Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Chris Farhood
|
e1c139ab94 |
@@ -1,116 +1,20 @@
|
||||
name: Promotion Gate
|
||||
name: Dual Approval (CTO + QA)
|
||||
|
||||
# dev PRs: no gate (engineer self-merges).
|
||||
# uat PRs: QA approval required.
|
||||
# main PRs: UAT approval required (uat→main promotions).
|
||||
# Calls the shared dual-approval-check workflow.
|
||||
# Passes when both privilegedescalation-cto and privilegedescalation-qa
|
||||
# have approved the PR. Add "Dual Approval (CTO + QA)" to required_status_checks
|
||||
# in branch protection to enforce this gate.
|
||||
|
||||
on:
|
||||
pull_request_review:
|
||||
types: [submitted, dismissed]
|
||||
pull_request:
|
||||
branches: [uat, main]
|
||||
branches: [main]
|
||||
types: [opened, reopened, synchronize]
|
||||
|
||||
jobs:
|
||||
promotion-gate:
|
||||
name: Promotion Gate
|
||||
runs-on: ubuntu-latest
|
||||
container: ubuntu:latest
|
||||
timeout-minutes: 5
|
||||
|
||||
steps:
|
||||
- name: Install dependencies
|
||||
run: apt-get update -qq && apt-get install -y --no-install-recommends curl jq
|
||||
|
||||
- name: Check promotion approval
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
||||
PR_NUMBER: ${{ github.event.pull_request.number }}
|
||||
REPO: ${{ github.repository }}
|
||||
BASE_REF: ${{ github.base_ref }}
|
||||
run: |
|
||||
if [ -z "${PR_NUMBER}" ] || [ "${PR_NUMBER}" = "null" ]; then
|
||||
echo "::notice::No PR number in context. Skipping promotion gate."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Checking promotion gate for PR #${PR_NUMBER} targeting ${BASE_REF} in ${REPO}"
|
||||
|
||||
if [ -z "${BASE_REF}" ] && [ -n "${PR_NUMBER}" ] && [ "${PR_NUMBER}" != "null" ]; then
|
||||
BASE_REF=$(curl -sf \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Accept: application/json" \
|
||||
"https://git.farh.net/api/v1/repos/${REPO}/pulls/${PR_NUMBER}" | jq -r '.base.ref')
|
||||
echo "BASE_REF was empty; resolved from PR #${PR_NUMBER} API: ${BASE_REF}"
|
||||
fi
|
||||
|
||||
# Determine required reviewer based on target branch
|
||||
case "${BASE_REF}" in
|
||||
dev)
|
||||
echo "Target is dev — no review required. Engineers self-merge."
|
||||
exit 0
|
||||
;;
|
||||
uat)
|
||||
REQUIRED_REVIEWER="pe_regina"
|
||||
GATE_NAME="QA"
|
||||
;;
|
||||
main)
|
||||
REQUIRED_REVIEWER="pe_regina"
|
||||
GATE_NAME="QA"
|
||||
# For plugin repos (Pipeline A), UAT approval is needed for uat→main
|
||||
# Check if the source branch is uat
|
||||
SOURCE_REF=$(curl -sf \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Accept: application/json" \
|
||||
"https://git.farh.net/api/v1/repos/${REPO}/pulls/${PR_NUMBER}" | jq -r '.head.ref')
|
||||
|
||||
if [ "${SOURCE_REF}" = "uat" ]; then
|
||||
REQUIRED_REVIEWER="pe_patty"
|
||||
GATE_NAME="UAT"
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
echo "::notice::Target branch '${BASE_REF}' has no promotion gate configured."
