Recertification Strategies
Relevant source files
The following files were used as context for generating this wiki page:Recertification Strategies are a core component of the IAC Recertification Engine (ICE) that determine how files requiring recertification are grouped together into pull requests. After the engine scans and checks files against their recertification thresholds, the selected strategy is used to organize these files into logical units, called FileGroups. Each FileGroup typically results in a single pull request.
This mechanism allows users to control the granularity of recertification tasks. For example, all files belonging to a single configuration pattern can be grouped into one PR, or each file can have its own individual PR. The choice of strategy is configured in the main config.yaml file and is a key step in the engine's execution flow.
Sources: iac-recert-engine/internal/engine/engine.go:121-124, iac-recert-engine/internal/strategy/strategy.go:11-13
Configuration
The PR grouping strategy is defined under the pr_strategy section in the config.yaml file. The primary setting is type, which specifies which grouping logic to use.
Sources: iac-recert-engine/example.config.yaml:57-59, iac-recert-engine/internal/config/types.go:49-53
An example configuration block:
# PR Grouping Strategy
# Options: per_file, per_pattern, per_committer, single_pr, plugin
pr_strategy:
type: "per_pattern"
# max_files_per_pr: 50 # Optional limit
Sources: iac-recert-engine/example.config.yaml:57-60
The PRStrategyConfig struct defines the available configuration options in the code.
| Field | Type | Description | Validation |
|---|---|---|---|
Type | string | The name of the strategy to use. | required, one of: per_file, per_pattern, per_committer, single_pr, plugin |
MaxFilesPerPR | int | An optional limit on the number of files per PR. (Note: This is defined in the config struct but not yet implemented in the strategies). | |
PluginName | string | The name of the plugin to use if type is plugin. |
Sources: iac-recert-engine/internal/config/types.go:49-53
The Strategy Interface
All grouping strategies implement the Strategy interface, which defines a single method, Group. This method takes a slice of RecertCheckResult objects and returns a slice of FileGroup objects. This standardized interface allows the engine to work with any strategy interchangeably.
type Strategy interface {
Group(results []types.RecertCheckResult) ([]types.FileGroup, error)
}
Sources: iac-recert-engine/internal/strategy/strategy.go:12-14
The following class diagram illustrates the relationship between the interface and its concrete implementations.
This diagram shows the Strategy interface and the four concrete strategy implementations that fulfill its contract.
Sources: iac-recert-engine/internal/strategy/strategy.go:23, 45, 72, 99
Strategy Factory
The NewStrategy function acts as a factory, instantiating the appropriate strategy struct based on the type specified in the PRStrategyConfig. If an unknown strategy type is provided, it returns an error.
This flowchart shows the logic of the NewStrategy factory function.
Sources: iac-recert-engine/internal/strategy/strategy.go:16-29
Integration with the Engine
The strategy is invoked during the "Group" phase of the engine's Run method. The results from the "Check" phase are passed directly to the strategy's Group method. The resulting FileGroups are then iterated over to create pull requests.
The diagram below shows the sequence of operations within the Engine.Run method.
This sequence diagram illustrates that the Strategy.Group method is called after scanning and checking, and its output is used for processing groups and creating PRs.
Sources: iac-recert-engine/internal/engine/engine.go:90-124
Available Strategies
The engine provides four built-in strategies for grouping files.
per_file
This strategy creates a separate FileGroup for each individual file that needs recertification. This will result in one pull request per file.
- Logic: Iterates through all check results and creates a new group for each result where
NeedsRecertis true. - Group ID:
file-{file_path}
Sources: iac-recert-engine/internal/strategy/strategy.go:31-43, iac-recert-engine/internal/strategy/strategy_test.go:12-32
per_pattern
This strategy groups files based on the PatternName they matched during the scan. All files that matched the same pattern (e.g., "terraform-prod") will be collected into a single FileGroup.
- Logic: Uses a map to collect files under their corresponding
PatternName. - Group ID:
pattern-{pattern_name}
Sources: iac-recert-engine/internal/strategy/strategy.go:49-69, iac-recert-engine/internal/strategy/strategy_test.go:34-66
per_committer
This strategy groups files based on the author of the last commit that modified the file. All files last modified by the same author will be collected into a single FileGroup. If an author cannot be determined, they are grouped under "unknown".
- Logic: Uses a map to collect files under their
CommitAuthor. - Group ID:
author-{author_name}
Sources: iac-recert-engine/internal/strategy/strategy.go:76-96, iac-recert-engine/internal/strategy/strategy_test.go:68-99
single_pr
This strategy groups all files that need recertification into a single, comprehensive FileGroup. This results in one pull request for all pending recertifications across the repository.
- Logic: Collects all results where
NeedsRecertis true into a single slice. - Group ID:
all-files
Sources: iac-recert-engine/internal/strategy/strategy.go:103-121, iac-recert-engine/internal/strategy/strategy_test.go:101-120
plugin
A plugin strategy type is defined, but its implementation is not yet available. Attempting to use it will result in an error.
Sources: iac-recert-engine/internal/strategy/strategy.go:25-26, iac-recert-engine/internal/config/types.go:50