510f9a13e2
Some checks failed
ci / standards-gate (push) Has been cancelled
Adopt the org engineering standard (its-consulting/standards @ v1.0.0).
Adds baseline governance/CI/policy files rendered from the standard's
templates and pins .standards-version=1.0.0. Vendored OPA/Rego policies
under .standards/policies/ so CI runs the gate locally (no cross-repo dep).
Placeholders ({{ORG}}/{{REPO}}/{{OWNER_HANDLE}}/{{MAINTAINER_EMAIL}}) filled in.
Existing files that differ were left untouched by the adopter.
Automated rollout. Files created: 15.
106 lines
3.6 KiB
Rego
106 lines
3.6 KiB
Rego
# Deploy gate: who is allowed to deploy WHAT, WHERE, and under WHICH conditions.
|
|
#
|
|
# Enforces: docs/adr/0004-policy-as-code-opa-conftest.md
|
|
# docs/adr/0005-trunk-based-with-release-branches.md
|
|
# SOP: sops/SOP-002-release-process.md (the human release procedure delegates
|
|
# its "production deploy is gated" step to this policy)
|
|
# Input: a deploy/pipeline descriptor, e.g.
|
|
# {
|
|
# "environment": "prod", # target environment (prod|staging|dev)
|
|
# "branch": "main", # ref the pipeline runs on
|
|
# "event": "tag", # trigger event (tag|push|pull_request|manual)
|
|
# "tag": "v1.4.0", # release tag, when event == "tag"
|
|
# "review": {"approved": true, "approvals": 2},
|
|
# "actor": "alex"
|
|
# }
|
|
#
|
|
# Contract (identical for the GitHub Actions and Woodpecker adapters — see
|
|
# docs/00-overview.md §4): a production deploy is allowed ONLY from `main`, ONLY on a
|
|
# `tag` event, ONLY with an approved review. Everything else is denied with a message.
|
|
package standards.ci.deploy
|
|
|
|
import rego.v1
|
|
|
|
import data.standards.lib
|
|
|
|
# Treat these environment names as production.
|
|
prod_envs := {"prod", "production"}
|
|
|
|
is_prod if {
|
|
prod_envs[lower(input.environment)]
|
|
}
|
|
|
|
# Non-release branch prefixes that must never deploy to production.
|
|
nonrelease_prefixes := {"feature/", "feat/", "fix/", "hotfix/", "wip/", "dependabot/", "renovate/"}
|
|
|
|
# --- Production guardrails ---------------------------------------------------
|
|
|
|
# Prod deploys must originate from the trunk branch `main`.
|
|
deny contains msg if {
|
|
is_prod
|
|
input.branch != "main"
|
|
msg := sprintf("prod deploy must run on branch 'main', got '%v' (see SOP-002, ADR-0005)", [input.branch])
|
|
}
|
|
|
|
# Prod deploys must be triggered by a release tag event, not an ad-hoc push/PR/manual run.
|
|
deny contains msg if {
|
|
is_prod
|
|
input.event != "tag"
|
|
msg := sprintf("prod deploy must be triggered by a 'tag' event, got '%v' (see SOP-002)", [input.event])
|
|
}
|
|
|
|
# The release tag itself must follow the vX.Y.Z convention.
|
|
deny contains msg if {
|
|
is_prod
|
|
input.event == "tag"
|
|
not lib.is_semver(input.tag)
|
|
msg := sprintf("prod release tag '%v' is not SemVer 'vX.Y.Z' (see ADR-0005)", [input.tag])
|
|
}
|
|
|
|
# Prod deploys require a recorded, approved review.
|
|
deny contains msg if {
|
|
is_prod
|
|
not review_approved
|
|
msg := "prod deploy requires an approved review (review.approved == true)"
|
|
}
|
|
|
|
review_approved if {
|
|
input.review.approved == true
|
|
}
|
|
|
|
# Feature/throwaway branches must never reach production, regardless of other fields.
|
|
deny contains msg if {
|
|
is_prod
|
|
some prefix in nonrelease_prefixes
|
|
startswith(input.branch, prefix)
|
|
msg := sprintf("branch '%v' may not deploy to prod (non-release branch prefix)", [input.branch])
|
|
}
|
|
|
|
# --- Staging guardrails (lighter) -------------------------------------------
|
|
|
|
# Staging may deploy from main or develop, but never from a pull_request event
|
|
# (PR builds are untrusted and must not push to a shared environment).
|
|
deny contains msg if {
|
|
lower(input.environment) == "staging"
|
|
input.event == "pull_request"
|
|
msg := "staging deploy must not run on a 'pull_request' event (untrusted ref)"
|
|
}
|
|
|
|
# --- Advisory ---------------------------------------------------------------
|
|
|
|
# Warn when a prod deploy is approved by a single reviewer; SOP-002 recommends >=2.
|
|
warn contains msg if {
|
|
is_prod
|
|
review_approved
|
|
count_approvals < 2
|
|
msg := sprintf("prod deploy approved by only %v reviewer(s); SOP-002 recommends >= 2", [count_approvals])
|
|
}
|
|
|
|
count_approvals := n if {
|
|
n := input.review.approvals
|
|
}
|
|
|
|
count_approvals := 1 if {
|
|
not input.review.approvals
|
|
input.review.approved == true
|
|
}
|