Skip to content

Add go-service policy to the registry #132

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ShubhaKC123 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add go-service policy to the registry #132

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/site/policy-registry.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ That writes `.signetry/admission.yaml` and prints the scope you just adopted.
|---|---|---|
| `docs-only` | any repo | Markdown, text and images. No code, no config, no CI. |
| `dependency-bump` | any repo | Manifests and lockfiles only. The narrowest useful policy. |
| `go-service` | Go service | `cmd/`, `internal/` and `pkg/`; keeps `go build`, `go vet` and `go test` green. |
| `python-library` | src-layout Python | Library code, tests, `pyproject.toml`. Keeps pytest green. |
| `node-service` | Node / TypeScript | App code and tests. Not the build or release path. |
| `monorepo-service` | monorepos | One service directory; siblings and shared packages excluded. |
Expand Down
51 changes: 51 additions & 0 deletions signetry_core/policies/go-service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
# @policy id: go-service
# @policy title: Go service (cmd/internal layout, go test)
# @policy summary: A Go service laid out as cmd/ and internal/. The agent may change handlers,
# business logic and tests, and must keep `go test ./...` and `go vet ./...` green. Generated
# code, migrations, the container image and CI stay off-limits.
# @policy caution: go.mod changes can add or upgrade dependencies whose code is built and tested;
# go.sum records their integrity checksums but does not choose dependency versions. Review
# dependency changes carefully and run the required checks only in a trusted, isolated environment.
# @policy stack: go, go-modules, gotest
# @policy author: signetry-registry
# @policy blocks: internal/db/migrations/0007_add_index.sql, internal/api/api.gen.go, Dockerfile, .github/workflows/release.yml
# @policy allows: cmd/server/main.go, internal/handler/checkout.go, internal/handler/checkout_test.go, go.mod
version: 2
task_type: feature-work

allowed_paths:
- "cmd/**"
- "internal/**"
- "pkg/**"
- "go.mod"
# go.sum contains integrity hashes, not version selection; go.mod controls the module graph.
- "go.sum"
- "README.md"
- "CHANGELOG.md"

forbidden_paths:
# Generated outputs are overwritten by their generators and should be changed at source.
- "**/*.gen.go"
- "**/*.pb.go"
- "**/zz_generated*.go"
# Migrations alter persistent schemas and can require coordinated rollout or rollback.
- "internal/db/migrations/**"
- "**/migrations/**"
# Workflow changes can alter CI permissions, access to secrets, and release behavior.
- ".github/**"
# Container definitions determine the image and commands deployed to production.
- "Dockerfile*"
# Deployment manifests configure live services and infrastructure.
- "deploy/**"
# Environment files and secret-named files can contain credentials or sensitive values.
- "**/.env*"
- "**/*secret*"

max_files_changed: 15
required_checks:
- "go build ./..."
- "go vet ./..."
- "go test ./..."

policy_owner: your-team
policy_version: "1.0"
Loading