RickCraig

package pipeline

deny[msg]{
  input.pipeline.tags.release
  branch := input.pipeline.properties.ci.codebase.build.spec.branch
  not check_branch(branch)
  msg := sprintf("Branch %s is not allowed, please use Release/* or <+trigger.payload.branch>", [branch])
}

check_branch(branch) {

RickCraig

package pipeline

step_order := ["TerraformPlan", "HarnessApproval", "TerraformApply"]

# Deny a pipeline if steps do not execute in the
# correct order, this will check the steps in every
# stage, but not across stages
deny[msg] {
  stage := input.pipeline.stages[_].stage

RickCraig

package pipeline

# Check serial stages
check_pipeline {
  stage := input.pipeline.stages[_].stage
  stage.type == "CI"
}

# Check parallel stages
check_pipeline {

RickCraig

package pipeline

# Ensure all CI stages in serial use the ci_cluster connector
deny[msg] {
  stage := input.pipeline.stages[_].stage
  stage.type == "CI"
  stage.spec.infrastructure.spec.connector.identifier != "ci_cluster"
  msg := sprintf("CI stage '%s' is not using CI cluster", [stage.name])
}

RickCraig

package pipeline

blocked_delegates := ["cti-shared-us-east-1-svc-eks-tfg7-swat", "my-other-delegate"]

# block any pipeline which uses a particular delegate
deny[msg] {
  # Get the stage
  stage := input.pipeline.stages[_].stage

  # Loop through blocked delegates

RickCraig

package pipeline

# Stage Type to Check
stage_type = "CI"

# Steps that required in every "stage_type" stage
required_steps = ["BuildAndPushDockerRegistry", "Run"]

# Walks through a stage and return all step objects
walk_steps(stage) = { value |

RickCraig

package pipeline

# Deny pipelines that use disallowed environments
deny[msg] {
	# Find all deployment stages
	stage = input.pipeline.stages[_].stage
	stage.type == "Deployment"

	# ... where the environment is on the disallow list
	contains(disallowed_environments, stage.spec.infrastructure.environment.identifier)

RickCraig

package pipeline

# Steps that must be present in every deployment
required_steps = ["BuildAndPushDockerRegistry"]

# Stage Type to Check
stage_type = "CI"

# Checks the required step for non-parallel stages
has_required_step[msg] {

RickCraig

package connector

import future.keywords.in

# Choose a connector type to check
connectorType := "K8sCluster"
# Choose one or more allowed auth types for the above connector type
allowedAuthTypes := ["UsernamePassword"]

deny[msg] {

RickCraig

package pipeline

stage_order := ["OPA check", "deploy"]

# Deny a pipeline if stages do not execute in the
# correct order. This will check that the named stages
# in the array above are in the right order, ignoring
# other stages.
deny[msg] {
  # Run through the order rules array