-15 19:05:03 +02:00
commit 59cacfdfab
48 changed files with 1703 additions and 0 deletions
@@ -0,0 +1,96 @@
+{
+  "scenarios": {
+    "enough_approvals": {
+      "input": {
+        "deployment": {
+          "environment": "production",
+          "service": "payments-api",
+          "version": "1.2.3",
+          "requested_by": "alice",
+          "created_at": "2026-09-15T10:00:00Z"
+        },
+        "approvals": [
+          {"by": "bob", "at": "2026-09-15T09:00:00Z", "active": true},
+          {"by": "carol", "at": "2026-09-15T09:30:00Z", "active": true}
+        ]
+      },
+      "data": {
+        "config": {
+          "production": {"min_approvals": 2}
+        }
+      },
+      "expect": {
+        "allow": true,
+        "violations": []
+      }
+    },
+    "insufficient_approvals": {
+      "input": {
+        "deployment": {
+          "environment": "production",
+          "service": "payments-api",
+          "version": "1.2.3",
+          "requested_by": "alice",
+          "created_at": "2026-09-15T10:00:00Z"
+        },
+        "approvals": [
+          {"by": "bob", "at": "2026-09-15T09:00:00Z", "active": true}
+        ]
+      },
+      "data": {
+        "config": {
+          "production": {"min_approvals": 2}
+        }
+      },
+      "expect": {
+        "allow": false,
+        "violations": ["insufficient_approvals"]
+      }
+    },
+    "revoked_approval_not_counted": {
+      "input": {
+        "deployment": {
+          "environment": "production",
+          "service": "payments-api",
+          "version": "1.2.3",
+          "requested_by": "alice",
+          "created_at": "2026-09-15T10:00:00Z"
+        },
+        "approvals": [
+          {"by": "bob", "at": "2026-09-15T09:00:00Z", "active": true},
+          {"by": "carol", "at": "2026-09-15T09:30:00Z", "active": false}
+        ]
+      },
+      "data": {
+        "config": {
+          "production": {"min_approvals": 2}
+        }
+      },
+      "expect": {
+        "allow": false,
+        "violations": ["insufficient_approvals"]
+      }
+    },
+    "no_approval_required": {
+      "input": {
+        "deployment": {
+          "environment": "development",
+          "service": "payments-api",
+          "version": "1.2.3",
+          "requested_by": "alice",
+          "created_at": "2026-09-15T10:00:00Z"
+        },
+        "approvals": []
+      },
+      "data": {
+        "config": {
+          "development": {"min_approvals": 0}
+        }
+      },
+      "expect": {
+        "allow": true,
+        "violations": []
+      }
+    }
+  }
+}