@intentius/terragucci 0.4.8 → 0.4.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/estate.schema.json +1 -0
- package/dist/inventory.schema.json +1 -0
- package/dist/report.schema.json +25 -3
- package/dist/terragucci.mjs +700 -680
- package/dist/terragucci.mjs.map +4 -4
- package/dist/terragucci.schema.json +463 -2
- package/dist/types.d.ts +86 -3
- package/package.json +6 -6
|
@@ -731,7 +731,29 @@
|
|
|
731
731
|
"minLength": 1
|
|
732
732
|
},
|
|
733
733
|
"audience": {
|
|
734
|
-
"
|
|
734
|
+
"anyOf": [
|
|
735
|
+
{
|
|
736
|
+
"type": "string"
|
|
737
|
+
},
|
|
738
|
+
{
|
|
739
|
+
"type": "object",
|
|
740
|
+
"properties": {
|
|
741
|
+
"plan": {
|
|
742
|
+
"type": "string",
|
|
743
|
+
"minLength": 1
|
|
744
|
+
},
|
|
745
|
+
"apply": {
|
|
746
|
+
"type": "string",
|
|
747
|
+
"minLength": 1
|
|
748
|
+
},
|
|
749
|
+
"drift": {
|
|
750
|
+
"type": "string",
|
|
751
|
+
"minLength": 1
|
|
752
|
+
}
|
|
753
|
+
},
|
|
754
|
+
"additionalProperties": false
|
|
755
|
+
}
|
|
756
|
+
]
|
|
735
757
|
},
|
|
736
758
|
"roles": {
|
|
737
759
|
"type": "object",
|
|
@@ -1386,6 +1408,216 @@
|
|
|
1386
1408
|
],
|
|
1387
1409
|
"description": "Roots each pull request gets a copy of."
|
|
1388
1410
|
},
|
|
1411
|
+
"environments": {
|
|
1412
|
+
"type": "object",
|
|
1413
|
+
"minProperties": 1,
|
|
1414
|
+
"propertyNames": {
|
|
1415
|
+
"type": "string",
|
|
1416
|
+
"pattern": "^[a-z0-9_-]+$",
|
|
1417
|
+
"not": {
|
|
1418
|
+
"anyOf": [
|
|
1419
|
+
{
|
|
1420
|
+
"enum": [
|
|
1421
|
+
"default",
|
|
1422
|
+
"decide"
|
|
1423
|
+
]
|
|
1424
|
+
},
|
|
1425
|
+
{
|
|
1426
|
+
"pattern": "^share-[0-9]+$"
|
|
1427
|
+
}
|
|
1428
|
+
]
|
|
1429
|
+
}
|
|
1430
|
+
},
|
|
1431
|
+
"additionalProperties": {
|
|
1432
|
+
"type": "object",
|
|
1433
|
+
"properties": {
|
|
1434
|
+
"roots": {
|
|
1435
|
+
"type": "array",
|
|
1436
|
+
"minItems": 1,
|
|
1437
|
+
"items": {
|
|
1438
|
+
"type": "string",
|
|
1439
|
+
"pattern": "^[^\\s,;=']+$"
|
|
1440
|
+
}
|
|
1441
|
+
},
|
|
1442
|
+
"gate": {
|
|
1443
|
+
"enum": [
|
|
1444
|
+
"always",
|
|
1445
|
+
"on-destructive",
|
|
1446
|
+
"never",
|
|
1447
|
+
"on-destroy"
|
|
1448
|
+
]
|
|
1449
|
+
},
|
|
1450
|
+
"oidc": {
|
|
1451
|
+
"type": "object",
|
|
1452
|
+
"properties": {
|
|
1453
|
+
"plan_role": {
|
|
1454
|
+
"type": "string",
|
|
1455
|
+
"minLength": 1
|
|
1456
|
+
},
|
|
1457
|
+
"apply_role": {
|
|
1458
|
+
"type": "string",
|
|
1459
|
+
"minLength": 1
|
|
1460
|
+
},
|
|
1461
|
+
"audience": {
|
|
1462
|
+
"type": "string",
|
|
1463
|
+
