jdevega
59cacfdfab
OPA/Rego deployment gateway policies: 5 rules (valid-environment, require-approvals, no-self-approval, block-weekends, freeze-window), a deploy-gate combining them, JSON schemas, scenario-driven tests, Gitea Actions CI (verify + publish to generic registry), changesets versioning, Makefile and scripts.
50 lines
1.7 KiB
Rego
50 lines
1.7 KiB
Rego
# METADATA
|
|
# schemas:
|
|
# - input: schema["input"]
|
|
# - data: schema["data"]
|
|
|
|
package gate.deploy_gate_test
|
|
|
|
import data.rules.block_weekends as block_weekends
|
|
import data.rules.freeze_window as freeze_window
|
|
import data.rules.no_self_approval as no_self_approval
|
|
import data.rules.require_approvals as require_approvals
|
|
import data.rules.valid_environment as valid_environment
|
|
import rego.v1
|
|
|
|
violations_for[scenario_name] contains code if {
|
|
some scenario_name, scenario in data.scenarios
|
|
some v in valid_environment.violations with input as scenario.input with data.deploygate as scenario.data
|
|
code := v.code
|
|
}
|
|
|
|
violations_for[scenario_name] contains code if {
|
|
some scenario_name, scenario in data.scenarios
|
|
some v in require_approvals.violations with input as scenario.input with data.deploygate as scenario.data
|
|
code := v.code
|
|
}
|
|
|
|
violations_for[scenario_name] contains code if {
|
|
some scenario_name, scenario in data.scenarios
|
|
some v in no_self_approval.violations with input as scenario.input with data.deploygate as scenario.data
|
|
code := v.code
|
|
}
|
|
|
|
violations_for[scenario_name] contains code if {
|
|
some scenario_name, scenario in data.scenarios
|
|
some v in block_weekends.violations with input as scenario.input with data.deploygate as scenario.data
|
|
code := v.code
|
|
}
|
|
|
|
violations_for[scenario_name] contains code if {
|
|
some scenario_name, scenario in data.scenarios
|
|
some v in freeze_window.violations with input as scenario.input with data.deploygate as scenario.data
|
|
code := v.code
|
|
}
|
|
|
|
test_scenario[scenario_name] if {
|
|
some scenario_name, scenario in data.scenarios
|
|
expected := {code | code := scenario.expect.violations[_]}
|
|
{code | code := violations_for[scenario_name][_]} == expected
|
|
}
|