<!-- m-wiki: type=top-level slug=config-policy topic=null base-sha=28f54cf7bef9 generated-at=2026-05-12T00:00:00+00:00 sources=[] -->

> Generated 2026-05-12 at base-sha 28f54cf7bef9. Type: top-level. 0 sources.

# Config and Policy

`constructParam.groovy` does two things: it resolves all `env.*` variables from `config.yaml` and the current branch/environment, and it enforces five policy gates by fetching `Meesho/whitelists` at runtime.

## TL;DR

- `config.yaml` is the service's contract — `getYamlParameter.getParam()` reads it before any build runs.
- `constructParam.run()` sets 15+ `env.*` vars (registry, vault, sonar, GCPProject, etc.) based on `cicd_environment`.
- Five whitelist files are fetched from `Meesho/whitelists` at runtime via `git clone` — not bundled.
- Whitelisted policies: skip-sonar, app-config-disabled, multizone, allowedNonDevelopPrToInt, ValidateCacConfig.
- `ValidateCacConfig` gate triggers `validate_configs_v2.py` on Go and Maven PRs.

## Mental model

`constructParam` is the policy layer. All build and deploy stages read `env.*` but never set it — they are consumers. `constructParam` is the sole producer. This ensures every stage shares a consistent view of which cloud, environment, registry, and policy applies to this build.

The whitelist pattern allows DevOps to grant exceptions without modifying any service's code — a repo is added to `Meesho/whitelists/skip-sonar-whitelist.yaml` and the next build automatically picks up the exception.

## Structure / data flow

```
config.yaml (in service repo):
  repo_name, build_tool, dockerBuildVersion, bu, team,
  deployment_order, notify_channel, skip_sonar, deployArgo, appConfigEnabled

getYamlParameter.getParam(repo_name) → param Map

constructParam.run(param):
  ├─ environment_map → env.cicd_environment
  ├─ GCP accountDetails[env.cicd_environment]:
  │    env.GCPProject, env.registry, env.buildRegistry
  │    env.vaultURL/Token, env.sonarURL/Token
  │    env.objBucket, env.DOCKER_HOST
  │
  ├─ [whitelist gate] skipSonarCheckForbidden() → clone Meesho/whitelists/skip-sonar-whitelist.yaml
  ├─ [whitelist gate] appConfigDisabledForbidden() → app-config-disabled.yaml
  ├─ [whitelist gate] isMultizoneEnabled() → multizone-enabled-repos.yaml
  ├─ [whitelist gate] allowedNonDevelopPrDeploymentToIntRepos() → allowedNonDevelopPrDeploymentToInt.yaml
  └─ [whitelist gate] ValidateCacConfigForRepo() → ValidateCacConfig.yaml
```

## Key code locations

| Symbol | File | What it does |
|--------|------|--------------|
| `run` | `src/com/meesho/utilities/constructParam.groovy:run` | Main env var setter |
| `perDeploymentVars` | `src/com/meesho/utilities/constructParam.groovy:perDeploymentVars` | Sets per-deployable ArgoCD vars |
| `getWhitelistedRepos` | `src/com/meesho/utilities/constructParam.groovy:getWhitelistedRepos` | Clones Meesho/whitelists and reads a YAML file |
| `skipSonarCheckForbidden` | `src/com/meesho/utilities/constructParam.groovy:skipSonarCheckForbidden` | Blocks Maven prd builds with skip_sonar=true if not whitelisted |
| `appConfigDisabledForbidden` | `src/com/meesho/utilities/constructParam.groovy:appConfigDisabledForbidden` | Blocks stg deploys if appConfig disabled and not whitelisted |
| `isMultizoneEnabled` | `src/com/meesho/utilities/constructParam.groovy:isMultizoneEnabled` | Returns true for deployables in multizone whitelist |
| `ValidateCacConfigForRepo` | `src/com/meesho/utilities/constructParam.groovy:ValidateCacConfigForRepo` | Returns true if repo must run CAC validation |
| `getParam` | `src/com/meesho/utilities/getYamlParameter.groovy:getParam` | Reads a YAML file from the workspace |

## Sharp edges

- **Each whitelist call does a fresh `git clone`**: `getWhitelistedRepos()` clones `Meesho/whitelists` into a `whitelist/` subdirectory every time it's called. Five separate calls = five clones in the same build. Network latency here directly adds to build time. This is deliberate — each clone captures the latest whitelist state so a DevOps policy change takes effect on the very next build without a library release. Never cache across calls.
- **Go sonar-skip logic is in `constructParam.groovy`, not `buildGo.groovy`**: `skipSonarCheckForGo(Map config)` (`src/com/meesho/utilities/constructParam.groovy:skipSonarCheckForGo`) centralises all skip-sonar policy. Embedding whitelist checks inline in language build stages is the wrong pattern.
- **`perDeploymentVars` must run before ArgoCD steps**: it sets `env.argoURL`, `env.argoCreds`, `env.argoAppNS`, and `env.argoIncubator` per deployable. Calling ArgoCD stages before this results in empty ArgoCD credentials.
- **`bu` drives GCP project name**: `prodGCPProject = "meesho-${config.bu}-prd-0622"`. An invalid or misspelled `bu` in `config.yaml` produces a nonexistent GCP project name.
- **Toolchain env skips several policies**: when `env.INFRA_ENV == 'toolchain'`, skip_sonar is forced true and vault/sonar are pointed at `toolchain-dind-dev-svc`.

## Related concepts

- [Whitelist system](policy/whitelist-system.md) — detailed whitelist file inventory
- [CAC validation](policy/cac-validation.md) — what happens when ValidateCacConfig=true
- [Multi-tenancy](policy/multi-tenancy.md) — BU/team mapping and initials
- [Environment mapping](05-ENVIRONMENT-MAPPING.md) — how cicd_environment is determined
- [Security overview](security/security-overview.md) — credential handling, trust boundaries, security rules for new code
- [ADR index](adr/adr-index.md) — architectural decisions behind the whitelist and policy model (ADR-0003, ADR-0004)

## Notes

<!-- Anything below is human-owned. wiki-init never reads or modifies content under this heading. -->

---

[← Previous](05-ENVIRONMENT-MAPPING.md) · [Index](../index.md) · [Next →](07-LANGUAGE-BUILDS.md)