2.8 KiB
Generated 2026-05-12 at base-sha 28f54cf7bef9. Type: concept. 0 sources.
Whitelist System
devops-lib enforces five policy gates at runtime by cloning Meesho/whitelists on GitHub and reading a YAML file. This allows DevOps to grant or revoke exceptions without changing any service code or the library itself.
Where it applies in this repo
src/com/meesho/utilities/constructParam.groovy:getWhitelistedRepos
Five whitelist files:
| File in Meesho/whitelists | Gate method | What it controls |
|---|---|---|
skip-sonar-whitelist.yaml |
skipSonarCheckForbidden() |
Allows skip_sonar: true in config.yaml for Maven prd builds |
app-config-disabled.yaml |
appConfigDisabledForbidden() |
Allows appConfigEnabled: false in stg for Maven/Gradle |
multizone-enabled-repos.yaml |
isMultizoneEnabled() |
Marks deployables that must go via Ringmaster (not Jenkins) |
allowedNonDevelopPrDeploymentToInt.yaml |
allowedNonDevelopPrDeploymentToIntRepos() |
Allows feature-branch PRs to target main for int deploy |
ValidateCacConfig.yaml |
ValidateCacConfigForRepo() |
Opts repo into CAC config validation during PR builds |
Each YAML file has a repos: list. getWhitelistedRepos(fileName) clones the entire Meesho/whitelists repo into whitelist/ in the workspace, reads whitelist/<fileName>.yaml, and returns the repos list as a Set.
getWhitelistedDeployable(fileName, keyName) is a variant that reads an arbitrary key from the YAML — used for multizone_enabled_deployables which is a list under a non-standard key.
Why this design
Inline conditionals in stage code would require PRs to devops-lib for every exception. The whitelist approach lets DevOps grant exceptions by merging a one-line YAML change to Meesho/whitelists — visible in its own audit trail, immediately effective on the next build, and independent of the library release cycle.
The cost is a fresh git clone per whitelist check per build. Five checks = five clones. On a slow network or under GitHub rate limiting, this adds measurable latency. This freshness guarantee is by design — never refactor getWhitelistedRepos to cache the clone across calls without confirming the freshness requirement is no longer needed.
Related
- Config policy — all five gates in context
- CAC validation — triggered by the ValidateCacConfig whitelist
Sources
(no raw/ sources at bootstrap)