"minLength": 1,
|
|
1464
|
+
"pattern": "\\S"
|
|
1465
|
+
},
|
|
1466
|
+
"gcp": {
|
|
1467
|
+
"type": "object",
|
|
1468
|
+
"properties": {
|
|
1469
|
+
"plan_service_account": {
|
|
1470
|
+
"type": "string",
|
|
1471
|
+
"pattern": "^[^@\\s]+@[^@\\s]+$"
|
|
1472
|
+
},
|
|
1473
|
+
"apply_service_account": {
|
|
1474
|
+
"type": "string",
|
|
1475
|
+
"pattern": "^[^@\\s]+@[^@\\s]+$"
|
|
1476
|
+
}
|
|
1477
|
+
},
|
|
1478
|
+
"additionalProperties": false,
|
|
1479
|
+
"required": [
|
|
1480
|
+
"plan_service_account",
|
|
1481
|
+
"apply_service_account"
|
|
1482
|
+
]
|
|
1483
|
+
},
|
|
1484
|
+
"azure": {
|
|
1485
|
+
"type": "object",
|
|
1486
|
+
"properties": {
|
|
1487
|
+
"plan_client_id": {
|
|
1488
|
+
"type": "string",
|
|
1489
|
+
"minLength": 1
|
|
1490
|
+
},
|
|
1491
|
+
"apply_client_id": {
|
|
1492
|
+
"type": "string",
|
|
1493
|
+
"minLength": 1
|
|
1494
|
+
}
|
|
1495
|
+
},
|
|
1496
|
+
"additionalProperties": false,
|
|
1497
|
+
"required": [
|
|
1498
|
+
"plan_client_id",
|
|
1499
|
+
"apply_client_id"
|
|
1500
|
+
]
|
|
1501
|
+
}
|
|
1502
|
+
},
|
|
1503
|
+
"additionalProperties": false,
|
|
1504
|
+
"minProperties": 1,
|
|
1505
|
+
"dependentRequired": {
|
|
1506
|
+
"plan_role": [
|
|
1507
|
+
"apply_role"
|
|
1508
|
+
],
|
|
1509
|
+
"apply_role": [
|
|
1510
|
+
"plan_role"
|
|
1511
|
+
]
|
|
1512
|
+
}
|
|
1513
|
+
},
|
|
1514
|
+
"runner": {
|
|
1515
|
+
"anyOf": [
|
|
1516
|
+
{
|
|
1517
|
+
"anyOf": [
|
|
1518
|
+
{
|
|
1519
|
+
"type": "string",
|
|
1520
|
+
"pattern": "^[^\\s,]+$"
|
|
1521
|
+
},
|
|
1522
|
+
{
|
|
1523
|
+
"type": "array",
|
|
1524
|
+
"minItems": 1,
|
|
1525
|
+
"uniqueItems": true,
|
|
1526
|
+
"items": {
|
|
1527
|
+
"type": "string",
|
|
1528
|
+
"pattern": "^[^\\s,]+$"
|
|
1529
|
+
}
|
|
1530
|
+
},
|
|
1531
|
+
{
|
|
1532
|
+
"type": "object",
|
|
1533
|
+
"properties": {
|
|
1534
|
+
"group": {
|
|
1535
|
+
"type": "string",
|
|
1536
|
+
"pattern": "\\S"
|
|
1537
|
+
},
|
|
1538
|
+
"labels": {
|
|
1539
|
+
"type": "array",
|
|
1540
|
+
"minItems": 1,
|
|
1541
|
+
"uniqueItems": true,
|
|
1542
|
+
"items": {
|
|
1543
|
+
"type": "string",
|
|
1544
|
+
"pattern": "^[^\\s,]+$"
|
|
1545
|
+
}
|
|
1546
|
+
}
|
|
1547
|
+
},
|
|
1548
|
+
"additionalProperties": false,
|
|
1549
|
+
"required": [
|
|
1550
|
+
"group"
|
|
1551
|
+
]
|
|
1552
|
+
}
|
|
1553
|
+
]
|
|
1554
|
+
},
|
|
1555
|
+
{
|
|
1556
|
+
"type": "object",
|
|
1557
|
+
"properties": {
|
|
1558
|
+
"apply": {
|
|
1559
|
+
"anyOf": [
|
|
1560
|
+
{
|
|
1561
|
+
"type": "string",
|
|
1562
|
+
