11747fa7e5
Some checks failed
ci / standards-gate (push) Has been cancelled
Adopt the org engineering standard (its-consulting/standards @ v1.0.0).
Adds baseline governance/CI/policy files rendered from the standard's
templates and pins .standards-version=1.0.0. Vendored OPA/Rego policies
under .standards/policies/ so CI runs the gate locally (no cross-repo dep).
Placeholders ({{ORG}}/{{REPO}}/{{OWNER_HANDLE}}/{{MAINTAINER_EMAIL}}) filled in.
Existing files that differ were left untouched by the adopter.
Automated rollout. Files created: 15.
58 lines
2 KiB
Bash
58 lines
2 KiB
Bash
#!/usr/bin/env bash
|
|
#
|
|
# policy-gate.sh — vendored standards policy gate.
|
|
#
|
|
# Runs the standard's Rego policies (vendored at .standards/policies/) against this
|
|
# repo's manifests with conftest. Auto-detects artifact types and applies the right
|
|
# parser + namespace so policies never cross-fire:
|
|
# *.container -> --parser ini --namespace standards.quadlet.security
|
|
# Containerfile*/Dockerfile* -> --parser dockerfile --namespace standards.containerfile.hardening
|
|
# deploy/deploy-descriptor.json -> --namespace standards.ci.deploy / standards.ci.image
|
|
#
|
|
# Fails (exit 1) only on a policy `deny`; `warn`s are reported but do not block —
|
|
# this is the "gates over gatekeepers" model (see the standard's docs/00-overview.md).
|
|
# Part of the standard; do NOT edit by hand — re-run adopt-standard.sh to update.
|
|
set -euo pipefail
|
|
shopt -s nullglob globstar
|
|
|
|
POL=".standards/policies"
|
|
rc=0
|
|
|
|
if [[ ! -d "${POL}" ]]; then
|
|
echo "policy-gate: ${POL} not found — run adopt-standard.sh to vendor the policies." >&2
|
|
exit 2
|
|
fi
|
|
|
|
run() { # run <label> <conftest-args...>
|
|
local label="$1"; shift
|
|
echo "== ${label}"
|
|
conftest test "$@" -p "${POL}" || rc=1
|
|
}
|
|
|
|
# Quadlet systemd units.
|
|
quadlets=( **/*.container )
|
|
if (( ${#quadlets[@]} )); then
|
|
run "quadlet policy (${#quadlets[@]} unit(s))" \
|
|
"${quadlets[@]}" --parser ini --namespace standards.quadlet.security
|
|
fi
|
|
|
|
# Containerfiles / Dockerfiles.
|
|
cfiles=( Containerfile* **/Containerfile* Dockerfile* **/Dockerfile* )
|
|
if (( ${#cfiles[@]} )); then
|
|
run "containerfile policy (${#cfiles[@]} file(s))" \
|
|
"${cfiles[@]}" --parser dockerfile --namespace standards.containerfile.hardening
|
|
fi
|
|
|
|
# Optional deploy descriptor for the CI/deploy/image policies.
|
|
if [[ -f deploy/deploy-descriptor.json ]]; then
|
|
run "ci policy (deploy descriptor)" \
|
|
deploy/deploy-descriptor.json \
|
|
--namespace standards.ci.deploy --namespace standards.ci.image
|
|
fi
|
|
|
|
if (( rc == 0 )); then
|
|
echo "policy gate: PASS"
|
|
else
|
|
echo "policy gate: FAIL (a deny rule fired — see above)" >&2
|
|
fi
|
|
exit "${rc}"
|