feat(policies): allow gate=false to override org-wide blocking#2777
feat(policies): allow gate=false to override org-wide blocking#2777matiasinsaurralde wants to merge 7 commits intochainloop-dev:mainfrom
Conversation
matiasinsaurralde
force-pushed
the
feat/policies-gate-false-override
branch
from
206bdbe to
55e399f
Compare
|
Additionally, Both the In order to try the |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
| except: | ||
| - EXTENSION_NO_DELETE | ||
| - FIELD_SAME_DEFAULT | ||
| - FIELD_SAME_CARDINALITY |
There was a problem hiding this comment.
I am not sure we want to disable this globally but instead you coudl add an annotation in your specific case?
migmartri
left a comment
migmartri
left a comment
There was a problem hiding this comment.
great, ptal at my comments, thanks
| // Effective gate semantics are already resolved in policy evaluations. | ||
| // For backwards compatibility, fall back to aggregate status only if | ||
| // no evaluations are available. | ||
| if len(status.PolicyEvaluations) == 0 && status.HasPolicyViolations { |
There was a problem hiding this comment.
I don't understand this change, mind elaborating a bit?
| Requirements: attachment.Requirements, | ||
| RawResults: engineRawResultsToAPIRawResults(rawResults), | ||
| Gate: attachment.GetGate(), | ||
| Gate: policyAttachmentGate(attachment, pv.defaultGate), |
There was a problem hiding this comment.
ok, so before the default gate was outside the context of policy verifier and now you are bringing both in?
…eritance Make PolicyAttachment.gate presence-aware to distinguish unset from explicit false. Resolve effective gate at evaluation time using org default when unset. Update attestation push enforcement to block on effective gated violations. Signed-off-by: Matías Insaurralde <matias@chainloop.dev>
Move the FIELD_SAME_CARDINALITY exception from buf.yaml to an inline ignore on PolicyAttachment.gate in crafting_schema.proto limiting the suppression to the specific field change. Signed-off-by: Matías Insaurralde <matias@chainloop.dev>
Signed-off-by: Matías Insaurralde <matias@chainloop.dev>
Signed-off-by: Matías Insaurralde <matias@chainloop.dev>
Signed-off-by: Matías Insaurralde <matias@chainloop.dev>
Signed-off-by: Matías Insaurralde <matias@chainloop.dev>
matiasinsaurralde
force-pushed
the
feat/policies-gate-false-override
branch
from
e4de61d to
bafe560
Compare
2 participants
PR for #2769
This change implements per-policy gate override behavior for policy enforcement.