"pattern": "^[^\\s,]+$"
|
|
1563
|
+
},
|
|
1564
|
+
{
|
|
1565
|
+
"type": "array",
|
|
1566
|
+
"minItems": 1,
|
|
1567
|
+
"uniqueItems": true,
|
|
1568
|
+
"items": {
|
|
1569
|
+
"type": "string",
|
|
1570
|
+
"pattern": "^[^\\s,]+$"
|
|
1571
|
+
}
|
|
1572
|
+
},
|
|
1573
|
+
{
|
|
1574
|
+
"type": "object",
|
|
1575
|
+
"properties": {
|
|
1576
|
+
"group": {
|
|
1577
|
+
"type": "string",
|
|
1578
|
+
"pattern": "\\S"
|
|
1579
|
+
},
|
|
1580
|
+
"labels": {
|
|
1581
|
+
"type": "array",
|
|
1582
|
+
"minItems": 1,
|
|
1583
|
+
"uniqueItems": true,
|
|
1584
|
+
"items": {
|
|
1585
|
+
"type": "string",
|
|
1586
|
+
"pattern": "^[^\\s,]+$"
|
|
1587
|
+
}
|
|
1588
|
+
}
|
|
1589
|
+
},
|
|
1590
|
+
"additionalProperties": false,
|
|
1591
|
+
"required": [
|
|
1592
|
+
"group"
|
|
1593
|
+
]
|
|
1594
|
+
}
|
|
1595
|
+
]
|
|
1596
|
+
}
|
|
1597
|
+
},
|
|
1598
|
+
"additionalProperties": false,
|
|
1599
|
+
"required": [
|
|
1600
|
+
"apply"
|
|
1601
|
+
]
|
|
1602
|
+
}
|
|
1603
|
+
]
|
|
1604
|
+
},
|
|
1605
|
+
"parallelism": {
|
|
1606
|
+
"type": "integer",
|
|
1607
|
+
"minimum": 1
|
|
1608
|
+
},
|
|
1609
|
+
"forge_environment": {
|
|
1610
|
+
"type": "string",
|
|
1611
|
+
"pattern": "^[A-Za-z0-9_][A-Za-z0-9_./-]*$"
|
|
1612
|
+
}
|
|
1613
|
+
},
|
|
1614
|
+
"additionalProperties": false,
|
|
1615
|
+
"required": [
|
|
1616
|
+
"roots"
|
|
1617
|
+
]
|
|
1618
|
+
},
|
|
1619
|
+
"description": "Named environments: each one's root globs, and its gate, identities, apply runner, parallelism and forge environment."
|
|
1620
|
+
},
|
|
1389
1621
|
"defaults": {
|
|
1390
1622
|
"$ref": "#/$defs/project",
|
|
1391
1623
|
"not": {
|
|
@@ -2140,7 +2372,29 @@
|
|
|
2140
2372
|
"minLength": 1
|
|
2141
2373
|
},
|
|
2142
2374
|
"audience": {
|
|
2143
|
-
"
|
|
2375
|
+
"anyOf": [
|
|
2376
|
+
{
|
|
2377
|
+
"type": "string"
|
|
2378
|
+
},
|
|
2379
|
+
{
|
|
2380
|
+
"type": "object",
|
|
2381
|
+
"properties": {
|
|
2382
|
+
"plan": {
|
|
2383
|
+
"type": "string",
|
|
2384
|
+
"minLength": 1
|
|
2385
|
+
},
|
|
2386
|
+
"apply": {
|
|
2387
|
+
"type": "string",
|
|
2388
|
+
"minLength": 1
|
|
2389
|
+
},
|
|
2390
|
+
"drift": {
|
|
2391
|
+
"type": "string",
|
|
2392
|
+
"minLength": 1
|
|
2393
|
+
}
|
|
2394
|
+
},
|
|
2395
|
+
"additionalProperties": false
|
|
2396
|
+
}
|
|
2397
|
+
]
|
|
2144
2398
|
},
|
|
2145
2399
|
"roles": {
|
|
2146
2400
|
"type": "object",
|
|
@@ -2794,6 +3048,213 @@
|
|
|
2794
3048
|
"roots"
|
|
2795
3049
|
],
|
|
2796
3050
|
"description": "Roots each pull request gets a copy of."
