StackGuardian / StackGuardian/tirith
research(platform): approvals when using Tirith
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 165
- Forks
- 42
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 11
Description
A policy failure that should pause for a human rather than hard-fail. Today's honest answer is
downgrade-to-warn, because blocking would leave the platform workflow stuck. Two candidate shapes,
both unproven: (1) lean on each CI system's own approval gates (GitHub environments/required
reviewers, GitLab manual jobs) with Tirith exiting the right code and a documented recipe per
platform; (2) sync run status through a GitHub App so an approval on the platform side updates the
PR check. Decide the shape before building; this intersects plan attestation — an approval is only
meaningful if the applied plan is provably the approved one.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing GitHub environments and required reviewers with GitLab manual jobs, then examine the alternative GitHub App status-sync shape. Resolve how plan attestation proves that the applied plan is the approved one. Done means one approval design is selected, its workflow and failure behavior are documented, and the downgrade-to-warn ambiguity is settled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github, gitlab, terraform
- Domain
- ci-cd, devops, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100