13257bc642
Some checks failed
ci / standards-gate (push) Has been cancelled
Adopt the org engineering standard (its-consulting/standards @ v1.0.0).
Adds baseline governance/CI/policy files rendered from the standard's
templates and pins .standards-version=1.0.0. Vendored OPA/Rego policies
under .standards/policies/ so CI runs the gate locally (no cross-repo dep).
Placeholders ({{ORG}}/{{REPO}}/{{OWNER_HANDLE}}/{{MAINTAINER_EMAIL}}) filled in.
Existing files that differ were left untouched by the adopter.
Automated rollout. Files created: 15.
44 lines
1.6 KiB
YAML
44 lines
1.6 KiB
YAML
# ci.yml — self-contained standards gate (VENDORED model).
|
|
#
|
|
# Rendered verbatim into <repo>/.github/workflows/ by adopt-standard.sh. The
|
|
# standard's Rego policies are vendored into this repo at .standards/policies/
|
|
# (also placed by adopt-standard.sh, pinned to .standards-version), and the gate
|
|
# logic lives in .standards/policy-gate.sh. CI installs conftest and runs the
|
|
# policies LOCALLY — no dependency on a remote (possibly private) standards repo,
|
|
# no cross-account reusable-workflow access, no PAT. Re-run adopt-standard.sh to
|
|
# update the vendored policies when you bump the pin.
|
|
#
|
|
# The same gate runs identically on Forgejo/Woodpecker — see the standard's
|
|
# ci/woodpecker/ (ADR-0002 dual-target CI). Add repo-native jobs (lint/test/build)
|
|
# below the gate; those are language-specific and owned by the repo.
|
|
name: ci
|
|
|
|
on:
|
|
push:
|
|
branches: [main, develop]
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ci-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
standards-gate:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
CONFTEST_VERSION: "0.68.2"
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install conftest (pinned)
|
|
run: |
|
|
set -euo pipefail
|
|
url="https://github.com/open-policy-agent/conftest/releases/download/v${CONFTEST_VERSION}/conftest_${CONFTEST_VERSION}_Linux_x86_64.tar.gz"
|
|
curl -fsSL "$url" | sudo tar -xz -C /usr/local/bin conftest
|
|
conftest --version
|
|
|
|
- name: Policy gate (vendored standards policies)
|
|
run: bash .standards/policy-gate.sh
|