|
|
3051
|
+
},
|
|
3052
|
+
"environments": {
|
|
3053
|
+
"type": "object",
|
|
3054
|
+
"minProperties": 1,
|
|
3055
|
+
"propertyNames": {
|
|
3056
|
+
"type": "string",
|
|
3057
|
+
"pattern": "^[a-z0-9_-]+$",
|
|
3058
|
+
"not": {
|
|
3059
|
+
"anyOf": [
|
|
3060
|
+
{
|
|
3061
|
+
"enum": [
|
|
3062
|
+
"default",
|
|
3063
|
+
"decide"
|
|
3064
|
+
]
|
|
3065
|
+
},
|
|
3066
|
+
{
|
|
3067
|
+
"pattern": "^share-[0-9]+$"
|
|
3068
|
+
}
|
|
3069
|
+
]
|
|
3070
|
+
}
|
|
3071
|
+
},
|
|
3072
|
+
"additionalProperties": {
|
|
3073
|
+
"type": "object",
|
|
3074
|
+
"properties": {
|
|
3075
|
+
"roots": {
|
|
3076
|
+
"type": "array",
|
|
3077
|
+
"minItems": 1,
|
|
3078
|
+
"items": {
|
|
3079
|
+
"type": "string",
|
|
3080
|
+
"pattern": "^[^\\s,;=']+$"
|
|
3081
|
+
}
|
|
3082
|
+
},
|
|
3083
|
+
"gate": {
|
|
3084
|
+
"enum": [
|
|
3085
|
+
"always",
|
|
3086
|
+
"on-destructive",
|
|
3087
|
+
"never",
|
|
3088
|
+
"on-destroy"
|
|
3089
|
+
]
|
|
3090
|
+
},
|
|
3091
|
+
"oidc": {
|
|
3092
|
+
"type": "object",
|
|
3093
|
+
"properties": {
|
|
3094
|
+
"plan_role": {
|
|
3095
|
+
"type": "string",
|
|
3096
|
+
"minLength": 1
|
|
3097
|
+
},
|
|
3098
|
+
"apply_role": {
|
|
3099
|
+
"type": "string",
|
|
3100
|
+
"minLength": 1
|
|
3101
|
+
},
|
|
3102
|
+
"audience": {
|
|
3103
|
+
"type": "string",
|
|
3104
|
+
"minLength": 1,
|
|
3105
|
+
"pattern": "\\S"
|
|
3106
|
+
},
|
|
3107
|
+
"gcp": {
|
|
3108
|
+
"type": "object",
|
|
3109
|
+
"properties": {
|
|
3110
|
+
"plan_service_account": {
|
|
3111
|
+
"type": "string",
|
|
3112
|
+
"pattern": "^[^@\\s]+@[^@\\s]+$"
|
|
3113
|
+
},
|
|
3114
|
+
"apply_service_account": {
|
|
3115
|
+
"type": "string",
|
|
3116
|
+
"pattern": "^[^@\\s]+@[^@\\s]+$"
|
|
3117
|
+
}
|
|
3118
|
+
},
|
|
3119
|
+
"additionalProperties": false,
|
|
3120
|
+
"required": [
|
|
3121
|
+
"plan_service_account",
|
|
3122
|
+
"apply_service_account"
|
|
3123
|
+
]
|
|
3124
|
+
},
|
|
3125
|
+
"azure": {
|
|
3126
|
+
"type": "object",
|
|
3127
|
+
"properties": {
|
|
3128
|
+
"plan_client_id": {
|
|
3129
|
+
"type": "string",
|
|
3130
|
+
"minLength": 1
|
|
3131
|
+
},
|
|
3132
|
+
"apply_client_id": {
|
|
3133
|
+
"type": "string",
|
|
3134
|
+
"minLength": 1
|
|
3135
|
+
}
|
|
3136
|
+
},
|
|
3137
|
+
"additionalProperties": false,
|
|
3138
|
+
"required": [
|
|
3139
|
+
"plan_client_id",
|
|
3140
|
+
"apply_client_id"
|
|
3141
|
+
]
|
|
3142
|
+
}
|
|
3143
|
+
},
|
|
3144
|
+
"additionalProperties": false,
|
|
3145
|
+
"minProperties": 1,
|
|
3146
|
+
"dependentRequired": {
|
|
3147
|
+
"plan_role": [
|
|
3148
|
+
"apply_role"
|
|
3149
|
+
],
|
|
3150
|
+
"apply_role": [
|
|
3151
|
+
"plan_role"
|
|
3152
|
+
]
|
|
3153
|
+
}
|
|
3154
|
+
},
|
|
3155
|
+
"runner": {
|
|
3156
|
+
"anyOf": [
|
|
3157
|
+
{
|
|
3158
|
+
