feat: deployment dependencies evaluator

apps/workspace-engine/oapi/openapi.json

@@ -281,6 +281,18 @@
             ],
             "type": "object"
          },
+         "DeploymentDependency": {
+            "properties": {
+               "versionSelector": {
+                  "description": "CEL expression evaluated against the dependency deployment's current release version on the same resource.",
+                  "type": "string"
+               }
+            },
+            "required": [
+               "versionSelector"
+            ],
+            "type": "object"
+         },
          "DeploymentDependencyRule": {
             "properties": {
                "dependsOn": {

apps/workspace-engine/oapi/spec/schemas/deployments.jsonnet

@@ -16,6 +16,17 @@ local openapi = import '../lib/openapi.libsonnet';
     },
   },
 
+  DeploymentDependency: {
+    type: 'object',
+    required: ['versionSelector'],
+    properties: {
+      versionSelector: {
+        type: 'string',
+        description: "CEL expression evaluated against the dependency deployment's current release version on the same resource.",
+      },
+    },
+  },
+
 
   DeploymentWithVariablesAndSystems: {
     type: 'object',

apps/workspace-engine/pkg/db/queries/computed_resources.sql

@@ -72,6 +72,26 @@ JOIN system_environment se
     AND se.system_id = sd.system_id
 WHERE cdr.resource_id = @resource_id;
 
+-- name: GetReleaseTargetForDeploymentResource :one
+-- Returns one release target for a (deployment, resource) pair across any
+-- environment. Used by the deployment-version-dependency evaluator, which
+-- only needs to identify some environment in which the dependency lives.
+SELECT DISTINCT
+    cdr.deployment_id,
+    cer.environment_id,
+    cdr.resource_id
+FROM computed_deployment_resource cdr
+JOIN computed_environment_resource cer
+    ON cer.resource_id = cdr.resource_id
+JOIN system_deployment sd
+    ON sd.deployment_id = cdr.deployment_id
+JOIN system_environment se
+    ON se.environment_id = cer.environment_id
+    AND se.system_id = sd.system_id
+WHERE cdr.deployment_id = @deployment_id
+  AND cdr.resource_id = @resource_id
+LIMIT 1;
+
 -- name: GetReleaseTargetsForEnvironment :many
 -- Returns all valid release targets for an environment by joining computed
 -- resource tables through the system link tables.

apps/workspace-engine/pkg/db/queries/deployments.sql

@@ -51,3 +51,9 @@ SELECT deployment_id FROM system_deployment WHERE system_id = $1;
 -- name: DeleteDeployment :exec
 DELETE FROM deployment WHERE id = $1;
 
+-- name: GetDeploymentDependenciesByDeploymentID :many
+SELECT dependency_deployment_id, version_selector
+FROM deployment_dependency
+WHERE deployment_id = $1
+ORDER BY dependency_deployment_id;
+

apps/workspace-engine/pkg/workspace/releasemanager/policy/evaluator/deploymentversiondependency/deployment_version_dependency.go

