Skip to content

Commit 406851a

Browse files
memmem
authored
feat: add policy bot configuration (#1047)
This allows us to have different configurations for the workflows and at the same time have a single configuration for what's required to pass in order to merge a PR. Signed-off-by: Marcelo E. Magallon <marcelo.magallon@grafana.com>
1 parent df9c5d9 commit 406851a

File tree

5 files changed

+170
-0
lines changed

5 files changed

+170
-0
lines changed

‎.github/workflows/validate-policy-bot-config.yml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: Validate Policy Bot Config
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- ".policy.yml"
7+
8+
push:
9+
branches:
10+
- main
11+
paths:
12+
- ".policy.yml"
13+
14+
jobs:
15+
validate:
16+
name: Validate policy bot config
17+
18+
runs-on: ubuntu-latest
19+
20+
steps:
21+
- name: Checkout code
22+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
23+
with:
24+
persists-credentials: false
25+
26+
- name: Validate policy bot config
27+
run: |
28+
curl \
29+
--silent \
30+
--fail-with-body \
31+
--request PUT \
32+
--upload-file .policy.yml \
33+
https://github-policy-bot.grafana-ops.net/api/validate

‎.policy.yml

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# This file is generated by generate-policy-bot-config.
2+
# Do not edit directly. Run "make .policy.yml" to update.
3+
4+
# The contents of ".policy.yml.tmpl" were merged with the generated parts of this config.
5+
# To add additional policies to the config, update this file and then run "make .policy.yml".
6+
7+
policy:
8+
approval:
9+
- or:
10+
- and:
11+
- Workflow .github/workflows/ci.yml succeeded or skipped
12+
- Workflow .github/workflows/is-compatible.yml succeeded or skipped
13+
- Workflow .github/workflows/validate-policy-bot-config.yml succeeded or skipped
14+
- default to approval
15+
- override policies
16+
- policy bot config is valid when modified
17+
approval_rules:
18+
- name: Workflow .github/workflows/ci.yml succeeded or skipped
19+
if:
20+
targets_branch:
21+
pattern: (^main$)
22+
requires:
23+
conditions:
24+
has_workflow_result:
25+
conclusions:
26+
- skipped
27+
- success
28+
workflows:
29+
- .github/workflows/ci.yml
30+
- name: Workflow .github/workflows/is-compatible.yml succeeded or skipped
31+
requires:
32+
conditions:
33+
has_workflow_result:
34+
conclusions:
35+
- skipped
36+
- success
37+
workflows:
38+
- .github/workflows/is-compatible.yml
39+
- name: Workflow .github/workflows/validate-policy-bot-config.yml succeeded or skipped
40+
if:
41+
changed_files:
42+
paths:
43+
- ^\.policy\.yml$
44+
requires:
45+
conditions:
46+
has_workflow_result:
47+
conclusions:
48+
- skipped
49+
- success
50+
workflows:
51+
- .github/workflows/validate-policy-bot-config.yml
52+
- name: default to approval
53+
- name: policy bot config is valid when modified
54+
if:
55+
changed_files:
56+
paths:
57+
- ^\.policy\.yml
58+
requires:
59+
conditions:
60+
has_successful_status:
61+
- Validate policy bot config
62+
- name: override policies
63+
options:
64+
methods:
65+
comments:
66+
- 'policy bot: approve'
67+
- 'policy-bot: approve'
68+
github_review: false
69+
requires:
70+
count: 1
71+
permissions:
72+
- write

‎.policy.yml.tmpl

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Require some statuses to pass only if certain files are modified. This is a
2+
# template file. You can edit it and the generated contents (to enforce that
3+
# conditional workflows pass when they are triggered) will be inserted where
4+
# `MERGE_WITH_GENERATED` is.
5+
6+
policy:
7+
approval:
8+
- or:
9+
- MERGE_WITH_GENERATED
10+
- override policies
11+
- policy bot config is valid when modified
12+
13+
approval_rules:
14+
- name: policy bot config is valid when modified
15+
if:
16+
changed_files:
17+
paths:
18+
- ^\.policy\.yml
19+
requires:
20+
conditions:
21+
has_successful_status:
22+
- Validate policy bot config
23+
24+
- name: override policies
25+
requires:
26+
count: 1
27+
permissions:
28+
- write
29+
options:
30+
methods:
31+
comments:
32+
- "policy bot: approve"
33+
- "policy-bot: approve"
34+
github_review: false

‎scripts/gen-policy-bot-config

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#!/bin/sh
2+
3+
set -e
4+
set -u
5+
6+
IMAGE=ghcr.io/grafana/generate-policy-bot-config:latest
7+
8+
targetdir=${1:-}
9+
mergearg=
10+
11+
if test -z "${targetdir}" ; then
12+
targetdir=$(git rev-parse --show-toplevel)
13+
fi
14+
15+
if test -f "${targetdir}/.policy.yml.tmpl" ; then
16+
mergearg="--merge-with=.policy.yml.tmpl"
17+
fi
18+
19+
docker run --rm \
20+
--volume "${targetdir}:/work" \
21+
--user "$(id -u):$(id -g)" \
22+
--workdir /work \
23+
"${IMAGE}" \
24+
--output /work/.policy.yml \
25+
"${mergearg}" \
26+
.

‎scripts/make/620_generate_policy_bot_config.mk

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
.PHONY: generate-policy-bot-config
2+
generate-policy-bot-config: ## Generate policy bot config.
3+
$(S) echo 'Generating policy bot configuration...'
4+
$(V) $(ROOTDIR)/scripts/gen-policy-bot-config "$(ROOTDIR)"
5+
$(S) echo 'Done.'

0 commit comments

Comments
 (0)