"anyOf": [
|
|
3159
|
+
{
|
|
3160
|
+
"type": "string",
|
|
3161
|
+
"pattern": "^[^\\s,]+$"
|
|
3162
|
+
},
|
|
3163
|
+
{
|
|
3164
|
+
"type": "array",
|
|
3165
|
+
"minItems": 1,
|
|
3166
|
+
"uniqueItems": true,
|
|
3167
|
+
"items": {
|
|
3168
|
+
"type": "string",
|
|
3169
|
+
"pattern": "^[^\\s,]+$"
|
|
3170
|
+
}
|
|
3171
|
+
},
|
|
3172
|
+
{
|
|
3173
|
+
"type": "object",
|
|
3174
|
+
"properties": {
|
|
3175
|
+
"group": {
|
|
3176
|
+
"type": "string",
|
|
3177
|
+
"pattern": "\\S"
|
|
3178
|
+
},
|
|
3179
|
+
"labels": {
|
|
3180
|
+
"type": "array",
|
|
3181
|
+
"minItems": 1,
|
|
3182
|
+
"uniqueItems": true,
|
|
3183
|
+
"items": {
|
|
3184
|
+
"type": "string",
|
|
3185
|
+
"pattern": "^[^\\s,]+$"
|
|
3186
|
+
}
|
|
3187
|
+
}
|
|
3188
|
+
},
|
|
3189
|
+
"additionalProperties": false,
|
|
3190
|
+
"required": [
|
|
3191
|
+
"group"
|
|
3192
|
+
]
|
|
3193
|
+
}
|
|
3194
|
+
]
|
|
3195
|
+
},
|
|
3196
|
+
{
|
|
3197
|
+
"type": "object",
|
|
3198
|
+
"properties": {
|
|
3199
|
+
"apply": {
|
|
3200
|
+
"anyOf": [
|
|
3201
|
+
{
|
|
3202
|
+
"type": "string",
|
|
3203
|
+
"pattern": "^[^\\s,]+$"
|
|
3204
|
+
},
|
|
3205
|
+
{
|
|
3206
|
+
"type": "array",
|
|
3207
|
+
"minItems": 1,
|
|
3208
|
+
"uniqueItems": true,
|
|
3209
|
+
"items": {
|
|
3210
|
+
"type": "string",
|
|
3211
|
+
"pattern": "^[^\\s,]+$"
|
|
3212
|
+
}
|
|
3213
|
+
},
|
|
3214
|
+
{
|
|
3215
|
+
"type": "object",
|
|
3216
|
+
"properties": {
|
|
3217
|
+
"group": {
|
|
3218
|
+
"type": "string",
|
|
3219
|
+
"pattern": "\\S"
|
|
3220
|
+
},
|
|
3221
|
+
"labels": {
|
|
3222
|
+
"type": "array",
|
|
3223
|
+
"minItems": 1,
|
|
3224
|
+
"uniqueItems": true,
|
|
3225
|
+
"items": {
|
|
3226
|
+
"type": "string",
|
|
3227
|
+
"pattern": "^[^\\s,]+$"
|
|
3228
|
+
}
|
|
3229
|
+
}
|
|
3230
|
+
},
|
|
3231
|
+
"additionalProperties": false,
|
|
3232
|
+
"required": [
|
|
3233
|
+
"group"
|
|
3234
|
+
]
|
|
3235
|
+
}
|
|
3236
|
+
]
|
|
3237
|
+
}
|
|
3238
|
+
},
|
|
3239
|
+
"additionalProperties": false,
|
|
3240
|
+
"required": [
|
|
3241
|
+
"apply"
|
|
3242
|
+
]
|
|
3243
|
+
}
|
|
3244
|
+
]
|
|
3245
|
+
},
|
|
3246
|
+
"parallelism": {
|
|
3247
|
+
"type": "integer",
|
|
3248
|
+
"minimum": 1
|
|
3249
|
+
},
|
|
3250
|
+
"forge_environment": {
|
|
3251
|
+
"type": "string",
|
|
3252
|
+
"pattern": "^[A-Za-z0-9_][A-Za-z0-9_./-]*$"
|
|
3253
|
+
}
|
|
3254
|
+
},
|
|
3255
|
+
"additionalProperties": false
|
|
3256
|
+
},
|
|
3257
|
+
"description": "Named environments: each one's root globs, and its gate, identities, apply runner, parallelism and forge environment."
|
|
2797
3258
|
}
|
|
2798
3259
|
},
|
|
2799
3260
|
"additionalProperties": false
|
package/dist/types.d.ts
CHANGED
|
@@ -182,8 +182,12 @@ export interface OidcSettings {
|
|
|
182
182
|
* does this.