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
echo "Required reviewer: ${REQUIRED_REVIEWER} (${GATE_NAME})"
|
||||
|
||||
# For uat→main promotions, pe_patty may not be able to review (bot account).
|
||||
# Accept pe_nancy (CTO) as a valid alternative reviewer.
|
||||
ALT_REVIEWER=""
|
||||
if [ "${REQUIRED_REVIEWER}" = "pe_patty" ]; then
|
||||
ALT_REVIEWER="pe_nancy"
|
||||
fi
|
||||
|
||||
REVIEWS=$(curl -sf \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
-H "Accept: application/json" \
|
||||
"https://git.farh.net/api/v1/repos/${REPO}/pulls/${PR_NUMBER}/reviews")
|
||||
|
||||
if [ -z "${REVIEWS}" ] || [ "${REVIEWS}" = "null" ]; then
|
||||
echo "::warning::Could not fetch reviews for PR #${PR_NUMBER}."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
REVIEWER_APPROVED=$(printf '%s' "${REVIEWS}" | jq -r --arg user "${REQUIRED_REVIEWER}" \
|
||||
'[.[] | select(.user.login == $user)] | last | if .state then .state == "APPROVED" else false end')
|
||||
|
||||
echo "${GATE_NAME} (${REQUIRED_REVIEWER}) approved: ${REVIEWER_APPROVED}"
|
||||
|
||||
# Fallback: check if CTO approved as alternative for uat→main
|
||||
if [ "${REVIEWER_APPROVED}" != "true" ] && [ -n "${ALT_REVIEWER}" ]; then
|
||||
REVIEWER_APPROVED=$(printf '%s' "${REVIEWS}" | jq -r --arg user "${ALT_REVIEWER}" \
|
||||
'[.[] | select(.user.login == $user)] | last | if .state then .state == "APPROVED" else false end')
|
||||
if [ "${REVIEWER_APPROVED}" = "true" ]; then
|
||||
echo "CTO (${ALT_REVIEWER}) approved as fallback for UAT gate."
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "${REVIEWER_APPROVED}" = "true" ]; then
|
||||
echo "Promotion gate passed: ${GATE_NAME} has approved."
|
||||
else
|
||||
echo "Promotion gate failed: waiting for ${GATE_NAME} approval from ${REQUIRED_REVIEWER}."
|
||||
exit 1
|
||||
fi
|
||||
dual-approval:
|
||||
uses: privilegedescalation/.github/.github/workflows/dual-approval-check.yaml@main
|
||||
with:
|
||||
pr_number: ${{ github.event.pull_request.number }}
|
||||
secrets: inherit
|
||||
|
||||
+7
-5
@@ -1,20 +1,22 @@
|
||||
# Artifact Hub package metadata
|
||||
# https://artifacthub.io/docs/topics/repositories/headlamp-plugins/
|
||||
# Replace ALL placeholder values before publishing.
|
||||
|
||||
version: "0.1.0"
|
||||
name: my-headlamp-plugin
|
||||
displayName: My Headlamp Plugin
|
||||
name: my-headlamp-plugin # TODO: change to your plugin name (lowercase, hyphens)
|
||||
displayName: My Headlamp Plugin # TODO: human-readable display name
|
||||
createdAt: "2026-05-20T00:00:00Z"
|
||||
description: A Headlamp plugin for Kubernetes
|
||||
description: A Headlamp plugin for Kubernetes # TODO: describe your plugin
|
||||
license: Apache-2.0
|
||||
homeURL: https://git.farh.net/privilegedescalation/headlamp-plugin-template
|
||||
appVersion: "0.1.0"
