jdevega
59cacfdfab
OPA/Rego deployment gateway policies: 5 rules (valid-environment, require-approvals, no-self-approval, block-weekends, freeze-window), a deploy-gate combining them, JSON schemas, scenario-driven tests, Gitea Actions CI (verify + publish to generic registry), changesets versioning, Makefile and scripts.
59 lines
1.9 KiB
Bash
Executable File
59 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Builds deployable OPA bundles for every rule and gate.
|
|
#
|
|
# Composition model: SEPARATE EVALUATION.
|
|
# - Each rule is built as its own bundle where the module lives at data.rules.<name>.
|
|
# - Each gate bundles the policy.rego of all its dependency rules; consumers evaluate
|
|
# data.rules.<name> per rule and combine results at runtime.
|
|
|
|
set -euo pipefail
|
|
|
|
source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/common.sh"
|
|
|
|
rm -rf "$ARTIFACTS_DIR"
|
|
STAGE_DIR="$(mktemp -d)"
|
|
trap 'rm -rf "$STAGE_DIR"' EXIT
|
|
|
|
MANIFEST='{"revision":"","roots":["rules"],"rego_version":1}'
|
|
|
|
write_manifest() {
|
|
printf '%s' "$MANIFEST" > "$1/.manifest"
|
|
}
|
|
|
|
# --- rules ---
|
|
for d in "$POLICIES_DIR"/rules/*/; do
|
|
name="$(repo_name "$d")"
|
|
version="$(repo_version "$d")"
|
|
out="$ARTIFACTS_DIR/rules/$name/$version"
|
|
mkdir -p "$out"
|
|
echo "==> build rule $name@$version"
|
|
mkdir -p "$STAGE_DIR/rule/$name"
|
|
cp "$d/policy.rego" "$STAGE_DIR/rule/$name/policy.rego"
|
|
write_manifest "$STAGE_DIR/rule/$name"
|
|
(cd "$STAGE_DIR/rule/$name" && "$OPA" build -b . -o "$out/bundle.tar.gz")
|
|
done
|
|
|
|
# --- gates ---
|
|
for g in "$POLICIES_DIR"/gates/*/; do
|
|
name="$(repo_name "$g")"
|
|
version="$(repo_version "$g")"
|
|
out="$ARTIFACTS_DIR/gates/$name/$version"
|
|
mkdir -p "$out"
|
|
echo "==> build gate $name@$version"
|
|
stage="$STAGE_DIR/gate/$name"
|
|
for dep in $(node -p "Object.keys(require('$g/package.json').dependencies ?? {}).join(' ')"); do
|
|
for r in "$POLICIES_DIR"/rules/*/; do
|
|
rname="$(repo_name "$r")"
|
|
if [ "$rname" = "$dep" ]; then
|
|
mkdir -p "$stage/$rname"
|
|
cp "$r/policy.rego" "$stage/$rname/policy.rego"
|
|
break
|
|
fi
|
|
done
|
|
done
|
|
[ -d "$stage" ] || { echo "ERROR: gate $name has no buildable dependencies" >&2; exit 1; }
|
|
write_manifest "$stage"
|
|
(cd "$stage" && "$OPA" build -b . -o "$out/bundle.tar.gz")
|
|
done
|
|
|
|
echo "Artifacts written under $ARTIFACTS_DIR" |