|
|
183
183
|
*/
|
|
184
184
|
roles?: Record<string, RolePair>;
|
|
185
|
-
/**
|
|
186
|
-
|
|
185
|
+
/**
|
|
186
|
+
* The AWS token's audience. Default `sts.amazonaws.com`. A map gives each
|
|
187
|
+
* stage its own (`plan`, `apply`, `drift`); a stage it leaves out keeps the
|
|
188
|
+
* default.
|
|
189
|
+
*/
|
|
190
|
+
audience?: string | Partial<Record<AudienceStage, string>>;
|
|
187
191
|
/** GCP Workload Identity Federation: the provider's resource name and a service account per stage. */
|
|
188
192
|
gcp?: {
|
|
189
193
|
workload_identity_provider: string;
|
|
@@ -545,6 +549,54 @@ export interface ProjectSettings {
|
|
|
545
549
|
own_jobs?: string | Record<string, Record<string, unknown>>;
|
|
546
550
|
/** Roots each pull request gets a copy of, under a state key of its own, destroyed on close or once its TTL passes; see EphemeralSettings. */
|
|
547
551
|
ephemeral?: EphemeralSettings;
|
|
552
|
+
/**
|
|
553
|
+
* Named environments: each names its roots by glob and sets the keys that
|
|
554
|
+
* vary for them (./environments.ts). A root in no environment takes the
|
|
555
|
+
* top-level values. Read at base, like `gate`. A control repo's `defaults`
|
|
556
|
+
* and project blocks merge them per environment name.
|
|
557
|
+
*/
|
|
558
|
+
environments?: Record<string, EnvironmentSettings>;
|
|
559
|
+
}
|
|
560
|
+
/** An environment's name: lower-case letters, digits, `-` and `_`. */
|
|
561
|
+
export declare const ENVIRONMENT_NAME: RegExp;
|
|
562
|
+
/** The keys an environment takes. */
|
|
563
|
+
export declare const ENVIRONMENT_KEYS: readonly ["roots", "gate", "oidc", "runner", "parallelism", "forge_environment"];
|
|
564
|
+
/** The keys of an environment's `oidc`. */
|
|
565
|
+
export declare const ENVIRONMENT_OIDC_KEYS: readonly ["plan_role", "apply_role", "audience", "gcp", "azure"];
|
|
566
|
+
/**
|
|
567
|
+
* One environment of `environments:`. `roots` are root globs; a root matches
|
|
568
|
+
* at most one environment. Each other key, when set, replaces the top-level
|
|
569
|
+
* key's value for the environment's roots.
|
|
570
|
+
*/
|
|
571
|
+
export interface EnvironmentSettings {
|
|
572
|
+
roots: string[];
|
|
573
|
+
/** The gate of a wave that holds the environment's roots. A wave of roots in several environments takes the strictest of their gates. */
|
|
574
|
+
gate?: GateName;
|
|
575
|
+
/** The environment's identities: its roots plan and apply with them, as `oidc.roles` gives a root glob a pair. */
|
|
576
|
+
oidc?: EnvironmentOidc;
|
|
577
|
+
/** The runner the environment's apply jobs run on: a runner, or `{ apply: <runner> }`. A plan job plans every environment's roots, so it keeps the top-level runner. */
|
|
578
|
+
runner?: RunnerSpec | {
|
|
579
|
+
apply?: RunnerSpec;
|
|
580
|
+
};
|
|
581
|
+
/** How many of the environment's roots of one dependency layer plan at once. */
|
|
582
|
+
parallelism?: number;
|
|
583
|
+
/** The forge environment its apply jobs run in, on GitHub and GitLab. Default: the environment's name. Forgejo has none. */
|
|
584
|
+
forge_environment?: string;
|
|
585
|
+
}
|
|
586
|
+
/** An environment's identities: an AWS role pair, and a GCP service account pair or an Azure client pair under the project's `oidc.gcp` or `oidc.azure`. */
|
|
587
|
+
export interface EnvironmentOidc {
|
|
588
|
+
plan_role?: string;
|
|
589
|
+
apply_role?: string;
|
|
590
|
+
/** The AWS token audience of the environment's apply jobs, over `oidc.audience`. */
|
|
591
|
+
audience?: string;
|
|
592
|
+
gcp?: {
|
|
593
|
+
plan_service_account: string;
|
|
594
|
+
apply_service_account: string;
|
|
595
|
+
};
|
|
596
|
+
azure?: {
|
|
597
|
+
plan_client_id: string;
|
|
598
|
+
apply_client_id: string;
|
|
599
|
+
};
|
|
548
600
|
}
|
|
549
601
|
/**
|
|
550
602
|
* Ephemeral environments: each open pull request gets its own copy of the
|
|
@@ -632,7 +684,7 @@ export declare const BUILT_IN: ResolvedSettings;
|
|
|
632
684
|
* own clone URL and `rollouts` belongs to a single repo, so `defaults`
|
|
633
685
|
* refuses both.
