jdevega
59cacfdfab
OPA/Rego deployment gateway policies: 5 rules (valid-environment, require-approvals, no-self-approval, block-weekends, freeze-window), a deploy-gate combining them, JSON schemas, scenario-driven tests, Gitea Actions CI (verify + publish to generic registry), changesets versioning, Makefile and scripts.
76 lines
1.9 KiB
JSON
76 lines
1.9 KiB
JSON
{
|
|
"scenarios": {
|
|
"others_approve": {
|
|
"input": {
|
|
"deployment": {
|
|
"environment": "production",
|
|
"service": "payments-api",
|
|
"version": "1.2.3",
|
|
"requested_by": "alice",
|
|
"created_at": "2026-09-15T10:00:00Z"
|
|
},
|
|
"approvals": [
|
|
{"by": "bob", "at": "2026-09-15T09:00:00Z", "active": true},
|
|
{"by": "carol", "at": "2026-09-15T09:30:00Z", "active": true}
|
|
]
|
|
},
|
|
"data": {
|
|
"config": {
|
|
"production": {"min_approvals": 2}
|
|
}
|
|
},
|
|
"expect": {
|
|
"allow": true,
|
|
"violations": []
|
|
}
|
|
},
|
|
"self_approval": {
|
|
"input": {
|
|
"deployment": {
|
|
"environment": "production",
|
|
"service": "payments-api",
|
|
"version": "1.2.3",
|
|
"requested_by": "alice",
|
|
"created_at": "2026-09-15T10:00:00Z"
|
|
},
|
|
"approvals": [
|
|
{"by": "alice", "at": "2026-09-15T09:00:00Z", "active": true},
|
|
{"by": "bob", "at": "2026-09-15T09:30:00Z", "active": true}
|
|
]
|
|
},
|
|
"data": {
|
|
"config": {
|
|
"production": {"min_approvals": 2}
|
|
}
|
|
},
|
|
"expect": {
|
|
"allow": false,
|
|
"violations": ["self_approval"]
|
|
}
|
|
},
|
|
"revoked_self_approval_ignored": {
|
|
"input": {
|
|
"deployment": {
|
|
"environment": "production",
|
|
"service": "payments-api",
|
|
"version": "1.2.3",
|
|
"requested_by": "alice",
|
|
"created_at": "2026-09-15T10:00:00Z"
|
|
},
|
|
"approvals": [
|
|
{"by": "alice", "at": "2026-09-15T09:00:00Z", "active": false},
|
|
{"by": "bob", "at": "2026-09-15T09:30:00Z", "active": true}
|
|
]
|
|
},
|
|
"data": {
|
|
"config": {
|
|
"production": {"min_approvals": 2}
|
|
}
|
|
},
|
|
"expect": {
|
|
"allow": true,
|
|
"violations": []
|
|
}
|
|
}
|
|
}
|
|
} |