Documentation
¶
Overview ¶
Package expr evaluates the `${{ ... }}` expressions in a Passage's steps.
Built on expr-lang: sandboxed, no I/O, no arbitrary code. Deliberately not Go templates — a promotion step evaluating arbitrary templates over cluster data is an escalation path, and the expressions here are evaluated on data an attacker can influence (image tags, commit messages, PR titles).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Bool ¶
Bool evaluates a condition, for `step.if`.
A non-boolean result is an error rather than a truthiness guess: `if: "1"` is a mistake, and silently treating it as true would run a step the author meant to gate.
func Condition ¶
Condition evaluates a boolean expression over an arbitrary environment.
For the one case a step cannot express through Env: a condition about something that only exists after the step ran, like an HTTP response. The sandbox choice lives here so a step cannot accidentally widen it.
func Interpolate ¶
Interpolate substitutes every `${{ ... }}` in s.
When the whole string is a single expression the typed value is returned; otherwise the results are stringified into the surrounding text. That distinction matters because step configuration is JSON: turning `${{ vars.replicas }}` into the string "3" would break a numeric field, while `"v${{ vars.major }}"` clearly wants text.
func InterpolateJSON ¶
func InterpolateJSON(raw json.RawMessage, env Env) (json.RawMessage, error)
InterpolateJSON walks a JSON document and interpolates every string leaf.
Applied by the engine to a step's `with:` block, so interpolation is universal rather than something each step remembers to do — and so a step added later cannot forget it.
Types ¶
type Env ¶
type Env struct {
Bundle *v1alpha1.Bundle
// Steps maps a step's `as:` alias to its output.
Steps map[string]map[string]any
// Vars are the Gate's declared variables.
Vars map[string]string
// Failed reports that an earlier step has already failed the Passage.
//
// It exists so a step can say `if: ${{ failed }}` and run precisely when
// something went wrong — reporting the outcome, recording evidence, tidying
// up. Without it the only steps that can ever run are the ones on the happy
// path, and anything that reports a result could only ever report success.
Failed bool
// Context about the crossing itself.
Gate string
Passage string
Actor string
Namespace string
}
Env is what expressions can see. Nothing else is reachable — no cluster, no filesystem, no environment variables.
Source Files