jdevega
59cacfdfab
OPA/Rego deployment gateway policies: 5 rules (valid-environment, require-approvals, no-self-approval, block-weekends, freeze-window), a deploy-gate combining them, JSON schemas, scenario-driven tests, Gitea Actions CI (verify + publish to generic registry), changesets versioning, Makefile and scripts.
23 lines
603 B
Rego
23 lines
603 B
Rego
# METADATA
|
|
# schemas:
|
|
# - input: schema["input"]
|
|
# - data: schema["data"]
|
|
|
|
package rules.freeze_window
|
|
|
|
import rego.v1
|
|
|
|
default allow := false
|
|
|
|
allow if {
|
|
count(violations) == 0
|
|
}
|
|
|
|
violations contains {"code": "deploy_in_freeze", "message": sprintf("deployment within freeze window starting %s ending %s", [window.start, window.end])} if {
|
|
some window in data.deploygate.freeze_windows
|
|
window.environment == input.deployment.environment
|
|
created := time.parse_rfc3339_ns(input.deployment.created_at)
|
|
created >= time.parse_rfc3339_ns(window.start)
|
|
created <= time.parse_rfc3339_ns(window.end)
|
|
}
|