1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

# Bitbucket Pipelines workflow for iac-policies ================================

# Pipeline definitions ---------------------------------------------------------

definitions:
  steps:
    - step: &run-diagnostics
        name: Run diagnostics
        runs-on:
          - self.hosted
          - linux.shell
          - acme.linux.prod
        script:
          - python3.12 pipeline.py run-diagnostics

    - step: &run-scan
        name: Run security scan
        runs-on:
          - self.hosted
          - linux.shell
          - acme.linux.prod
        script:
          - python3.12 pipeline.py run-scan

    - step: &validate-policies
        name: Validate policies and catalog
        runs-on:
          - self.hosted
          - linux.shell
          - acme.linux.prod
        script:
          - python3.12 pipeline.py validate-policies

    - step: &publish-policies
        name: Publish policies to Artifactory
        runs-on:
          - self.hosted
          - linux.shell
          - acme.linux.prod
        script:
          - python3.12 pipeline.py publish-policies

# Pipeline Triggers ------------------------------------------------------------

pipelines:
  # PR — security scan and validate
  pull-requests:
    "**":
      - step: *run-scan
      - step: *validate-policies

  # Main — publish on merge
  branches:
    main:
      - step: *publish-policies

  # On-demand
  custom:
    run-scan:
      - step: *run-scan
    run-diagnostics:
      - step: *run-diagnostics