effects

Documentation

Overview

Package effects performs the effect an allowed action names, with credentials the hands never see. This is the mediation the standard asks for (C7.1.4a): the credentials and the transport for the effect are held inside the attesting environment, which emits the request itself.

Index

• Variables
• type Adapter
• type GitHub
  • func (g GitHub) Kinds() []string
  • func (g GitHub) Perform(ctx context.Context, a policy.Action) Outcome
• type Outcome
• type Registry
  • func (r Registry) Add(a Adapter)

Variables

var ErrNoAdapter = errors.New("no effect adapter for this kind")

ErrNoAdapter: an allowed action nobody can perform is not performed.

Types

type Adapter

type Adapter interface {
	Kinds() []string
	Perform(ctx context.Context, a policy.Action) Outcome
}

Adapter performs one kind of effect.

type GitHub

type GitHub struct {
	SecretsDir string
	Client     *http.Client
	Base       string // https://api.github.com
}

GitHub performs workflow.dispatch and pull.open on owner/repo resources with a token per owner read from the secrets directory as github-token-<owner>.

func (GitHub) Kinds

func (g GitHub) Kinds() []string

func (GitHub) Perform

func (g GitHub) Perform(ctx context.Context, a policy.Action) Outcome

type Outcome

type Outcome struct {
	OK     bool           `json:"ok"`
	Detail map[string]any `json:"detail,omitempty"`
	Error  string         `json:"error,omitempty"`
}

Outcome of an effect: what the tool answered, never a secret.

type Registry

type Registry map[string]Adapter

Registry of adapters by kind.

func (Registry) Add

func (r Registry) Add(a Adapter)

Add registers an adapter for every kind it performs.