jdevega
59cacfdfab
OPA/Rego deployment gateway policies: 5 rules (valid-environment, require-approvals, no-self-approval, block-weekends, freeze-window), a deploy-gate combining them, JSON schemas, scenario-driven tests, Gitea Actions CI (verify + publish to generic registry), changesets versioning, Makefile and scripts.
51 lines
1.7 KiB
Bash
Executable File
51 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Lints, schema-checks and tests every rule and gate.
|
|
|
|
set -euo pipefail
|
|
|
|
source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/common.sh"
|
|
|
|
fail() {
|
|
echo "FAIL: $1" >&2
|
|
exit 1
|
|
}
|
|
|
|
# Rego formatting.
|
|
echo "==> opa fmt --fail"
|
|
"$OPA" fmt --fail --diff "$POLICIES_DIR" || fail "rego files are not formatted (run 'make fmt' or 'opa fmt -w')"
|
|
|
|
# Lint with regal if available.
|
|
if command -v regal >/dev/null 2>&1; then
|
|
echo "==> regal lint"
|
|
regal lint "$POLICIES_DIR" --format github || fail "regal lint found issues"
|
|
else
|
|
echo "==> regal not found, skipping"
|
|
fi
|
|
|
|
RULES_ARG=""
|
|
rule_dirs=( "$POLICIES_DIR"/rules/*/ )
|
|
[ "${#rule_dirs[@]}" -gt 0 ] && [ -d "${rule_dirs[0]}" ] || fail "no rules found"
|
|
|
|
# Schema-check + unit tests per rule (runs are isolated so each rule's scenarios.json loads at data.scenarios).
|
|
for d in "${rule_dirs[@]}"; do
|
|
name="$(basename "$d")"
|
|
echo "==> check ${name}"
|
|
"$OPA" check --strict --schema "$d/schema" "$d/policy.rego" "$d/policy_test.rego" || fail "check ${name}"
|
|
echo "==> test ${name}"
|
|
"$OPA" test "$d/policy.rego" "$d/policy_test.rego" "$d/scenarios.json" || fail "test ${name}"
|
|
RULES_ARG="$RULES_ARG $d/policy.rego"
|
|
done
|
|
|
|
# Gates: check + tests with all rule policy.rego files loaded so data.rules.* resolves.
|
|
gate_dirs=( "$POLICIES_DIR"/gates/*/ )
|
|
for g in "${gate_dirs[@]}"; do
|
|
[ -d "$g" ] || continue
|
|
name="$(basename "$g")"
|
|
echo "==> check ${name}"
|
|
"$OPA" check --strict --schema "$g/schema" "$g/gate_test.rego" || fail "check ${name}"
|
|
echo "==> test ${name}"
|
|
# shellcheck disable=SC2086
|
|
"$OPA" test "$g/gate_test.rego" "$g/scenarios.json" $RULES_ARG || fail "test ${name}"
|
|
done
|
|
|
|
echo "All checks passed." |