Tirith platform mode: Take the policies from the organization instead

[refeed]

Two lines in, three files out. Same action, same position in the pipeline, same plan.json — what
changes is where the rules come from.

       - uses: StackGuardian/tirith-iac-governance-action@v2.1.1
         with:
+          sg-api-key: ${{ secrets.SG_API_TOKEN }}
+          sg-org: ${{ vars.SG_ORG }}
           fail-on-error: true

- .tirith/policies/s3-owner-tag.tirith.json
- .tirith/policies/s3-naming.tirith.json
- .tirith/policies/provider-region.tirith.json

There is no mode switch. Supplying credentials is the switch — policy-path is ignored from here
on, and the rules are selected server-side by workflow group, so they can change without a commit in
this repository.

The credentials are step inputs rather than a job-level env: block on purpose. At job scope every
step in the job can read them, terraform and every third-party action included.

What we get that the runner could not do

The check below reports four engines where
chapter 1 reported three:

engine	why it needs the platform
Infracost	the plan has to be priced, and nothing on a runner does that
OPA / rego	needs an OPA engine; the CLI has none
Checkov	the platform's built-in pack, advisory only
Tirith	the same owner-tag rule that was in this repo a commit ago

Plus run history on the dashboard, and one policy set enforced across every repository instead of
per-repo copies that drift.

One thing we lose in the swap

The findings go back to bare comparisons — `""` is empty rather than chapter 1's
[aws_s3_bucket.artifacts (no-op)] tags.Owner: .... That richer wording comes from the CLI this action
installs, and platform findings are produced by StackGuardian's own evaluation step, which pins its own
copy. They get it when that step is released.

The plan report survives the swap either way, because it is rendered on the runner from the plan we
supplied — still a no-op here, so still a summary line and no diff block.

And what we give up entirely

Nobody can check this repository without an account any more. That is a real cost, and it is why
chapter 1 comes first: local mode is the
version you can adopt on a Tuesday afternoon, and this is the version an organization standardises on.

---

Chapter 2 of 5. Based on #16 · Next: #18 — Add the analytics bucket

[github-actions]

🛡️ Tirith — 1 warned, 3 passed

_{Scanned commit 9395dcb · dir . · workflow github-com-StackGuardian-tirith-action-demo-deploy}

Plan: 0 to add, 0 to change, 0 to destroy. 5 unchanged.

	Policy	Rule	Resource
⚠️	__sg.checkov-best-practices	checkov-best-practices	aws_s3_bucket.artifacts
✅	tirith-demo-cost-ceiling	monthly-cost-ceiling	—
✅	tirith-demo-opa-check	s3-naming-and-region	—
✅	tirith-demo-s3-owner-tag	s3-buckets-must-declare-an-owner	—

⚠️ __sg.checkov-best-practices › checkov-best-practices

• Ensure S3 buckets should have event notifications enabled
• Ensure that S3 bucket has cross-region replication enabled

Resources:

• aws_s3_bucket.artifacts

_{💵 Estimated monthly cost: 1.00 USD (+1.00 from this change)}

_{✅ 3 passed · View run in StackGuardian}