mirror of
https://github.com/tailscale/tailscale.git
synced 2026-07-14 17:43:03 -04:00
5bd52667fb
Add a .policy-tests.yml file with tests exercising the policy that was just landed: the tailcfg/ control-protocol-owners gate, the "policybot-override:" comment escape hatch (including defaults-regression guards so the override rule does not silently accept a normal review or a 👍 comment), and the always-on "any tailscale/dev review" baseline. Updates tailscale/corp#13972 Change-Id: I42afb06b0771658c803512cb5de4701450c8a704 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
259 lines
7.4 KiB
YAML
259 lines
7.4 KiB
YAML
# Tests for testdata/tailscale.com.policy.yml.
|
|
#
|
|
# Run from the parent directory with:
|
|
# go run . -policy testdata/tailscale.com.policy.yml \
|
|
# -tests testdata/tailscale.com.policy-test.yml
|
|
|
|
teams:
|
|
# Members are picked solely so tests below can refer to them.
|
|
# `alice` and `bob` are control-protocol-owners *and* dev. `carol`,
|
|
# `dave`, and `eve` are dev only. `outsider` is in nothing.
|
|
tailscale/control-protocol-owners:
|
|
- alice
|
|
- bob
|
|
tailscale/dev:
|
|
- alice
|
|
- bob
|
|
- carol
|
|
- dave
|
|
- eve
|
|
|
|
tests:
|
|
# ------------------------------------------------------------------
|
|
# Baseline: every PR (touching tailcfg/ or not) requires a +1 from a
|
|
# tailscale/dev member.
|
|
# ------------------------------------------------------------------
|
|
|
|
- name: non-tailcfg PR with no review is pending
|
|
pull_request:
|
|
author: carol
|
|
changed_files:
|
|
- README.md
|
|
- cmd/tailscale/main.go
|
|
expect:
|
|
status: pending
|
|
rules:
|
|
"tailcfg changes approved by control-protocol-owners": skipped
|
|
"tailcfg changes overridden by another tailscale/dev": skipped
|
|
"any tailscale/dev review": pending
|
|
|
|
- name: non-tailcfg PR with dev review is approved
|
|
pull_request:
|
|
author: carol
|
|
changed_files:
|
|
- README.md
|
|
reviews:
|
|
- user: dave
|
|
state: approved
|
|
expect:
|
|
status: approved
|
|
rules:
|
|
"any tailscale/dev review": approved
|
|
|
|
- name: non-tailcfg PR with thumbs-up comment from dev is approved
|
|
pull_request:
|
|
author: carol
|
|
changed_files:
|
|
- README.md
|
|
comments:
|
|
- user: dave
|
|
body: ":+1:"
|
|
expect:
|
|
status: approved
|
|
rules:
|
|
"any tailscale/dev review": approved
|
|
|
|
- name: non-tailcfg PR with non-dev review is pending
|
|
pull_request:
|
|
author: carol
|
|
changed_files:
|
|
- README.md
|
|
reviews:
|
|
- user: outsider
|
|
state: approved
|
|
expect:
|
|
status: pending
|
|
rules:
|
|
"any tailscale/dev review": pending
|
|
|
|
- name: PR with no files at all is pending without a dev review
|
|
pull_request:
|
|
author: carol
|
|
changed_files: []
|
|
expect:
|
|
status: pending
|
|
rules:
|
|
"any tailscale/dev review": pending
|
|
|
|
# ------------------------------------------------------------------
|
|
# tailcfg/ requires BOTH a control-protocol-owners review (or an
|
|
# override comment) AND a dev +1. Owners are in tailscale/dev too,
|
|
# so their single review satisfies both gates.
|
|
# ------------------------------------------------------------------
|
|
|
|
- name: tailcfg change without anything is pending
|
|
pull_request:
|
|
author: carol
|
|
changed_files:
|
|
- tailcfg/tailcfg.go
|
|
expect:
|
|
status: pending
|
|
rules:
|
|
"tailcfg changes approved by control-protocol-owners": pending
|
|
"tailcfg changes overridden by another tailscale/dev": pending
|
|
"any tailscale/dev review": pending
|
|
|
|
- name: a single owner review approves both the owner rule and the dev rule
|
|
pull_request:
|
|
author: carol
|
|
changed_files:
|
|
- tailcfg/tailcfg.go
|
|
reviews:
|
|
- user: alice
|
|
state: approved
|
|
expect:
|
|
status: approved
|
|
rules:
|
|
"tailcfg changes approved by control-protocol-owners": approved
|
|
"any tailscale/dev review": approved
|
|
|
|
- name: owner cannot self-approve their own tailcfg PR
|
|
pull_request:
|
|
author: alice
|
|
changed_files:
|
|
- tailcfg/tailcfg.go
|
|
reviews:
|
|
- user: alice
|
|
state: approved
|
|
expect:
|
|
status: pending
|
|
|
|
- name: non-owner dev review alone leaves the tailcfg gate pending
|
|
pull_request:
|
|
author: alice
|
|
changed_files:
|
|
- tailcfg/tailcfg.go
|
|
reviews:
|
|
- user: carol
|
|
state: approved
|
|
expect:
|
|
status: pending
|
|
rules:
