Merge pull request #12 from NDDev-OpenNetwork/fix/ruleset-initial-creation

fix(governance): plan initial ruleset creation

Author: rldyourmnd

.gds/bundle.lock.yaml

@@ -5,14 +5,14 @@ bundle:
   version: "0.4.0-dev"
   release_sequence: 0
   channel: "development"
-  source_tree_digest: "sha256:ef10b91ed03c562d05495a6375f444879ca08017eb7bab4f40fe2a6fc3bc3e86"
-  digest: "sha256:8d5aa5c36a0e59ea9c64408423934224bdf3880ed0a861585dbc6e5f30d31306"
+  source_tree_digest: "sha256:a236bcc5c7527d3a0a3c6230e20ebe9c48796c0a5d41392b47a22da934ff49fa"
+  digest: "sha256:977eaefa91e2e04f211495101ffde77fcb56aaff13972acf63d9a276d25fd97d"
 
 projection:
-  input_digest: "sha256:47efcfb0b381f7398a08a5a176d7ca63a671fcf53045bb5e09e70f943becbc9f"
-  output_digest: "sha256:a2c3f18837f79a45a19ea7aafa3f3100d2d63ad6eaa6deed156f0f7b2092563f"
+  input_digest: "sha256:7b88ac05c2c898a1ac7e96d88846fe99b719ba2312751a661b1b02eaf0eadbbd"
+  output_digest: "sha256:498a0c7407167e63ce51f8e853b1f91b66e4ac9acba5484892c44efb2aab61fb"
   files:
     - path: ".gds/compiled-policy.json"
       digest: "sha256:78d09606bb4168d74bce1f50ab62b46a7ded34652c6b23af1badfd26dd060e94"
     - path: ".github/workflows/gds-ci.yml"
-      digest: "sha256:0929cc3bbed80e0c315703ee2860439cbc3ceeeefbe78e6376dda7393fb883b7"
+      digest: "sha256:8f198d373f786d2d2c88e1910851c1039c6200359ee95cca11af0ab3cb5d326c"

.github/workflows/gds-ci.yml

@@ -1,8 +1,8 @@
 # GENERATED FILE - DO NOT EDIT DIRECTLY
 # generator: gds
 # bundle: 0.4.0-dev
-# source-tree-digest: sha256:ef10b91ed03c562d05495a6375f444879ca08017eb7bab4f40fe2a6fc3bc3e86
-# input-digest: sha256:47efcfb0b381f7398a08a5a176d7ca63a671fcf53045bb5e09e70f943becbc9f
+# source-tree-digest: sha256:a236bcc5c7527d3a0a3c6230e20ebe9c48796c0a5d41392b47a22da934ff49fa
+# input-digest: sha256:7b88ac05c2c898a1ac7e96d88846fe99b719ba2312751a661b1b02eaf0eadbbd
 # output-digest: sha256:8f61a9ffd6949238099d4523a037d57199eb575f187cc8ac52baa4b5b832e79f
 # edit-source:
 #   - .gds/repository.yaml

core/app/github_ruleset_external_test.go

@@ -83,6 +83,18 @@ func TestDesiredRulesetCarriesDeclaredExternalContexts(t *testing.T) {
 	}
 }
 
+func TestMissingRulesetPlansCreationWithoutInventingObservedIdentity(t *testing.T) {
+	t.Parallel()
+	if expected := rulesetPlanExpected(githubRulesetOperationContext{exists: false}); expected != nil {
+		t.Fatalf("missing ruleset produced observed precondition: %#v", expected)
+	}
+	observed := githubprovider.RepositoryRulesetState{ID: 9, Name: "Protect main", SourceType: "Repository", Source: "example/repository"}
+	expected := rulesetPlanExpected(githubRulesetOperationContext{exists: true, observed: observed})
+	if expected == nil || expected.ID != 9 {
+		t.Fatalf("existing ruleset lost observed identity: %#v", expected)
+	}
+}
+
 func TestDesiredRulesetIsUnchangedWithoutADeclaration(t *testing.T) {
 	root := t.TempDir()
 	writeRuleset(t, root, []string{"CI / build"}, "")

core/app/github_ruleset_operations.go

@@ -84,7 +84,7 @@ func (services *Services) PlanGitHubRuleset(
 	}
 	// Apply compares the stored expectation against the visible form of what it
 	// re-observes, so the plan must record exactly that form.
-	observed := githubruleset.VisibleState(current.observed)
+	expected := rulesetPlanExpected(current)
 	plan, err := operations.NewPlan(planID, now, now.Add(projectionPlanLifetime), operations.PlanInput{
 		Operation: githubRulesetOperation,
 		Actor:     operations.Actor{Type: "agent-session", SessionID: options.SessionID},
@@ -112,7 +112,7 @@ func (services *Services) PlanGitHubRuleset(
 					ProviderRepositoryID: current.providerRepositoryID,
 					Owner:                options.Owner, Name: options.Repository,
 				},
-				Expected: &observed,
+				Expected: expected,
 				Desired:  current.desired,
 			}),
 		}},
@@ -135,6 +135,14 @@ func (services *Services) PlanGitHubRuleset(
 	return result
 }
 
+func rulesetPlanExpected(current githubRulesetOperationContext) *githubprovider.RepositoryRulesetState {
+	if !current.exists {
+		return nil
+	}
+	observed := githubruleset.VisibleState(current.observed)
+	return &observed
+}
+
 // ApplyGitHubRuleset applies one approved ruleset plan through the bound
 // mutation capability.
 func (services *Services) ApplyGitHubRuleset(
@@ -272,6 +280,7 @@ type githubRulesetOperationContext struct {
 	observed             githubprovider.RepositoryRulesetState
 	visible              githubprovider.RepositoryRulesetState
 	desired              githubprovider.RepositoryRuleset
+	exists               bool
 	inSync               bool
 	providerRepositoryID int64
 	mutationCapabilityID string
@@ -353,13 +362,12 @@ func (services *Services) githubRulesetContext(
 		}
 	}
 	if rulesetID == 0 {
-		failure := domain.NewEnvelope(command, domain.ExitNotProven, nil, domain.Finding{
-			Code: "GDS_GITHUB_RULESET_NOT_ADOPTED", Severity: domain.SeverityHigh,
-			Message: fmt.Sprintf(
-				"No repository ruleset named %q exists; adopt it before reconciling.", desired.Name,
-			),
-		})
-		return githubRulesetOperationContext{}, &failure
+		return githubRulesetOperationContext{
+			governance: governanceContext, privileged: privileged,
+			desired: desired, exists: false, inSync: false,
+			providerRepositoryID: providerRepositoryID,
+			mutationCapabilityID: capability.Mutation.ID,
+		}, nil
 	}
 	observed, _, err := privileged.GetRepositoryRuleset(ctx, rulesetID)
 	if err != nil {
@@ -371,6 +379,7 @@ func (services *Services) githubRulesetContext(
 	return githubRulesetOperationContext{
 		governance: governanceContext, privileged: privileged,
 		observed: observed, visible: visible, desired: desired,
+		exists:               true,
 		inSync:               rulesetOwnedStateMatches(observed, desired),
 		providerRepositoryID: providerRepositoryID,
 		mutationCapabilityID: capability.Mutation.ID,