Skip to content

Commit

Permalink
Merge pull request #1186 from joejstuart/EC-867-2
Browse files Browse the repository at this point in the history
conform to package name best practice
  • Loading branch information
joejstuart authored Oct 15, 2024
2 parents 5806564 + 511bd93 commit c93514e
Show file tree
Hide file tree
Showing 99 changed files with 362 additions and 437 deletions.
2 changes: 0 additions & 2 deletions .regal/config.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -60,8 +60,6 @@ rules:
idiomatic:
no-defined-entrypoint:
level: ignore
directory-package-mismatch:
level: ignore # we need to refactor our directory structure see https://issues.redhat.com/browse/EC-864
bugs:
leaked-internal-reference:
ignore:
Expand Down
6 changes: 3 additions & 3 deletions antora/docs/modules/ROOT/pages/build_task_policy.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ These rules are applied to Tekton build task definitions.
Policies to verify that a Tekton build task definition has the required build type label.

* Package name: `labels`
* Package full path: `policy.build_task.labels`
* Package full path: `build_task.labels`
[#labels__build_type_label_set]
=== link:#labels__build_type_label_set[Build task has build type label]
Expand All @@ -20,7 +20,7 @@ Confirm the build task definition has the required build type label.
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `The required build label '%s' is missing`
* Code: `labels.build_type_label_set`
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/build_task/labels.rego#L17[Source, window="_blank"]
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/build_task/labels/labels.rego#L17[Source, window="_blank"]
[#labels__build_task_has_label]
=== link:#labels__build_task_has_label[Build task has label]
Expand All @@ -30,4 +30,4 @@ Confirm that the build task definition includes at least one label.
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `The task definition does not include any labels`
* Code: `labels.build_task_has_label`
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/build_task/labels.rego#L30[Source, window="_blank"]
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/build_task/labels/labels.rego#L30[Source, window="_blank"]
30 changes: 15 additions & 15 deletions antora/docs/modules/ROOT/pages/pipeline_policy.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ These rules are applied to Tekton pipeline definitions.
To be able to reproduce and audit builds accurately it's important to know exactly what happens during the build. To do this Enterprise Contract requires that all tasks are defined in a set of known and trusted task bundles. This package includes rules to confirm that the tasks in a Pipeline definition are defined in task bundles, and that the task bundles are from the list of known and trusted bundles.

