ada/agentguard-ci
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

plan files

Browse Source
This commit is contained in:
Elizabeth W
2026-04-19 22:12:00 -06:00
parent 89b3586030
commit 963e020efa
14 changed files with 238 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/plans/phase2-step6-crossguard.md
+18
View File
@@ -0,0 +1,18 @@
# Implementation Plan: Pulumi Crossguard
## Objective
Implement the Pulumi Crossguard policy enforcement step as a parallel task in the DAG.
## Requirements
- Define a task template named `scan-crossguard`.
- Depend on the `clone-repo` task.
- Mount the shared PVC at `/workspace`.
- Expect Pulumi credentials and cloud provider credentials (e.g., AWS/GCP) to be injected via Infisical as environment variables (using the initContainer logic).
- Run `pulumi preview --policy-pack <path>` inside the `/workspace`.
- Capture the output and convert/save it into a structured JSON/SARIF format at `/workspace/reports/crossguard.json`.
- Ensure the task exits successfully (`|| true`) to allow Phase 3 aggregation.
## Agent Instructions
1. Add the `scan-crossguard` template to the `ClusterWorkflowTemplate`.
2. Configure the Infisical initContainer to wait for Pulumi and Cloud credentials.
3. Wire it into the DAG alongside the other scanners.