|
||||
appVersion: "0.1.0" # TODO: version of the app this plugin targets
|
||||
keywords:
|
||||
- headlamp
|
||||
- kubernetes
|
||||
# TODO: add your plugin-specific keywords
|
||||
annotations:
|
||||
headlamp/plugin/archive-url: "https://git.farh.net/privilegedescalation/headlamp-plugin-template/releases/download/v0.1.0/my-headlamp-plugin-0.1.0.tar.gz"
|
||||
headlamp/plugin/archive-checksum: "sha256:e2cfecedbef47931c54612a0f77f3b95c85a16923bd578e6d3a50bf15f55403b"
|
||||
headlamp/plugin/archive-checksum: "sha256:242372e9dbf85e7dbbf4ad8478647c4064f4da24aaa8070c1a6241cb16f8488d"
|
||||
headlamp/plugin/version-compat: ">=0.13.0"
|
||||
headlamp/plugin/distro-compat: "desktop,in-cluster,web,docker-desktop"
|
||||
links:
|
||||
|
||||
+9
-17
@@ -4,15 +4,14 @@
|
||||
"description": "A Headlamp plugin for Kubernetes",
|
||||
"repository": {
|
||||
"type": "git",
|
||||
"url": "https://git.farh.net/privilegedescalation/headlamp-plugin-template.git"
|
||||
"url": "https://github.com/YOUR_ORG/YOUR_REPO.git"
|
||||
},
|
||||
"bugs": {
|
||||
"url": "https://git.farh.net/privilegedescalation/headlamp-plugin-template/issues"
|
||||
"url": "https://github.com/YOUR_ORG/YOUR_REPO/issues"
|
||||
},
|
||||
"homepage": "https://git.farh.net/privilegedescalation/headlamp-plugin-template",
|
||||
"author": "Privileged Escalation",
|
||||
"homepage": "https://github.com/YOUR_ORG/YOUR_REPO#readme",
|
||||
"author": "YOUR_NAME",
|
||||
"license": "Apache-2.0",
|
||||
"packageManager": "pnpm@10.32.1",
|
||||
"scripts": {
|
||||
"start": "headlamp-plugin start",
|
||||
"build": "headlamp-plugin build",
|
||||
@@ -37,20 +36,13 @@
|
||||
"react-dom": "^18.3.1",
|
||||
"react-router-dom": "^5.3.0",
|
||||
"typescript": "^5.6.2",
|
||||
"vite": "^6.4.1",
|
||||
"vite-plugin-svgr": "^4.5.0",
|
||||
"vitest": "^3.0.5"
|
||||
},
|
||||
"pnpm": {
|
||||
"onlyBuiltDependencies": [
|
||||
"@swc/core",
|
||||
"esbuild",
|
||||
"msw"
|
||||
]
|
||||
},
|
||||
"overrides": {
|
||||
"tar": "^7.5.11",
|
||||
"undici": "^7.24.3",
|
||||
"vite": ">=6.4.2",
|
||||
"lodash": ">=4.18.0",
|
||||
"elliptic": ">=6.6.1"
|
||||
"overrides": {
|
||||
"elliptic": ">=6.6.1"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Generated
+43
-3
@@ -4,6 +4,9 @@ settings:
|
||||
autoInstallPeers: true
|
||||
excludeLinksFromLockfile: false
|
||||
|
||||
overrides:
|
||||
elliptic: '>=6.6.1'
|
||||
|
||||
importers:
|
||||
|
||||
.:
|
||||
@@ -41,6 +44,12 @@ importers:
|
||||
typescript:
|
||||
specifier: ^5.6.2
|
||||
version: 5.9.3
|
||||
vite:
|
||||
specifier: ^6.4.1
|
||||
version: 6.4.2(@types/node@20.19.39)(terser@5.46.2)(yaml@2.8.4)
|
||||
vite-plugin-svgr:
|
||||
specifier: ^4.5.0
|
||||
version: 4.5.0(rollup@4.60.3)(typescript@5.9.3)(vite@6.4.2(@types/node@20.19.39)(terser@5.46.2)(yaml@2.8.4))
|
||||
vitest:
|
