master
730354a1af
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
- Added `SchedulerWorkerOptions` class to encapsulate configuration for the scheduler worker. - Introduced `PlannerBackgroundService` to manage the planner loop, fetching and processing planning runs. - Created `PlannerExecutionService` to handle the execution logic for planning runs, including impact targeting and run persistence. - Developed `PlannerExecutionResult` and `PlannerExecutionStatus` to standardize execution outcomes. - Implemented validation logic within `SchedulerWorkerOptions` to ensure proper configuration. - Added documentation for the planner loop and impact targeting features. - Established health check endpoints and authentication mechanisms for the Signals service. - Created unit tests for the Signals API to ensure proper functionality and response handling. - Configured options for authority integration and fallback authentication methods.
42 lines
942 B
YAML
42 lines
942 B
YAML
version: "1.0"
|
|
metadata:
|
|
description: Strict policy for serverless workloads
|
|
tags:
|
|
- serverless
|
|
- prod
|
|
- strict
|
|
exceptions:
|
|
effects:
|
|
- id: suppress-canary
|
|
name: Canary Freeze
|
|
effect: suppress
|
|
routingTemplate: secops-approvers
|
|
maxDurationDays: 14
|
|
routingTemplates:
|
|
- id: secops-approvers
|
|
authorityRouteId: governance.secops
|
|
requireMfa: true
|
|
rules:
|
|
- name: Block High And Above
|
|
severity: [High, Critical]
|
|
action: block
|
|
|
|
- name: Forbid Unpinned Base Images
|
|
tags: [image:latest-tag]
|
|
action: block
|
|
|
|
- name: Require Trusted VEX
|
|
action:
|
|
type: require_vex
|
|
requireVex:
|
|
vendors: [VendorX, VendorY]
|
|
justifications: [component_not_present]
|
|
|
|
- name: Quiet Medium Canary
|
|
severity: [Medium]
|
|
environments: [canary]
|
|
action:
|
|
type: ignore
|
|
until: 2025-12-31T00:00:00Z
|
|
justification: "Temporary canary exception"
|