Documentation
¶
Overview ¶
Package planfile binds policy evaluation to saved Terraform artifacts. It does not collect CI facts, execute hooks or coordinate other runs. Its caller can supply approval verification through ResolveApprovals.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Guard ¶
type Guard struct {
ResolveApprovals func(context.Context, *policy.Request, policy.Decision) (policy.Decision, error)
Subject *policy.Subject
Engine *policy.Engine
Rules []policy.Rule
Show process.Runner
CI *policy.CISnapshot
}
Guard evaluates rules using the configured pure engine. Show uses an isolated process runner so raw JSON never passes through terminal masking or CI capture.
func (*Guard) Execute ¶
func (g *Guard) Execute(ctx context.Context, invocation *Invocation, run func([]string) process.Result) (process.Result, error)
Execute runs one governed plan/apply. The callback preserves the existing command executor's streams/retries. A separate gate error must NEVER be remapped as a Terraform exit code or treated as best-effort reporting.
Source Files
Click to show internal directories.
Click to hide internal directories.