@@ -0,0 +1,142 @@
+package deploymentversiondependency
+
+import (
+	"context"
+	"fmt"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/attribute"
+	"workspace-engine/pkg/celutil"
+	"workspace-engine/pkg/oapi"
+	cel "workspace-engine/pkg/selector/langs/cel"
+	"workspace-engine/pkg/workspace/releasemanager/policy/evaluator"
+	"workspace-engine/pkg/workspace/releasemanager/policy/results"
+)
+
+var tracer = otel.Tracer("DeploymentVersionDependencyEvaluator")
+
+const RuleType = "deploymentVersionDependency"
+
+type Evaluator struct {
+	getters Getters
+}
+
+func NewEvaluator(getters Getters) evaluator.Evaluator {
+	if getters == nil {
+		return nil
+	}
+	return evaluator.WithMemoization(&Evaluator{getters: getters})
+}
+
+func (e *Evaluator) ScopeFields() evaluator.ScopeFields {
+	return evaluator.ScopeDeployment | evaluator.ScopeResource
+}
+
+func (e *Evaluator) RuleType() string { return RuleType }
+
+func (e *Evaluator) RuleId() string { return "deployment-version-dependency" }
+
+func (e *Evaluator) Complexity() int { return 3 }
+
+func (e *Evaluator) Evaluate(
+	ctx context.Context,
+	scope evaluator.EvaluatorScope,
+) *oapi.RuleEvaluation {
+	ctx, span := tracer.Start(ctx, "DeploymentVersionDependencyEvaluator.Evaluate")
+	defer span.End()
+
+	span.SetAttributes(
+		attribute.String("deployment.id", scope.Deployment.Id),
+		attribute.String("resource.id", scope.Resource.Id),
+	)
+
+	edges, err := e.getters.GetDependencies(ctx, scope.Deployment.Id)
+	if err != nil {
+		span.RecordError(err)
+		return results.NewDeniedResult(
+			fmt.Sprintf("Deployment dependency: failed to load dependencies: %v", err),
+		).WithDetail("error", err.Error())
+	}
+
+	if len(edges) == 0 {
+		return results.NewAllowedResult("Deployment dependency: no dependencies declared")
+	}
+
+	for _, edge := range edges {
+		if denied := e.evaluateEdge(ctx, scope, edge); denied != nil {
+			return denied
+		}
+	}
+
+	return results.NewAllowedResult("Deployment dependency: all dependencies satisfied")
+}
+
+func (e *Evaluator) evaluateEdge(
+	ctx context.Context,
+	scope evaluator.EvaluatorScope,
+	edge DependencyEdge,
+) *oapi.RuleEvaluation {
+	program, err := cel.CompileProgram(edge.VersionSelector)
+	if err != nil {
+		return results.NewDeniedResult(
+			fmt.Sprintf("Deployment dependency: failed to compile selector for %s: %v",
+				edge.DependencyDeploymentID, err),
+		).
+			WithDetail("dependency_deployment_id", edge.DependencyDeploymentID).
+			WithDetail("version_selector", edge.VersionSelector)
+	}
+
+	rt, err := e.getters.GetReleaseTargetForDeploymentResource(
+		ctx, edge.DependencyDeploymentID, scope.Resource.Id,
+	)
+	if err != nil {
+		return results.NewDeniedResult(
+			fmt.Sprintf("Deployment dependency: failed to look up release target for %s: %v",
+				edge.DependencyDeploymentID, err),
+		).WithDetail("dependency_deployment_id", edge.DependencyDeploymentID)
+	}
+	if rt == nil {
+		return results.NewDeniedResult(
+			fmt.Sprintf("Deployment dependency: dependency %s is not deployed on this resource",
+				edge.DependencyDeploymentID),
+		).WithDetail("dependency_deployment_id", edge.DependencyDeploymentID)
+	}
+
+	version, err := e.getters.GetCurrentVersionForReleaseTarget(ctx, rt)
+	if err != nil {
+		return results.NewDeniedResult(
+			fmt.Sprintf("Deployment dependency: failed to load current version for %s: %v",
+				edge.DependencyDeploymentID, err),
+		).WithDetail("dependency_deployment_id", edge.DependencyDeploymentID)
+	}
+	if version == nil {
+		return results.NewDeniedResult(
+			fmt.Sprintf(
+				"Deployment dependency: dependency %s has no successful release on this resource",
+				edge.DependencyDeploymentID,
+			),
+		).WithDetail("dependency_deployment_id", edge.DependencyDeploymentID)
+	}
+
+	celCtx := map[string]any{"version": cel.DeploymentVersionToMap(version)}
+	matched, err := celutil.EvalBool(program, celCtx)
+	if err != nil {
+		return results.NewDeniedResult(
+			fmt.Sprintf("Deployment dependency: CEL evaluation error for %s: %v",
+				edge.DependencyDeploymentID, err),
+		).
+			WithDetail("dependency_deployment_id", edge.DependencyDeploymentID).
+			WithDetail("version_selector", edge.VersionSelector)
+	}
+	if !matched {
+		return results.NewDeniedResult(
+			fmt.Sprintf("Deployment dependency: dependency %s version %s does not satisfy selector",
+				edge.DependencyDeploymentID, version.Tag),
+		).
+			WithDetail("dependency_deployment_id", edge.DependencyDeploymentID).
+			WithDetail("dependency_version", version.Tag).
+			WithDetail("version_selector", edge.VersionSelector)
+	}
+
+	return nil
+}