Skip to content

Commit fdc3693

Browse files
memmem
authored
feat: add policy bot configuration (#48)
This allows us to have different configurations for the workflows and at the same time have a single configuration for what's required to pass in order to merge a PR. Signed-off-by: Marcelo E. Magallon <[email protected]>
1 parent 2087ec8 commit fdc3693

5 files changed

+184
-0
lines changed

‎.github/workflows/validate-policy-bot-config.yml

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: Validate Policy Bot Config
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- ".policy.yml"
7+
8+
push:
9+
branches:
10+
- main
11+
paths:
12+
- ".policy.yml"
13+
14+
jobs:
15+
validate:
16+
name: Validate policy bot config
17+
18+
runs-on: ubuntu-latest
19+
20+
steps:
21+
- name: Checkout code
22+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
23+
with:
24+
persists-credentials: false
25+
26+
- name: Validate policy bot config
27+
run: |
28+
curl \
29+
--silent \
30+
--fail-with-body \
31+
--request PUT \
32+
--upload-file .policy.yml \
33+
https://github-policy-bot.grafana-ops.net/api/validate

‎.policy.yml

+86
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
# This file is generated by generate-policy-bot-config.
2+
# Do not edit directly. Run "make .policy.yml" to update.
3+
4+
# The contents of ".policy.yml.tmpl" were merged with the generated parts of this config.
5+
# To add additional policies to the config, update this file and then run "make .policy.yml".
6+
7+
policy:
8+
approval:
9+
- or:
10+
- and:
11+
- Workflow .github/workflows/lint.yaml succeeded or skipped
12+
- Workflow .github/workflows/push-pr-release.yaml succeeded or skipped
13+
- Workflow .github/workflows/renovate-validate.yaml succeeded or skipped
14+
- Workflow .github/workflows/validate-policy-bot-config.yml succeeded or skipped
15+
- default to approval
16+
- override policies
17+
- policy bot config is valid when modified
18+
approval_rules:
19+
- name: Workflow .github/workflows/lint.yaml succeeded or skipped
20+
requires:
21+
conditions:
22+
has_workflow_result:
23+
conclusions:
24+
- skipped
25+
- success
26+
workflows:
27+
- .github/workflows/lint.yaml
28+
- name: Workflow .github/workflows/push-pr-release.yaml succeeded or skipped
29+
requires:
30+
conditions:
31+
has_workflow_result:
32+
conclusions:
33+
- skipped
34+
- success
35+
workflows:
36+
- .github/workflows/push-pr-release.yaml
37+
- name: Workflow .github/workflows/renovate-validate.yaml succeeded or skipped
38+
if:
39+
changed_files:
40+
paths:
41+
- ^renovate\.(?:[^/]*)$
42+
- ^\.renovate\.(?:[^/]*)$
43+
- ^\.github\/renovate\.(?:[^/]*)$
44+
- ^\.github\/workflows\/renovate(?:[^/]*)$
45+
requires:
46+
conditions:
47+
has_workflow_result:
48+
conclusions:
49+
- skipped
50+
- success
51+
workflows:
52+
- .github/workflows/renovate-validate.yaml
53+
- name: Workflow .github/workflows/validate-policy-bot-config.yml succeeded or skipped
54+
if:
55+
changed_files:
56+
paths:
57+
- ^\.policy\.yml$
58+
requires:
59+
conditions:
60+
has_workflow_result:
61+
conclusions:
62+
- skipped
63+
- success
64+
workflows:
65+
- .github/workflows/validate-policy-bot-config.yml
66+
- name: default to approval
67+
- name: policy bot config is valid when modified
68+
if:
69+
changed_files:
70+
paths:
71+
- ^\.policy\.yml
72+
requires:
73+
conditions:
74+
has_successful_status:
75+
- Validate policy bot config
76+
- name: override policies
77+
options:
78+
methods:
79+
comments:
80+
- 'policy bot: approve'
81+
- 'policy-bot: approve'
82+
github_review: false
83+
requires:
84+
count: 1
85+
permissions:
86+
- write

‎.policy.yml.tmpl

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Require some statuses to pass only if certain files are modified. This is a
2+
# template file. You can edit it and the generated contents (to enforce that
3+
# conditional workflows pass when they are triggered) will be inserted where
4+
# `MERGE_WITH_GENERATED` is.
5+
6+
policy:
7+
approval:
8+
- or:
9+
- MERGE_WITH_GENERATED
10+
- override policies
11+
- policy bot config is valid when modified
12+
13+
approval_rules:
14+
- name: policy bot config is valid when modified
15+
if:
16+
changed_files:
17+
paths:
18+
- ^\.policy\.yml
19+
requires:
20+
conditions:
21+
has_successful_status:
22+
- Validate policy bot config
23+
24+
- name: override policies
25+
requires:
26+
count: 1
27+
permissions:
28+
- write
29+
options:
30+
methods:
31+
comments:
32+
- "policy bot: approve"
33+
- "policy-bot: approve"
34+
github_review: false

‎scripts/gen-policy-bot-config

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#!/bin/sh
2+
3+
set -e
4+
set -u
5+
6+
IMAGE=ghcr.io/grafana/generate-policy-bot-config:latest
7+
8+
targetdir=${1:-}
9+
mergearg=
10+
11+
if test -z "${targetdir}" ; then
12+
targetdir=$(git rev-parse --show-toplevel)
13+
fi
14+
15+
if test -f "${targetdir}/.policy.yml.tmpl" ; then
16+
mergearg="--merge-with=.policy.yml.tmpl"
17+
fi
18+
19+
docker run --rm \
20+
--volume "${targetdir}:/work" \
21+
--user "$(id -u):$(id -g)" \
22+
--workdir /work \
23+
"${IMAGE}" \
24+
--output /work/.policy.yml \
25+
"${mergearg}" \
26+
.

‎scripts/make/620_generate_policy_bot_config.mk

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
.PHONY: generate-policy-bot-config
2+
generate-policy-bot-config: ## Generate policy bot config.
3+
$(S) echo 'Generating policy bot configuration...'
4+
$(V) $(ROOTDIR)/scripts/gen-policy-bot-config "$(ROOTDIR)"
5+
$(S) echo 'Done.'

0 commit comments

Comments
 (0)