Documentation
¶
Overview ¶
Package githubpolicy classifies GitHub activity (gh / git / curl / GitHub MCP / WebFetch) into canonical provider actions and binds the shared provider-policy sync machinery (internal/providerpolicy) to the GitHub snapshot contract.
The contract mirrors packages/shared/src/github/policy-snapshot.ts in the kontext cloud repository. For ENG-426 the directive is observe-only: the engine records what it *would* allow or deny, but never blocks.
Index ¶
Constants ¶
const ( SchemaVersionV2 = "github-policy-snapshot-v2" SchemaVersionV3 = "github-policy-snapshot-v3" )
Snapshot wire-format versions. v2 added the endpoint layer and most-specific-wins evaluation. v3 added the group layer (SCIM directory groups) and the endpointDirectory block carrying this endpoint's resolved directory identity.
The client requests v3 but accepts v2 for one release: a pre-v3 server ignores the negotiation query params and answers v2 (with group-layer rules filtered out server-side). Any other version is rejected (fail closed) rather than misread under the wrong semantics.
const ( ModeObserve = providerpolicy.ModeObserve ModeEnforce = providerpolicy.ModeEnforce LayerOrg = providerpolicy.LayerOrg LayerUser = providerpolicy.LayerUser LayerAgent = providerpolicy.LayerAgent LayerEndpoint = providerpolicy.LayerEndpoint LayerGroup = providerpolicy.LayerGroup EffectAllow = providerpolicy.EffectAllow EffectDeny = providerpolicy.EffectDeny ReasonCodeAllow = providerpolicy.ReasonCodeAllow ReasonCodeDeny = providerpolicy.ReasonCodeDeny DefaultRefreshInterval = providerpolicy.DefaultRefreshInterval )
Re-exported shared constants.
const SnapshotEndpoint = "/api/v1/policy/github/snapshot"
SnapshotEndpoint is the cloud path serving the GitHub policy snapshot. Tenancy is resolved from the install token.
Variables ¶
var Config = providerpolicy.Config{ ProviderKey: "github", SnapshotEndpoint: SnapshotEndpoint, RequestSchema: SchemaVersionV3, Schemas: []providerpolicy.SchemaSupport{ {Version: SchemaVersionV3, GroupLayer: true, Directory: true}, {Version: SchemaVersionV2}, }, CacheFileName: "github-policy-snapshot.json", CacheTempPattern: ".github-policy-*.tmp", RefreshEnvVar: "KONTEXT_GITHUB_POLICY_REFRESH_INTERVAL", }
Config binds the shared sync machinery to the GitHub snapshot contract.
Functions ¶
func DefaultCachePathForDB ¶
DefaultCachePathForDB stores the snapshot next to the guard database, the same convention managedstream uses for its cursor state.
func DefaultIntervalFromEnv ¶
Types ¶
type Cache ¶
type Cache = providerpolicy.Cache
Re-exported shared types: consumers of GitHub policy keep importing this package; the semantics live in providerpolicy and are shared verbatim with every other provider.
type EndpointDirectory ¶ added in v0.14.0
type EndpointDirectory = providerpolicy.EndpointDirectory
Re-exported shared types: consumers of GitHub policy keep importing this package; the semantics live in providerpolicy and are shared verbatim with every other provider.
type Evaluation ¶
type Evaluation = providerpolicy.Evaluation
Re-exported shared types: consumers of GitHub policy keep importing this package; the semantics live in providerpolicy and are shared verbatim with every other provider.
type GitContext ¶
GitContext carries repository context derived from the session working directory (current branch and configured remotes). It mirrors the toolInput.kontext.git enrichment the cloud classifier consumes.
func GitContextFromCWD ¶
func GitContextFromCWD(cwd string) GitContext
GitContextFromCWD derives the current branch and configured remotes from the session working directory. This stands in for the toolInput.kontext.git enrichment the cloud classifier receives.
type MatchedRule ¶
type MatchedRule = providerpolicy.MatchedRule
Re-exported shared types: consumers of GitHub policy keep importing this package; the semantics live in providerpolicy and are shared verbatim with every other provider.
type ProviderAction ¶
type ProviderAction struct {
// Action is the canonical action name, e.g. "github.pr.write".
Action string
// Resource is the repository slug "owner/repo" when derivable.
Resource string
// BranchOrRef is the branch or ref when derivable (push refspecs,
// fetch/pull positionals, current branch fallback).
BranchOrRef string
}
ProviderAction is one classified GitHub action extracted from a tool call.
func ClassifyProviderActions ¶
func ClassifyProviderActions(toolName string, toolInput map[string]any, gitContext func() GitContext) []ProviderAction
ClassifyProviderActions maps a tool invocation to canonical GitHub actions. gitContext is invoked lazily — only when a git command needs remote or branch resolution — because deriving it shells out to git.
func ClassifyProviderActionsWithCWD ¶
func ClassifyProviderActionsWithCWD(toolName string, toolInput map[string]any, cwd string, gitContext func(string) GitContext) []ProviderAction
ClassifyProviderActionsWithCWD maps a tool invocation to canonical GitHub actions, using cwd as the base for git -C context resolution.
type Request ¶
type Request = providerpolicy.Request
Re-exported shared types: consumers of GitHub policy keep importing this package; the semantics live in providerpolicy and are shared verbatim with every other provider.
type Rule ¶
type Rule = providerpolicy.Rule
Re-exported shared types: consumers of GitHub policy keep importing this package; the semantics live in providerpolicy and are shared verbatim with every other provider.
type Snapshot ¶
type Snapshot = providerpolicy.Snapshot
Re-exported shared types: consumers of GitHub policy keep importing this package; the semantics live in providerpolicy and are shared verbatim with every other provider.
type SnapshotProvider ¶
type SnapshotProvider = providerpolicy.SnapshotProvider
Re-exported shared types: consumers of GitHub policy keep importing this package; the semantics live in providerpolicy and are shared verbatim with every other provider.
type Status ¶
type Status = providerpolicy.Status
Re-exported shared types: consumers of GitHub policy keep importing this package; the semantics live in providerpolicy and are shared verbatim with every other provider.
Source Files