Stack policies
Block stack runs before they start, or approve and reject infrastructure plans with Rego
Stack policies use the plrl.stack Rego package. They evaluate at one of two stages:
Stage | When it runs | Effect of deny | Effect of approve |
|---|---|---|---|
| Run | Before a stack run is created | Ignored | Ignored |
| Approval | After plan, when the run is waiting for approval | The run is approved | The run is approved |
Attach the same policy at both stages when you want both behaviors. Use input.stage (run or approval) so each rule applies to the intended evaluation.
Run stage
Run-stage policies decide whether Plural should create a stack run at all. Typical uses are release windows, blocked committers, and required variables, environment, or files.
A denial is the only decision that changes behavior. If the policy produces no denial, the run is created and later approval-stage policies still apply.
When a Git or pull-request poll is denied, Plural does not consume the detected SHA, so the same commit is retried after the window reopens. Cron denials still stamp the last-run time. Manual and restart denials return the policy message to the caller.
If policy compilation or evaluation fails, run creation continues. Treat that as fail-open: a broken policy will not freeze every stack.
Run-stage input
Field | Description |
|---|---|
input.stage | Always run |
input.now | Current time as an RFC 3339 timestamp, for freeze windows |
input.trigger.source | Why the run was requested: git, pr, cron, manual, restart, destroy, or custom |
input.actor | The initiating user, including identity, service-account status, roles, and groups |
input.stack | Stack metadata, including its name, project, Git configuration, and variables |
input.commit | Commit SHA, message, and committer for the proposed run |
input.run | Intended run flags: dry_run, destroy, and pull_request |
input.variables | Stack variables |
input.environment | Stack environment variables. Secret values are omitted; only name and secret: true are present |
input.files | Stack file paths. File contents are omitted |
input.changes | Paths changed in Git since the last run, when the trigger supplies them |