feat: infra_deployment collection and CM-007 evaluation#3
Merged
Conversation
Define infra_deployment JSON shape (Execution block, applied_at) and scope.Matches for workspace include/exclude glob filtering. Co-authored-by: Cursor <cursoragent@cursor.com>
Add evidence.infra_deployment settings (apply_workflows, apply_job_names, workspace_job_name_pattern) and controls.infra_deployment.traceability with design-doc defaults. Co-authored-by: Cursor <cursoragent@cursor.com>
Extend storage backend with infra_deployment_evidence upsert and date/repo filtering for postgres and filesystem backends. Co-authored-by: Cursor <cursoragent@cursor.com>
Join deployments to code_change by repository + commit_sha, picking the newest merged_at when multiple candidates exist (CM-006/007). Co-authored-by: Cursor <cursoragent@cursor.com>
Evaluate Required Chain (infra_deployment → code_change → author → approvals → execution.url) using QueryCodeChangeForJoin and the shared join helper. Wire into evaluate runner and --infra-deployment files flag. Co-authored-by: Cursor <cursoragent@cursor.com>
Detect Terraform apply runs via apply_workflows and apply_job_names prefix match, extract workspace from matrix job names, and emit infra_deployment evidence per successful apply job. Co-authored-by: Cursor <cursoragent@cursor.com>
Expose kao collect infra-deployment and run it as step 4 in kao run daily before evaluate. Co-authored-by: Cursor <cursoragent@cursor.com>
Add sample matrix-apply evidence for files-mode evaluate testing. Co-authored-by: Cursor <cursoragent@cursor.com>
Clarify that workspace is parsed from GHA matrix job name suffix, not workflow_dispatch inputs. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Terraform infra apply 証跡（
infra_deployment）の収集と CM-007 評価を追加する。GHA matrix apply を前提に、共有 reusable workflow の固定 job 名から workspace を抽出する。InfraDeployment型、evidence.infra_deployment（apply_workflows,apply_job_names,workspace_job_name_pattern）、controls.infra_deployment.traceabilityPutInfraDeployment/QueryInfraDeployment（postgres + filesystem）repository + commit_shaで過去code_changeを結合（lookback_days、最新merged_at優先）kao collect infra-deployment— workflow run → apply job（prefix マッチ）→ job 名 regex で workspace 抽出execution.url）kao run dailyに infra_deployment 収集（step 4）を追加Commit 順（実装手順）
feat: add InfraDeployment evidence type and workspace scope helperfeat: add infra_deployment evidence and control configfeat: add infra_deployment storage Put and Queryfeat: add code_change join helper for deployment traceabilityfeat: implement CM-007 infra_deployment evaluationfeat: add github provider for infra_deployment collectionfeat: add collect infra-deployment command and daily steptest: add infra_deployment fixture datadocs: document matrix job name workspace extraction in §14Test plan
go test ./...kao collect infra-deployment --config kao.yaml --date YYYY-MM-DD（platform-infra 等の実 repo）kao evaluate --input files --infra-deployment testdata/infra_deployment.jsonl --code-change testdata/code_change.jsonlkao run daily --config kao.yaml --date YYYY-MM-DDMade with Cursor