||||
specifier: ^3.0.5
|
||||
version: 3.2.4(@types/debug@4.1.13)(@types/node@20.19.39)(jsdom@24.1.3)(msw@2.4.9(typescript@5.9.3))(terser@5.46.2)(yaml@2.8.4)
|
||||
@@ -6572,16 +6581,27 @@ snapshots:
|
||||
- supports-color
|
||||
- typescript
|
||||
|
||||
'@svgr/core@8.1.0(typescript@5.9.3)':
|
||||
dependencies:
|
||||
'@babel/core': 7.29.0
|
||||
'@svgr/babel-preset': 8.1.0(@babel/core@7.29.0)
|
||||
camelcase: 6.3.0
|
||||
cosmiconfig: 8.3.6(typescript@5.9.3)
|
||||
snake-case: 3.0.4
|
||||
transitivePeerDependencies:
|
||||
- supports-color
|
||||
- typescript
|
||||
|
||||
'@svgr/hast-util-to-babel-ast@8.0.0':
|
||||
dependencies:
|
||||
'@babel/types': 7.29.0
|
||||
entities: 4.5.0
|
||||
|
||||
'@svgr/plugin-jsx@8.1.0(@svgr/core@8.1.0(typescript@5.6.2))':
|
||||
'@svgr/plugin-jsx@8.1.0(@svgr/core@8.1.0(typescript@5.9.3))':
|
||||
dependencies:
|
||||
'@babel/core': 7.29.0
|
||||
'@svgr/babel-preset': 8.1.0(@babel/core@7.29.0)
|
||||
'@svgr/core': 8.1.0(typescript@5.6.2)
|
||||
'@svgr/core': 8.1.0(typescript@5.9.3)
|
||||
'@svgr/hast-util-to-babel-ast': 8.0.0
|
||||
svg-parser: 2.0.4
|
||||
transitivePeerDependencies:
|
||||
@@ -7752,6 +7772,15 @@ snapshots:
|
||||
optionalDependencies:
|
||||
typescript: 5.6.2
|
||||
|
||||
cosmiconfig@8.3.6(typescript@5.9.3):
|
||||
dependencies:
|
||||
import-fresh: 3.3.1
|
||||
js-yaml: 4.1.1
|
||||
parse-json: 5.2.0
|
||||
path-type: 4.0.0
|
||||
optionalDependencies:
|
||||
typescript: 5.9.3
|
||||
|
||||
create-ecdh@4.0.4:
|
||||
dependencies:
|
||||
bn.js: 4.12.3
|
||||
@@ -11324,7 +11353,18 @@ snapshots:
|
||||
dependencies:
|
||||
'@rollup/pluginutils': 5.3.0(rollup@4.60.3)
|
||||
'@svgr/core': 8.1.0(typescript@5.6.2)
|
||||
'@svgr/plugin-jsx': 8.1.0(@svgr/core@8.1.0(typescript@5.6.2))
|
||||
'@svgr/plugin-jsx': 8.1.0(@svgr/core@8.1.0(typescript@5.9.3))
|
||||
vite: 6.4.2(@types/node@20.19.39)(terser@5.46.2)(yaml@2.8.4)
|
||||
transitivePeerDependencies:
|
||||
- rollup
|
||||
- supports-color
|
||||
- typescript
|
||||
|
||||
vite-plugin-svgr@4.5.0(rollup@4.60.3)(typescript@5.9.3)(vite@6.4.2(@types/node@20.19.39)(terser@5.46.2)(yaml@2.8.4)):
|
||||
dependencies:
|
||||
'@rollup/pluginutils': 5.3.0(rollup@4.60.3)
|
||||
'@svgr/core': 8.1.0(typescript@5.9.3)
|
||||
'@svgr/plugin-jsx': 8.1.0(@svgr/core@8.1.0(typescript@5.9.3))
|
||||
vite: 6.4.2(@types/node@20.19.39)(terser@5.46.2)(yaml@2.8.4)
|
||||
transitivePeerDependencies:
|
||||
- rollup
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
"compilerOptions": {
|
||||
"jsx": "react",
|
||||
"skipLibCheck": true,
|
||||
"types": ["vitest/globals", "@testing-library/jest-dom"]
|
||||
"types": ["vite/client", "vite-plugin-svgr/client", "vitest/globals", "@testing-library/jest-dom"]
|
||||
},
|
||||
"include": ["src"]
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user