support for apply policies (#2538)

* support for apply policies

Author: motatoes

backend/models/policies.go

@@ -6,6 +6,7 @@ const (
 	POLICY_TYPE_ACCESS = "access"
 	POLICY_TYPE_PLAN   = "plan"
 	POLICY_TYPE_DRIFT  = "drift"
+	POLICY_TYPE_APPLY  = "apply"
 )
 
 type Policy struct {

cli/pkg/digger/digger.go

@@ -105,7 +105,7 @@ func RunJobs(jobs []orchestrator.Job, prService ci.PullRequestService, orgServic
 
 			if !allowedToPerformCommand {
 				msg := reportPolicyError(job.ProjectName, command, job.RequestedBy, reporter)
-				slog.Warn("Skipping command ... %v for project %v", command, job.ProjectName)
+				slog.Warn("Skipping command ...", "command", command, "projectName", job.ProjectName)
 				slog.Warn("Received policy error", "message", msg)
 				appliesPerProject[job.ProjectName] = false
 				continue
@@ -429,6 +429,71 @@ func run(command string, job orchestrator.Job, policyChecker policy.Checker, org
 				return nil, msg, errors.New(msg)
 			}
 
+			// Check apply policy before apply
+			// Try to retrieve the terraform plan JSON if plan storage is configured
+			var terraformPlanJson string
+			if os.Getenv("PLAN_UPLOAD_DESTINATION") != "" {
+				slog.Debug("Plan storage configured, attempting to retrieve plan for apply policy check")
+				retrievedPlanJson, err := executor.RetrievePlanJson()
+				if err != nil {
+					slog.Warn("Failed to retrieve plan JSON for apply policy check, proceeding without plan data", "error", err)
+				} else {
+					terraformPlanJson = retrievedPlanJson
+					slog.Debug("Successfully retrieved plan JSON for apply policy check", "planLength", len(terraformPlanJson))
+				}
+			} else {
+				slog.Debug("Plan storage not configured, apply policy will not have terraform plan data")
+			}
+
+			slog.Debug("Calling CheckApplyPolicy",
+				"organisation", SCMOrganisation,
+				"repository", SCMrepository,
+				"projectName", job.ProjectName,
+				"projectDir", job.ProjectDir,
+				"command", command,
+				"requestedBy", requestedBy,
+				"hasTerraformPlan", terraformPlanJson != "")
+			allowedToApplyByApplyPolicy, applyPolicyViolations, err := policyChecker.CheckApplyPolicy(SCMOrganisation, SCMrepository, job.ProjectName, job.ProjectDir, command, job.PullRequestNumber, requestedBy, teams, approvals, approvalTeams, planPolicyViolations, terraformPlanJson)
+			slog.Debug("CheckApplyPolicy result",
+				"allowed", allowedToApplyByApplyPolicy,
+				"violationsCount", len(applyPolicyViolations),
+				"violations", applyPolicyViolations,
+				"error", err)
+			if err != nil {
+				msg := fmt.Sprintf("Failed to run apply policy check before apply. %v", err)
+				slog.Error("Failed to run apply policy check before apply", "error", err)
+				return nil, msg, fmt.Errorf("%s", msg)
+			}
+			if !allowedToApplyByApplyPolicy {
+				slog.Info("Apply policy check denied",
+					"violationsCount", len(applyPolicyViolations),
+					"violations", applyPolicyViolations)
+				var applyPolicyFormatter func(report string) string
+				summary := fmt.Sprintf("Policy violation for <b>%v - %v</b>", job.ProjectName, command)
+				if reporter.SupportsMarkdown() {
+					applyPolicyFormatter = reporting.AsCollapsibleComment(summary, false)
+				} else {
+					applyPolicyFormatter = reporting.AsComment(summary)
+				}
+
+				applyPolicyReportMessage := "Terraform apply failed validation checks :x:<br>"
+				if len(applyPolicyViolations) > 0 {
+					preformattedMessages := make([]string, 0)
+					for _, message := range applyPolicyViolations {
+						preformattedMessages = append(preformattedMessages, fmt.Sprintf("    %v", message))
+					}
+					applyPolicyReportMessage = applyPolicyReportMessage + strings.Join(preformattedMessages, "<br>")
+				}
+				_, _, err = reporter.Report(applyPolicyReportMessage, applyPolicyFormatter)
+				if err != nil {
+					slog.Error("Failed to report apply policy violation.", "error", err)
+				}
+
+				msg := fmt.Sprintf("Apply is not allowed due to policy violations")
+				slog.Error(msg)
+				return nil, msg, errors.New(msg)
+			}
+
 			// Running apply
 