|
|
634
686
|
*/
|
|
635
|
-
export declare const PROJECT_FILE_KEYS: readonly ["policy", "sources", "reports", "approval", "gate", "roots", "waves", "parallelism", "synth", "steps", "drift", "cost", "tips", "runtime", "telemetry", "respond", "review", "decide", "audit_region", "modules", "terragrunt", "token_env", "generate", "ephemeral"];
|
|
687
|
+
export declare const PROJECT_FILE_KEYS: readonly ["policy", "sources", "reports", "approval", "gate", "roots", "waves", "parallelism", "synth", "steps", "drift", "cost", "tips", "runtime", "telemetry", "respond", "review", "decide", "audit_region", "modules", "terragrunt", "token_env", "generate", "ephemeral", "environments"];
|
|
636
688
|
export declare class ConfigError extends Error {
|
|
637
689
|
/** Every problem found, when the error is a validation failure. */
|
|
638
690
|
readonly problems?: string[];
|
|
@@ -653,6 +705,9 @@ export declare const SOURCES_KEYS: string[];
|
|
|
653
705
|
/** One `sources` entry: a glob with no whitespace, commas, semicolons or quotes. */
|
|
654
706
|
export declare const SOURCE_GLOB = "^[^\\s,;'\"]+$";
|
|
655
707
|
export declare const OIDC_KEYS: string[];
|
|
708
|
+
/** The stages `oidc.audience` takes as a map: the jobs that plan a change, the jobs that apply (confirm among them), and drift. */
|
|
709
|
+
export declare const AUDIENCE_STAGES: readonly ["plan", "apply", "drift"];
|
|
710
|
+
export type AudienceStage = (typeof AUDIENCE_STAGES)[number];
|
|
656
711
|
export declare const TELEMETRY_KEYS: string[];
|
|
657
712
|
export declare const TOKEN_PROTECTION_KEYS: string[];
|
|
658
713
|
export declare const COST_KEYS: string[];
|
|
@@ -795,6 +850,32 @@ export declare const ATMOS_KEYS: string[];
|
|
|
795
850
|
export declare const ATMOS_NOT_TERRAGRUNT = "terragucci runs an Atmos repo or a Terragrunt repo, not both; keep the block of the one this repo is";
|
|
796
851
|
/** The GCP Workload Identity Federation provider's resource name. */
|
|
797
852
|
export declare const WIF_PROVIDER: RegExp;
|
|
853
|
+
/** The apply group of the roots in no environment, or that no glob gives an identity (./groups.ts). */
|
|
854
|
+
export declare const DEFAULT_GROUP = "default";
|
|
855
|
+
/** Names an apply group cannot take: the rest group's, and chant's own job names (decide, share-<i>). */
|
|
856
|
+
export declare const reservedGroupName: (name: string) => boolean;
|
|
857
|
+
/** Why an environment's `runner.plan` is refused: a plan job plans the roots of every environment. */
|
|
858
|
+
export declare const ENVIRONMENT_PLAN_RUNNER = "a plan job plans the roots of every environment, so an environment's runner is its apply jobs' alone; set runner: { apply: <runner> }, and runner.plan at the top level";
|
|
859
|
+
/** A forge environment's name, as GitHub and GitLab both take it. */
|
|
860
|
+
export declare const FORGE_ENVIRONMENT_NAME: RegExp;
|
|
861
|
+
/** Why an environment cannot take a name the apply jobs use for their own. */
|
|
862
|
+
export declare const ENVIRONMENT_RESERVED = "names the apply jobs use for their own (default holds the roots in no environment; decide and share-<n> are a wave's own jobs)";
|
|
863
|
+
/** Why `environments` refuses `apply.when: pull-request`: a comment's one job applies every environment's roots. */
|
|
864
|
+
export declare const ENVIRONMENTS_PR_APPLY = "with environments each environment's roots apply in jobs of their own, with their own identities, and apply.when: pull-request applies every wave in the one job a comment starts; leave apply.when at merge";
|
|
865
|
+
/** Why `environments` refuses `apply.resume` on GitHub and Forgejo: the resume job applies every wave in one job. */
|
|
866
|
+
