2cb281183f
Some checks failed
Test Suite / test (3.12) (push) Has been cancelled
Test Suite / test (3.9) (push) Has been cancelled
ci / standards-gate (push) Has been cancelled
CodeQL Security Scan / Analyze (push) Has been cancelled
Test Suite / test (3.10) (push) Has been cancelled
Test Suite / test (3.11) (push) Has been cancelled
Test Suite / lint (push) Has been cancelled
Adopt the org engineering standard (its-consulting/standards @ v1.0.0).
Adds baseline governance/CI/policy files rendered from the standard's
templates and pins .standards-version=1.0.0. Vendored OPA/Rego policies
under .standards/policies/ so CI runs the gate locally (no cross-repo dep).
Placeholders ({{ORG}}/{{REPO}}/{{OWNER_HANDLE}}/{{MAINTAINER_EMAIL}}) filled in.
Existing files that differ were left untouched by the adopter.
Automated rollout. Files created: 15.
18 lines
991 B
TOML
18 lines
991 B
TOML
# Conftest configuration for the `standards` Policy-as-Code package.
|
|
#
|
|
# Enforces: docs/adr/0004-policy-as-code-opa-conftest.md
|
|
# Followed by: sops/SOP-002-release-process.md, sops/SOP-005-secrets-management.md
|
|
#
|
|
# Config keys mirror conftest's CLI flags (hyphenated). Conftest auto-discovers a
|
|
# `conftest.toml` in the policy directory / working directory, so running
|
|
# `conftest test <manifest>` from `policies/` picks these up with no extra flags.
|
|
#
|
|
# `all-namespaces = true` makes conftest evaluate `deny`/`warn` rules from EVERY
|
|
# Rego package it loads (standards.ci.*, standards.quadlet.*, standards.containerfile.*),
|
|
# so a single `conftest test <manifest>` exercises every relevant policy. Without it,
|
|
# conftest only looks at the `main` namespace and silently ignores our namespaced rules.
|
|
#
|
|
# `policy = "."` points conftest at this directory (run it from `policies/`), so the
|
|
# lib/, ci/, quadlet/ and containerfile/ subtrees are all discovered.
|
|
policy = "."
|
|
all-namespaces = true
|