 			applySummary, applyPerformed, output, err := diggerExecutor.Apply()

ee/cli/pkg/policy/policy.go

@@ -3,6 +3,7 @@ package policy
 import (
 	"github.com/diggerhq/digger/libs/git_utils"
 	"github.com/samber/lo"
+	"log/slog"
 	"os"
 	"path"
 	"path/filepath"
@@ -115,6 +116,25 @@ func (p DiggerRepoPolicyProvider) GetPlanPolicy(organisation string, repository
 	return policy, nil
 }
 
+func (p DiggerRepoPolicyProvider) GetApplyPolicy(organisation string, repository string, projectname string, projectDir string) (string, error) {
+	slog.Debug("GetApplyPolicy called",
+		"organisation", organisation,
+		"repository", repository,
+		"projectname", projectname,
+		"projectDir", projectDir,
+		"managementRepoUrl", p.ManagementRepoUrl)
+	policy, err := p.getPolicyFileContents(repository, projectname, projectDir, "apply.rego")
+	if err != nil {
+		slog.Error("Error getting apply policy file", "error", err)
+		return policy, err
+	}
+	slog.Debug("GetApplyPolicy result",
+		"policyLength", len(policy),
+		"policyEmpty", policy == "",
+		"policyContent", policy)
+	return policy, nil
+}
+
 func (p DiggerRepoPolicyProvider) GetDriftPolicy() (string, error) {
 	return "", nil
 

libs/policy/core.go

@@ -4,6 +4,7 @@ type Provider interface {
 	GetAccessPolicy(organisation string, repository string, projectname string, projectDir string) (string, error)
 	GetPlanPolicy(organisation string, repository string, projectname string, projectDir string) (string, error)
 	GetDriftPolicy() (string, error)
+	GetApplyPolicy(organisation string, repository string, projectname string, projectDir string) (string, error)
 	GetOrganisation() string // TODO: remove this method from here since out of place
 }
 
@@ -12,6 +13,7 @@ type Checker interface {
 	CheckAccessPolicy(SCMOrganisation string, SCMrepository string, projectName string, projectDir string, command string, prNumber *int, requestedBy string, teams []string, approvals []string, approvalTeams []string, planPolicyViolations []string) (bool, error)
 	CheckPlanPolicy(SCMrepository string, SCMOrganisation string, projectname string, projectDir string, requestedBy string, teams []string, approvals []string, approvalTeams []string, planOutput string) (bool, []string, error)
 	CheckDriftPolicy(SCMOrganisation string, SCMrepository string, projectname string) (bool, error)
+	CheckApplyPolicy(SCMOrganisation string, SCMrepository string, projectName string, projectDir string, command string, prNumber *int, requestedBy string, teams []string, approvals []string, approvalTeams []string, planPolicyViolations []string, planOutput string) (bool, []string, error)
 }
 
 type PolicyCheckerProvider interface {

libs/policy/mocks.go

@@ -14,3 +14,7 @@ func (t MockPolicyChecker) CheckPlanPolicy(SCMrepository string, SCMOrganisation
 func (t MockPolicyChecker) CheckDriftPolicy(SCMOrganisation string, SCMrepository string, projectname string) (bool, error) {
 	return true, nil
 }
+
+func (t MockPolicyChecker) CheckApplyPolicy(SCMOrganisation string, SCMrepository string, projectName string, projectDir string, command string, prNumber *int, requestedBy string, teams []string, approvals []string, approvalTeams []string, planPolicyViolations []string, planOutput string) (bool, []string, error) {
+	return true, nil, nil
+}