DEV Community

Nir Adler
Nir Adler

Posted on

Policyer Action

#actionshackathon21 #github #opensource #policyer

My Workflow

Policyer is an open source project (more like a vision) I created after inspired by policy engines that become very popular lately (OPA,Checkov)
Policyer going to focus on providing platform to run and create meaningful reports, data engagement and plugin system to let you provide any data, some time it can be k8s yaml and in other it can be user data.

Policyer Action

The policyer-action let you the option to run Policyer as part of your CI process, in my example I'm going to validate GitHub SDK calls.

Provider is like a plugin for policyer engine, it provide the data so the engine can run it against the checks (polciies)

Its important for me to emphasize that Policyer provide a platform, and eventually I will want to see marketplace full of custom providers.
The action can use any provider either local or published to NPM (support for private registries is on the way). In my example I created a simple provider to run GitHub SDK calls.

Example Repo

Example Check:

--- configuration: provider: github-provider type: rest validEvents: - pull_request - push domain: pulls action: listRequestedReviewers args: owner: context.payload.pull_request.base.user.login repo: context.payload.pull_request.base.repo.name pull_number: context.payload.pull_request.number checks: - id: validate-reviewers name: check if reviewers exists. severity: High steps: - path: data.users condition: includes value: "nirtester" utility: map utilityProps: - "login"
Enter fullscreen mode Exit fullscreen mode

(just a reminder this is a policy example and the Github action will evaluate it and output as a report)

Check flow:

  • first of all we setup the configuration section where we can provider meta data for the check, in this example I'm asking from the provider to do an SDK call: 
SDK[pulls][listRequestedReviewers]({ owner: ...pull_request.base.user.login repo: ...pull_request.base.repo.name pull_number: ...pull_request.number })
Enter fullscreen mode Exit fullscreen mode

octokit docs

  • next we going to dive in to the actual policy, in this policy we want to verify a certain user is a reviewer, so after the call im going to point to the "users" array, then use the condition includes ([...users].includes(value)), utilities function by default includes all Lodash functions, you can add custom utilities in the provider level. I'm going to use the map utility function to prepare an array of reviewers usernames.
  • final step is the results: 
 ____ _ _ | _ \ ___ | (_) ___ _ _ ___ _ __ | |_) / _ \| | |/ __| | | |/ _ \ '__| | __/ (_) | | | (__| |_| | __/ | |_| \___/|_|_|\___|\__, |\___|_| |___/ Visit us at policyer.org Event name: pull_request Valid events: pull_request,push ┌────────────────────┬──────────┬──────────────────────────────┬──────────────┬─────────────────┬───────────┬──────────┐ │ (index) │ hasError │ check │ stepsResults │ inspectedValues │ status │ severity │ ├────────────────────┼──────────┼──────────────────────────────┼──────────────┼─────────────────┼───────────┼──────────┤ │ validate-reviewers │ false │ 'check if reviewers exists.' │ [ true ] │ [ [Array] ] │ 'success' │ 'High' │ └────────────────────┴──────────┴──────────────────────────────┴──────────────┴─────────────────┴───────────┴──────────┘
Enter fullscreen mode Exit fullscreen mode

Submission Category:

Wacky Wildcards

Action yaml 

# Add github action file .github/workflows/policyer.yml name: Policyer on: [pull_request] jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - name: Policyer GitHub Action uses: policyerorg/policyer-action@v0.0.3-alpha with: verbose: false provider: policyer-github internal: false checks_path: ./checks
Enter fullscreen mode Exit fullscreen mode

Additional Resources / Info

Visit Policyer for more information this is just the beginning

Packages used

  • chalk
  • figlet
  • jmespath
  • lodash
  • moment
  • yaml
  • yargs
  • @actions/core/github

Top comments (0)