feat: scaffold deployment-policies monorepo

OPA/Rego deployment gateway policies: 5 rules (valid-environment, require-approvals, no-self-approval, block-weekends, freeze-window), a deploy-gate combining them, JSON schemas, scenario-driven tests, Gitea Actions CI (verify + publish to generic registry), changesets versioning, Makefile and scripts.
2026-09-15 19:05:03 +02:00
commit 59cacfdfab
48 changed files with 1703 additions and 0 deletions
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Publishes every built rule/gate bundle to the Gitea generic package registry.
+#
+# Requires:
+#   - GITEA_TOKEN   API token with write:package scope
+#   - GITEA_URL     e.g. https://gitea.devegamoreno.com (default: env or https://gitea.devegamoreno.com)
+#   - GITEA_OWNER   repo/package owner (default: git remote owner or jdevega)
+#
+# Registry path: /api/packages/{owner}/generic/{package}/{version}/{file}
+
+set -euo pipefail
+
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/common.sh"
+
+GITEA_URL="${GITEA_URL:-https://gitea.devegamoreno.com}"
+GITEA_OWNER="${GITEA_OWNER:-jdevega}"
+GITEA_TOKEN="${GITEA_TOKEN:-}"
+[ -n "$GITEA_TOKEN" ] || { echo "ERROR: GITEA_TOKEN is not set" >&2; exit 1; }
+
+publish_file() {
+  local pkg="$1" version="$2" file="$3"
+  local url="$GITEA_URL/api/packages/$GITEA_OWNER/generic/$pkg/$version/$(basename "$file")"
+  echo "==> publish $pkg@$version $(basename "$file")"
+  curl -fsSL \
+    -H "Authorization: token $GITEA_TOKEN" \
+    -H "Content-Type: application/octet-stream" \
+    --upload-file "$file" \
+    "$url"
+  echo
+}
+
+if [ ! -d "$ARTIFACTS_DIR" ]; then
+  echo "No artifacts found. Run 'make build' first." >&2
+  exit 1
+fi
+
+for bundle in "$ARTIFACTS_DIR"/rules/*/*/bundle.tar.gz; do
+  path="${bundle#"$ARTIFACTS_DIR/rules/"}"
+  name="${path%%/*}"
+  version="$(basename "$(dirname "$bundle")")"
+  publish_file "rule-$name" "$version" "$bundle"
+done
+
+for bundle in "$ARTIFACTS_DIR"/gates/*/*/bundle.tar.gz; do
+  path="${bundle#"$ARTIFACTS_DIR/gates/"}"
+  name="${path%%/*}"
+  version="$(basename "$(dirname "$bundle")")"
+  publish_file "gate-$name" "$version" "$bundle"
+done
+
+echo "Publish complete."