1.11.0
Policy as Code: Plan gating with conftest and CrossGuard
Policies validate what a plan is allowed to contain before it is applied — or destroyed. A hard violation refuses the job before anything reaches the infrastructure; a soft violation records a warning and lets the job continue. Evaluation happens on the Runner against the plan the job actually produced, and the plan document never leaves the Runner.
- Terraform / OpenTofu — OPA/Rego policies evaluated with conftest against the JSON export of the binary plan. conftest's conventions are adopted wholesale (
deny*/violation*hard,warn*soft, prefix-matched, all namespaces), so existing conftest policy repos work unchanged and Snap CD policies stay runnable under plain conftest in CI. - Pulumi — CrossGuard policy packs enforced inside the preview via
--policy-pack. A mandatory violation fails the preview and the job finalizes exactly like a Terraform denial.
Policies attach to a Module or a Namespace, in three source flavours: inline (a policy document held in Snap CD), remote (a git subtree at a pinned revision) and local (an operator-managed folder on the Runner). Severity lives in the policy content rather than on the resource, and evaluate_on scopes Terraform policies to apply, destroy or both — destroy protection is a first-class use case.
A denial is a refusal, not a failure: jobs finish in a new PolicyDenied state alongside Declined, and the approvals screen shows the outcome, the plan's change counts, and links into the policy logs.
Operators: the Runner image now carries conftest and python3/venv; the pulumi CLI already ships CrossGuard. Air-gapped runners can pre-provision CrossGuard packs and set PolicyEvaluation:PackProvisioningEnabled=false.