|
|
"tailcfg changes approved by control-protocol-owners": pending
|
|
"tailcfg changes overridden by another tailscale/dev": pending
|
|
"any tailscale/dev review": approved
|
|
|
|
# ------------------------------------------------------------------
|
|
# policybot-override flow on a tailcfg/ PR.
|
|
# ------------------------------------------------------------------
|
|
|
|
# An override comment by itself only satisfies the override rule.
|
|
# The baseline dev-review rule still needs a separate +1.
|
|
- name: override comment alone leaves baseline dev review pending
|
|
pull_request:
|
|
author: carol
|
|
changed_files:
|
|
- tailcfg/tailcfg.go
|
|
comments:
|
|
- user: dave
|
|
body: "policybot-override: emergency rollback"
|
|
expect:
|
|
status: pending
|
|
rules:
|
|
"tailcfg changes overridden by another tailscale/dev": approved
|
|
"any tailscale/dev review": pending
|
|
|
|
- name: override comment plus a separate dev review approves
|
|
pull_request:
|
|
author: carol
|
|
changed_files:
|
|
- tailcfg/tailcfg.go
|
|
comments:
|
|
- user: dave
|
|
body: "policybot-override: emergency rollback"
|
|
reviews:
|
|
- user: eve
|
|
state: approved
|
|
expect:
|
|
status: approved
|
|
|
|
# One dev doing BOTH (post the override AND a regular +1) works too.
|
|
- name: same dev posts both the override and a +1 review
|
|
pull_request:
|
|
author: carol
|
|
changed_files:
|
|
- tailcfg/tailcfg.go
|
|
comments:
|
|
- user: dave
|
|
body: "policybot-override: shipping a typo fix"
|
|
reviews:
|
|
- user: dave
|
|
state: approved
|
|
expect:
|
|
status: approved
|
|
|
|
- name: override comment from the author does not approve the override
|
|
pull_request:
|
|
author: carol
|
|
changed_files:
|
|
- tailcfg/tailcfg.go
|
|
comments:
|
|
- user: carol
|
|
body: "policybot-override: please let me ship this"
|
|
expect:
|
|
status: pending
|
|
rules:
|
|
"tailcfg changes overridden by another tailscale/dev": pending
|
|
|
|
- name: override comment from a non-dev does not approve the override
|
|
pull_request:
|
|
author: carol
|
|
changed_files:
|
|
- tailcfg/tailcfg.go
|
|
comments:
|
|
- user: outsider
|
|
body: "policybot-override: I am not on the dev team"
|
|
expect:
|
|
rules:
|
|
"tailcfg changes overridden by another tailscale/dev": pending
|
|
|
|
- name: empty-reason policybot-override does not approve
|
|
pull_request:
|
|
author: carol
|
|
changed_files:
|
|
- tailcfg/tailcfg.go
|
|
comments:
|
|
- user: dave
|
|
body: "policybot-override:"
|
|
expect:
|
|
rules:
|
|
"tailcfg changes overridden by another tailscale/dev": pending
|
|
|
|
# Defaults regression guards: a normal review approval from a dev
|
|
# member must NOT silently approve the override rule. Same for a
|
|
# plain :+1: comment. Without the explicit `methods: github_review:
|
|
# false` / `comments: []` on the override rule, both would.
|
|
- name: a regular dev review does not silently satisfy the override rule
|
|
pull_request:
|
|
author: carol
|
|
changed_files:
|
|
- tailcfg/tailcfg.go
|
|
reviews:
|
|
- user: dave
|
|
state: approved
|
|
expect:
|
|
rules:
|
|
"tailcfg changes overridden by another tailscale/dev": pending
|
|
|
|
- name: a thumbs-up comment from a dev does not silently satisfy the override rule
|
|
pull_request:
|
|
author: carol
|
|
changed_files:
|
|
- tailcfg/tailcfg.go
|
|
comments:
|
|
- user: dave
|
|
body: ":+1:"
|
|
expect:
|
|
rules:
|
|
"tailcfg changes overridden by another tailscale/dev": pending
|