any recommendations on running the

zed

cli in a circleCI container for

zed validate

? things i've tried so far: 1. installing the .deb in the cimg/base container (errored out saying

error: 'zed_0.4.3_linux_amd64.deb' is not a Debian format archive

), 2. using the quay.io/authzed/zed image directly (is distroless so doesn't have git to do the checkout step), 3. using the zed image indirectly (doesn't work easily because i'd need to mount the tempfile that i'm working with into the container somehow in order to run

zed validate

)

i suppose i could use a

go

image and build/install it in that container, but that seems overwrought

@yetitwo what does the CircleCI container provide?

Yeah, I can see how having some attributes passed into the Check request will ease requirements on spicedb. However for us it probably means that we would likely need to deploy an intermediary that takes in the access request from the PEP, looks up some distributed database to fetch user and resource attributes of interest and then call into SpiceDB. Our PEP is pretty light weight.

if the attributes are defined in a database, they should be placed into a relationship if possible

that means they aren't really environmental, but "static"

depends on which one i use - cimg/base has curl, buildessentials, git, docker; i could use cimg/go for one that has go built into it; there are others

i basically have access to anything in the docker hub

is there a way to run docker-in-docker?

yes - the cimg/base image will let you run docker commands, but i'd still have the problem of needing to mount a temporary file into the

docker run --rm quay.io/authzed/zed

command

(i could discard the tempfile as a part of the process, but i like having it for local runs)

and a lot of this is coming around because i want to have

schema.zed

separate from

validations.yaml

, and i don't want to have my schema replicated in my validations, but rather compose them when i run a validation command

i.e. that

zed schema write

and

zed validate

expect two different but overlapping file shapes

yeah

we're working on proposals to break out the schema from validation and into chunks, etc

for now, maybe just

go install

zed?

will that both download it and make it available on the path? that might be a good way to go

i'm not seeing it on the go package repository: https://pkg.go.dev/search?q=zed

is there something else i need to do to be able to download it?

context is that this is on circleci, not my local

Oh whoops lol

Should have read the whole context

i want to be able to download it with a minimum of fanfare - i could theoretically use a macos executor, but that feels like a sledgehammer to crack a nut

no worries

Just spit-balling here, but could you clone the zed repo and build from source?

yeah, but that also feels overwrought when i all i wanna do is

zed validate schema.yaml

as a CI step 😛

i'll keep that in mind as a nuclear option though

i ended up using

cimg/base

and getting the tarball for the time being

- I have an employee resource: on that resource, you can do 4 actions view, promote, transfer, and fire. - There are multiple departments and each department provides permission for different actions to its manager role. For example in one department manager can fire an employee and in another department, the manager can't. I am okay to create different manager roles for each department, for example, Dept1_manager - How can I model it so that when a new department comes up and ask for a role with a specific combination of permission for a manager role, I don't need to change the employee definition? I basically want to decouple the employee definition and manager role definition.