{"id":26958593,"url":"https://github.com/infracloudio/ci-cd-standards-using-opa","last_synced_at":"2025-09-05T07:33:36.794Z","repository":{"id":46313547,"uuid":"257641222","full_name":"infracloudio/ci-cd-standards-using-opa","owner":"infracloudio","description":"A github-action to validate your infrastructure configuration manifests (eg. kubernetes resource yaml manifests) against the ci-cd standards using OpenPolicyAgent (OPA).","archived":false,"fork":false,"pushed_at":"2021-08-23T07:08:56.000Z","size":17,"stargazers_count":6,"open_issues_count":0,"forks_count":3,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-02T15:45:28.275Z","etag":null,"topics":["ci-cd","github-actions","kubernetes","openpolicyagent"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/infracloudio.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-04-21T15:43:15.000Z","updated_at":"2022-08-29T14:59:06.000Z","dependencies_parsed_at":"2022-08-30T01:31:57.358Z","dependency_job_id":null,"html_url":"https://github.com/infracloudio/ci-cd-standards-using-opa","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/infracloudio%2Fci-cd-standards-using-opa","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/infracloudio%2Fci-cd-standards-using-opa/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/infracloudio%2Fci-cd-standards-using-opa/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/infracloudio%2Fci-cd-standards-using-opa/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/infracloudio","download_url":"https://codeload.github.com/infracloudio/ci-cd-standards-using-opa/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246933995,"owners_count":20857167,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ci-cd","github-actions","kubernetes","openpolicyagent"],"created_at":"2025-04-03T04:20:22.736Z","updated_at":"2025-04-03T04:20:23.450Z","avatar_url":"https://github.com/infracloudio.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ci-cd-standards-using-opa\n[![Actions Status](https://github.com/ameydev/ci-cd-standards-using-opa/workflows/Build./badge.svg?branch=master)](https://github.com/ameydev/ci-cd-standards-using-opa/actions) [![Actions Status](https://github.com/ameydev/ci-cd-standards-using-opa/workflows/Opa%20tests/badge.svg?branch=master)](https://github.com/ameydev/ci-cd-standards-using-opa/actions)\n\nA github-action to validate your infrastructure configuration manifests (eg. kubernetes resource yaml manifests) against the ci-cd standards using OpenPolicyAgent(OPA).\n\nThis action uses [`opa eval`](https://www.openpolicyagent.org/docs/latest/#2-try-opa-eval) command, to make sure that the specifications committed in any of the yaml manifests are not violating the standard policies.\n\n\n## Usage\n\n## Example workflow.\n\n```yaml\nname: Pre-deploy validation of k8s resources.\non: [push]\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n    - uses: actions/checkout@master\n    - name: OPA-Test ci-cd manifests standards.\n      uses: ameydev/ci-cd-standards-using-opa@master\n      env:\n        MANIFESTS_PATH_PATTERN: k8s/subpath/ #eg. directoy path or file path k8s/subpath/deploy.yaml\n        LIBRARY_PATH: opa-policies/ci-standards #path to your ci-cd policies.\n        DATA: data.kubernetes.admission.deny # the policy data \n```\n\n## Use opa command to execute opa unit tests\n\n```yaml\n    - name: OPA-Test ci-cd manifests standards.\n      uses: ameydev/ci-cd-standards-using-opa@master\n      env:\n        MANIFESTS_PATH_PATTERN: k8s/subpath/ #eg. directoy path or file path k8s/subpath/deploy.yaml\n        LIBRARY_PATH: opa-policies/ci-standards #path to your ci-cd policies.\n        DATA: data.kubernetes.admission.deny # the policy data \n      with:\n        args: opa test test-data/policies \n```\n\n\n## Write a CI-CD standard policy using Rego.\n\nYou can write any number of standard policies using [Rego language](https://www.openpolicyagent.org/docs/latest/policy-language/)\n\nExample of rego policy which will deny the containers in a pod, running as a root user.\nCheck more exampples of policies in [`test-data/`](https://github.com/ameydev/ci-cd-standards-using-opa/tree/master/test-data/policies).\n\n```\n  package kubernetes.admission\n\n  \u003c!-- Validate Deployment resources --\u003e\n  deny[msg] {\n    input.kind = \"Deployment\"\n    not input.spec.template.spec.securityContext.runAsNonRoot = true\n    msg = \"Deployment Standards: Containers must not run as root\"\n  }\n\n  \u003c!-- Validate Pod resources --\u003e\n  deny[msg] {\n    input.kind = \"Deployment\"\n    not input.spec.securityContext.runAsNonRoot = true\n    msg = \"Pod Standards: Containers must not run as root\"\n  }\n\n```\n\n\nTODO:\n- Terraform, Chef and Puppet support\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Finfracloudio%2Fci-cd-standards-using-opa","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Finfracloudio%2Fci-cd-standards-using-opa","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Finfracloudio%2Fci-cd-standards-using-opa/lists"}