Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent release with quay expires-after set #993

Merged
merged 1 commit into from
May 15, 2024

Conversation

simonbaird
Copy link
Member

The quay.expires-after label is used by quay.io to indicate the image doesn't need to be kept indefinitely. The goal is to prevent unintentionally releasing images with that label is set.

There's some dependency on the extra rule data name/value chosen in EC-618 so this is WIP for now.

Ref: https://issues.redhat.com/browse/KFLUXBUGS-1223

@simonbaird
Copy link
Member Author

I didn't test it with a real image yet.

policy/lib/rule_data.rego Outdated Show resolved Hide resolved
@codecov-commenter
Copy link

codecov-commenter commented May 10, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 100.00%. Comparing base (b977a95) to head (9750df9).

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff            @@
##              main      #993   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          103       105    +2     
  Lines         4930      4961   +31     
=========================================
+ Hits          4930      4961   +31     
Files Coverage Δ
policy/release/quay_expiration.rego 100.00% <100.00%> (ø)
policy/release/quay_expiration_test.rego 100.00% <100.00%> (ø)

@simonbaird simonbaird marked this pull request as ready for review May 14, 2024 16:53
@zregvart
Copy link
Member

Be wary both this and #999 modify the same docs so one of them most likely would need to be rebased on top of the other.

The quay.expires-after label is used by quay.io to indicate the
image doesn't need to be kept indefinitely. The goal is to prevent
unintentionally releasing images with that label is set.

Uses the newly introduced `pipeline_intention` rule data to
determine if we're running the check in a release pipeline.

Ref: https://issues.redhat.com/browse/KFLUXBUGS-1223
@simonbaird
Copy link
Member Author

A rebase plus minor tweaks.

@simonbaird
Copy link
Member Author

Let's merge.

@simonbaird simonbaird merged commit 7058844 into enterprise-contract:main May 15, 2024
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants