jdevega
59cacfdfab
OPA/Rego deployment gateway policies: 5 rules (valid-environment, require-approvals, no-self-approval, block-weekends, freeze-window), a deploy-gate combining them, JSON schemas, scenario-driven tests, Gitea Actions CI (verify + publish to generic registry), changesets versioning, Makefile and scripts.
35 lines
934 B
Rego
35 lines
934 B
Rego
# METADATA
|
|
# schemas:
|
|
# - input: schema["input"]
|
|
# - data: schema["data"]
|
|
|
|
package rules.require_approvals
|
|
|
|
import rego.v1
|
|
|
|
default allow := false
|
|
|
|
allow if {
|
|
count(violations) == 0
|
|
}
|
|
|
|
violations contains {"code": "insufficient_approvals", "message": sprintf("need at least %d approval(s), got %d", [min_approvals, count(active_approvals)])} if {
|
|
cfg := data.deploygate.config[input.deployment.environment]
|
|
cfg.min_approvals > 0
|
|
count(active_approvals) < cfg.min_approvals
|
|
}
|
|
|
|
min_approvals := data.deploygate.config[input.deployment.environment].min_approvals if {
|
|
input.deployment
|
|
}
|
|
|
|
active_approvals contains approval if {
|
|
some approval in input.approvals
|
|
approval.active
|
|
}
|
|
|
|
violations contains {"code": "not_configured", "message": sprintf("no min_approvals configured for environment %q", [input.deployment.environment])} if {
|
|
input.deployment
|
|
not data.deploygate.config[input.deployment.environment].min_approvals
|
|
}
|