feat(cli): Add skeleton of executor and action only commits by c-r33d · Pull Request #3301 · opentdf/platform

c-r33d · 2026-04-13T21:58:46Z

Proposed Changes

1.) Adds the executor which is in-charge of committing a specific plan.
2.) Adds commit logic for actions only
3.) Adds stubs for other policy constructs.

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

coderabbitai · 2026-04-13T21:58:55Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 03387a72-06c8-478f-b3e8-9d7caf200e62

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch step-4-commit-migration-plan

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist · 2026-04-13T21:58:59Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces the core infrastructure for the namespaced policy migration workflow. It establishes the planning and execution framework, enabling the system to derive target namespaces for legacy policy objects and perform dry-run migrations. The changes focus on building a robust, deterministic planning engine that ensures migration consistency before any actual state changes are applied.

Highlights

Migration Executor: Added an executor component responsible for committing specific migration plans, including logic for actions and stubs for other policy constructs.
Namespaced Policy Migration: Implemented the dry-run planning workflow for migrating legacy policy objects to namespaced policies, including canonicalization and target derivation.
CLI Command Update: Updated the migrate namespaced-policy command to support planning and writing migration manifests to a specified output file.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

The policy shifts to a new space, Legacy objects find their place. With plans in hand and dry-run done, The migration journey has begun.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request implements the dry-run planning and initial execution logic for migrating legacy policy objects to namespaced policy within the otdfctl tool. It introduces a comprehensive migration framework including object retrieval, dependency-based target derivation, canonical comparison for deduplication, and a structured planning phase. Feedback focuses on improving the robustness and performance of the migration process. Specifically, it is recommended to ensure the migration plan is saved even if execution fails mid-process to track progress, and to move "not implemented" scope checks to the validation phase to prevent partial migrations. Additionally, performance optimizations were identified regarding the use of linear searches in retrieval loops and inefficient JSON marshaling during object canonicalization. A suggestion was also made to refactor the executor logic to reduce code duplication when handling existing or already migrated targets.

otdfctl/migrations/namespacedpolicy/execute.go

otdfctl/migrations/namespacedpolicy/canonical.go

otdfctl/migrations/namespacedpolicy/plan.go

github-actions · 2026-04-14T13:54:56Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	187.338298ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	93.79269ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	425.092554ms
Throughput	235.24 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	42.278116864s
Average Latency	420.722942ms
Throughput	118.26 requests/second

github-actions · 2026-04-14T13:56:01Z

X-Test Failure Report

cukes-report
opentdf~~platform~~JSIV8X.dockerbuild
govulncheck-failure-3
govulncheck-failure-8
govulncheck-failure-1
govulncheck-failure-5
govulncheck-failure-2
govulncheck-failure-0

github-actions · 2026-04-14T13:59:32Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	163.948553ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	80.356164ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	401.668218ms
Throughput	248.96 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.627699357s
Average Latency	394.559082ms
Throughput	126.17 requests/second

github-actions · 2026-04-14T14:09:28Z

X-Test Results

✅ go-pull-3301
✅ go-v0.9.0
✅ java-pull-3301
✅ js-v0.9.0
✅ java-v0.9.0
✅ js-pull-3301
test-cases-mapping-report
bats-test-results
cukes-report
opentdf~~platform~~BHBGDA.dockerbuild
govulncheck-failure-3
govulncheck-failure-8
govulncheck-failure-2
govulncheck-failure-1
govulncheck-failure-5
govulncheck-failure-0

github-actions · 2026-04-14T14:21:07Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	182.250024ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	96.780423ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	389.296038ms
Throughput	256.87 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.721157185s
Average Latency	395.158817ms
Throughput	125.88 requests/second

github-actions · 2026-04-14T14:23:48Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

examples
otdfctl
sdk
service
lib/fixtures
tests-bdd

See the workflow run for details.

github-actions · 2026-04-14T14:28:11Z

X-Test Results

✅ go-pull-3301
✅ go-v0.9.0
✅ java-pull-3301
✅ js-pull-3301
✅ java-v0.9.0
✅ js-v0.9.0
cukes-report
test-cases-mapping-report
bats-test-results
opentdf~~platform~~79PWYL.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-0
govulncheck-failure-2
govulncheck-failure-1
govulncheck-failure-5

elizabethhealy · 2026-04-14T14:43:15Z

otdfctl/migrations/namespacedpolicy/execute.go

+	return nil
+}
+
+func (e *Executor) executeSubjectConditionSets(_ context.Context, plan *Plan) error {


depending on length it may be beneficial to have these (or some of them) live in different files to avoid a giant executor.go

Yeah, I agree. I will refactor as the code gets longer.

elizabethhealy · 2026-04-14T14:44:09Z

otdfctl/migrations/namespacedpolicy/execute.go

+	migrationLabelRun          = "migration_run"
+)
+
+type ExecutorHandler interface {


is there a handler implementation yet or is that next?

This is more a testing nicety. It will just expand on the different CreateXx rpcs.

c-r33d requested a review from a team as a code owner April 13, 2026 21:58

github-actions bot added the size/xl label Apr 13, 2026

gemini-code-assist bot reviewed Apr 13, 2026

View reviewed changes

feat(cli): Commit actions, executor shape.

b832687

c-r33d force-pushed the step-4-commit-migration-plan branch from b73159d to b832687 Compare April 14, 2026 13:48

gemini comment.

f9b0a15

c-r33d changed the title ~~Step 4 commit migration plan~~ feat(cli): Add skeleton of executor and action only commits Apr 14, 2026

c-r33d added 2 commits April 14, 2026 09:15

clean up error code.

78324f4

execute test.

6ba7648

elizabethhealy approved these changes Apr 14, 2026

View reviewed changes

c-r33d merged commit 6fe9afe into DSPX-2655-migrate-otdfctl Apr 14, 2026
35 checks passed

c-r33d deleted the step-4-commit-migration-plan branch April 14, 2026 15:05

Conversation

c-r33d commented Apr 13, 2026

Proposed Changes

Checklist

Testing Instructions

Uh oh!

coderabbitai bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

gemini-code-assist bot commented Apr 13, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Apr 14, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions bot commented Apr 14, 2026

X-Test Failure Report

Uh oh!

github-actions bot commented Apr 14, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions bot commented Apr 14, 2026

X-Test Results

Uh oh!

github-actions bot commented Apr 14, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions bot commented Apr 14, 2026

⚠️ Govulncheck found vulnerabilities ⚠️

Uh oh!

github-actions bot commented Apr 14, 2026

X-Test Results

Uh oh!

elizabethhealy Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

c-r33d Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

elizabethhealy Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

c-r33d Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai bot commented Apr 13, 2026 •

edited

Loading