export declare const ENVIRONMENTS_RESUME = "with environments each environment's roots apply in jobs of their own, and on GitHub and Forgejo the resume job applies every wave in one job; leave apply.resume unset and re-run the waiting wave's job once it is approved";
|
|
867
|
+
/** Why `environments` refuses `ephemeral`: a pull request's copies apply in one job with the apply identities. */
|
|
868
|
+
export declare const ENVIRONMENTS_EPHEMERAL = "with environments each environment's roots apply in jobs of their own, and an ephemeral copy applies in the pull request's one job; leave ephemeral unset";
|
|
869
|
+
/** Why an environment's `forge_environment` is refused on Forgejo. */
|
|
870
|
+
export declare const FORGE_ENVIRONMENT_NOT_FORGEJO = "Forgejo Actions has no deployment environments, so a job cannot run in one; leave forge_environment out of each environment";
|
|
871
|
+
/**
|
|
872
|
+
* What a whole set of environments needs from the settings around it: a
|
|
873
|
+
* root glob in each, and the project's `oidc.gcp` or `oidc.azure` for an
|
|
874
|
+
* environment that names a GCP or Azure pair, since the provider, the tenant
|
|
875
|
+
* and the token come from there. A repo's own file is checked whole in
|
|
876
|
+
* checkSettings; a control repo's project once its defaults are merged in.
|
|
877
|
+
*/
|
|
878
|
+
export declare function environmentNeeds(s: ProjectSettings, where: string): string[];
|
|
798
879
|
/** Check a parsed config and return it typed, or throw with every problem listed. */
|
|
799
880
|
export declare function validateConfig(raw: unknown, where: string): TerragucciConfig;
|
|
800
881
|
export type ConfigMode = "fold" | "run" | "check";
|
|
@@ -818,3 +899,5 @@ export declare function forgeFromHost(host: string): ForgeName | undefined;
|
|
|
818
899
|
export declare function resolveRepo(config: TerragucciConfig): ResolvedSettings;
|
|
819
900
|
/** A control repo's project: built-in defaults, then `defaults`, then the project's own keys. */
|
|
820
901
|
export declare function resolveProject(config: TerragucciConfig, key: string): ResolvedSettings;
|
|
902
|
+
/** `environments` merged per environment name: an environment both name takes `over`'s keys over `base`'s. */
|
|
903
|
+
export declare function mergeEnvironments(base: Record<string, EnvironmentSettings> | undefined, over: Record<string, EnvironmentSettings> | undefined): Record<string, EnvironmentSettings> | undefined;
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@intentius/terragucci",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.9",
|
|
4
4
|
"description": "The whole Terraform lifecycle, handled: one config file, generated pipelines for GitHub, GitLab and Forgejo.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"type": "module",
|
|
@@ -34,7 +34,7 @@
|
|
|
34
34
|
"build": "node ../../scripts/build-cli.mjs"
|
|
35
35
|
},
|
|
36
36
|
"dependencies": {
|
|
37
|
-
"@intentius/chant": "0.124.
|
|
37
|
+
"@intentius/chant": "0.124.24"
|
|
38
38
|
},
|
|
39
39
|
"peerDependencies": {
|
|
40
40
|
"@intentius/tsad-reference": "2.x",
|
|
@@ -50,10 +50,10 @@
|
|
|
50
50
|
},
|
|
51
51
|
"devDependencies": {
|
|
52
52
|
"@cdktn/hcl2json": "0.24.0",
|
|
53
|
-
"@intentius/chant-lexicon-forgejo": "0.124.
|
|
54
|
-
"@intentius/chant-lexicon-github": "0.124.
|
|
55
|
-
"@intentius/chant-lexicon-gitlab": "0.124.
|
|
56
|
-
"@intentius/chant-lexicon-terraform": "0.124.
|
|
53
|
+
"@intentius/chant-lexicon-forgejo": "0.124.24",
|
|
54
|
+
"@intentius/chant-lexicon-github": "0.124.24",
|
|
55
|
+
"@intentius/chant-lexicon-gitlab": "0.124.24",
|
|
56
|
+
"@intentius/chant-lexicon-terraform": "0.124.24",
|
|
57
57
|
"@intentius/tsad-reference": "2.1.0",
|
|
58
58
|
"@modelcontextprotocol/sdk": "1.30.1"
|
|
59
59
|
}
|