* Package name: `task_bundle`
* Package full path: `policy.pipeline.task_bundle`
* Package full path: `pipeline.task_bundle`
[#task_bundle__missing_required_data]
=== link:#task_bundle__missing_required_data[Missing required data]
Expand All @@ -20,7 +20,7 @@ Confirm the `trusted_tasks` rule data was provided, since it's required by the p
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `Missing required trusted_tasks data`
* Code: `task_bundle.missing_required_data`
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/task_bundle.rego#L92[Source, window="_blank"]
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/task_bundle/task_bundle.rego#L92[Source, window="_blank"]
[#task_bundle__untrusted_task_bundle]
=== link:#task_bundle__untrusted_task_bundle[Task bundle is not trusted]
Expand All @@ -30,7 +30,7 @@ For each Task in the Pipeline definition, check if the Tekton Bundle used is a t
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `Pipeline task '%s' uses an untrusted task bundle '%s'`
* Code: `task_bundle.untrusted_task_bundle`
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/task_bundle.rego#L77[Source, window="_blank"]
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/task_bundle/task_bundle.rego#L77[Source, window="_blank"]
[#task_bundle__out_of_date_task_bundle]
=== link:#task_bundle__out_of_date_task_bundle[Task bundle is out of date]
Expand All @@ -40,7 +40,7 @@ For each Task in the Pipeline definition, check if the Tekton Bundle used is the
* Rule type: [rule-type-indicator warning]#WARNING#
* WARNING message: `Pipeline task '%s' uses an out of date task bundle '%s'`
* Code: `task_bundle.out_of_date_task_bundle`
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/task_bundle.rego#L34[Source, window="_blank"]
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/task_bundle/task_bundle.rego#L34[Source, window="_blank"]
[#task_bundle__empty_task_bundle_reference]
=== link:#task_bundle__empty_task_bundle_reference[Task bundle reference is empty]
Expand All @@ -50,7 +50,7 @@ Check that a valid task bundle reference is being used.
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `Pipeline task '%s' uses an empty bundle image reference`
* Code: `task_bundle.empty_task_bundle_reference`
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/task_bundle.rego#L64[Source, window="_blank"]
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/task_bundle/task_bundle.rego#L64[Source, window="_blank"]
[#task_bundle__disallowed_task_reference]
=== link:#task_bundle__disallowed_task_reference[Task bundle was not used or is not defined]
Expand All @@ -60,7 +60,7 @@ Check for the existence of a task bundle. This rule will fail if the task is not
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `Pipeline task '%s' does not contain a bundle reference`
* Code: `task_bundle.disallowed_task_reference`
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/task_bundle.rego#L50[Source, window="_blank"]
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/task_bundle/task_bundle.rego#L50[Source, window="_blank"]
[#task_bundle__unpinned_task_bundle]
=== link:#task_bundle__unpinned_task_bundle[Unpinned task bundle reference]
Expand All @@ -70,15 +70,15 @@ Check if the Tekton Bundle used for the Tasks in the Pipeline definition is pinn
* Rule type: [rule-type-indicator warning]#WARNING#
* WARNING message: `Pipeline task '%s' uses an unpinned task bundle reference '%s'`
* Code: `task_bundle.unpinned_task_bundle`
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/task_bundle.rego#L20[Source, window="_blank"]
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/task_bundle/task_bundle.rego#L20[Source, window="_blank"]
[#basic_package]
== link:#basic_package[Pipeline definition sanity checks]
Policies to confirm the Tekton Pipeline definition has the expected kind.
* Package name: `basic`
* Package full path: `policy.pipeline.basic`
* Package full path: `pipeline.basic`
[#basic__expected_kind]
=== link:#basic__expected_kind[Pipeline definition has expected kind]
Expand All @@ -88,15 +88,15 @@ Confirm that the pipeline definition has the kind "Pipeline".
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `Unexpected kind '%s' for pipeline definition`
* Code: `basic.expected_kind`
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/basic.rego#L19[Source, window="_blank"]
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/basic/basic.rego#L19[Source, window="_blank"]
[#required_tasks_package]
== link:#required_tasks_package[Required tasks]
Konflux expects that certain Tekton tasks are executed during image builds. This package includes policy rules to confirm that the pipeline definition includes those required tasks.
* Package name: `required_tasks`
* Package full path: `policy.pipeline.required_tasks`
* Package full path: `pipeline.required_tasks`
[#required_tasks__missing_future_required_task]
=== link:#required_tasks__missing_future_required_task[Missing future required task]
Expand All @@ -106,7 +106,7 @@ Produce a warning when a task that will be required in the future is not current
* Rule type: [rule-type-indicator warning]#WARNING#
* WARNING message: `%s is missing and will be required on %s`
* Code: `required_tasks.missing_future_required_task`
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/required_tasks.rego#L35[Source, window="_blank"]
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/required_tasks/required_tasks.rego#L35[Source, window="_blank"]
[#required_tasks__missing_required_task]
=== link:#required_tasks__missing_required_task[Missing required task]
Expand All @@ -116,7 +116,7 @@ Ensure that the set of required tasks is included in the Pipeline definition.
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `%s is missing`
* Code: `required_tasks.missing_required_task`
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/required_tasks.rego#L72[Source, window="_blank"]
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/required_tasks/required_tasks.rego#L72[Source, window="_blank"]
[#required_tasks__tasks_found]
=== link:#required_tasks__tasks_found[Pipeline contains tasks]
Expand All @@ -126,7 +126,7 @@ Confirm at least one task is present in the pipeline definition.
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `No tasks found in pipeline`
* Code: `required_tasks.tasks_found`
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/required_tasks.rego#L59[Source, window="_blank"]
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/required_tasks/required_tasks.rego#L59[Source, window="_blank"]
[#required_tasks__required_tasks_list_present]
=== link:#required_tasks__required_tasks_list_present[Required task list is present in rule data]
Expand All @@ -136,7 +136,7 @@ Confirm the `required-tasks` rule data was provided, since it's required by the
* Rule type: [rule-type-indicator failure]#FAILURE#
* FAILURE message: `The required tasks list is missing from the rule data`
* Code: `required_tasks.required_tasks_list_present`
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/required_tasks.rego#L91[Source, window="_blank"]
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/required_tasks/required_tasks.rego#L91[Source, window="_blank"]
[#required_tasks__required_tasks_found]
=== link:#required_tasks__required_tasks_found[Required tasks found in pipeline definition]
Expand All @@ -146,4 +146,4 @@ Produce a warning if a list of current or future required tasks does not exist i
* Rule type: [rule-type-indicator warning]#WARNING#
* WARNING message: `Required tasks do not exist for pipeline %q`
* Code: `required_tasks.required_tasks_found`
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/required_tasks.rego#L16[Source, window="_blank"]
* https://github.com/enterprise-contract/ec-policies/blob/{page-origin-refhash}/policy/pipeline/required_tasks/required_tasks.rego#L16[Source, window="_blank"]
Loading

0 comments on commit c93514e

Please sign in to comment.