From c4493ab3785b2d19bd751964055c0676f6798512 Mon Sep 17 00:00:00 2001
From: Tom Whitwell <tom.whitwell@digital.cabinet-office.gov.uk>
Date: Fri, 10 Jul 2026 15:24:24 +0100
Subject: [PATCH] BAU: guardrail to ensure pentester email parity

As we maintail the pentester email addresses in two places, we need to
nsure they are kept in sync. This guardrail checks that the email
addresses match in both locations and that they are only set in staging.

This is similar to the guardrail we have for the CIDR blocks.
---
 ...ail_matching_pentester_email_addresses.yml | 57 +++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 .github/workflows/guardrail_matching_pentester_email_addresses.yml

diff --git a/.github/workflows/guardrail_matching_pentester_email_addresses.yml b/.github/workflows/guardrail_matching_pentester_email_addresses.yml
new file mode 100644
index 000000000..cd3face5c
--- /dev/null
+++ b/.github/workflows/guardrail_matching_pentester_email_addresses.yml
@@ -0,0 +1,57 @@
+name: "Guardrail: Matching pentester email addresses"
+
+on:
+  pull_request:
+    paths:
+      - "infra/deployments/forms/account/tfvars/staging.tfvars"
+      - "infra/deployments/deploy/engineer-access/roles.tf"
+      - ".github/workflows/guardrail_matching_pentester_email_addresses.yml"
+env:
+  HCL2JSON_VERSION: "v0.6.1"
+jobs:
+  check_for_matching_email_addresses:
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      contents: read
+      pull-requests: write
+
+    name: Check for matching email addresses
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Install `hcl2json` with mise
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+        with:
+          install_args: hcl2json
+
+      - name: Check email addresses match everywhere
+        run: |
+          hcl2json infra/deployments/forms/account/tfvars/staging.tfvars | jq -rc '.pentester_email_addresses' > forms_acct_tfvars_staging
+          hcl2json infra/deployments/deploy/engineer-access/roles.tf | jq -rc '.module.engineer_access[0].pentesters' > deploy_engineer_access_roles
+
+          if ! cmp --silent forms_acct_tfvars_staging deploy_engineer_access_roles; then
+            cat <<EOF
+              If you're setting pen tester email addresses, make sure you set them the same everywhere
+              * infra/deployments/forms/account/tfvars/staging.tfvars
+              * infra/deployments/deploy/engineer-access/roles.tf
+          EOF
+
+            echo "infra/deployments/forms/account/tfvars/staging.tfvars"
+            cat forms_acct_tfvars_staging
+
+            echo "infra/deployments/deploy/engineer-access/roles.tf"
+            cat deploy_engineer_access_roles
+            exit 1
+          fi
+
+      - name: Check email addresses are only set in staging
+        run: |
+          while IFS= read -r file
+          do
+            if [ "$(hcl2json "${file}" | jq -rc '.pentester_email_addresses')" != "[]" ]; then
+              echo "Pentester email addresses should not be set outside of staging"
+              echo "Guilty file: ${file}"
+              exit 1
+            fi
+          done < <(find infra/deployments/forms/account/tfvars -maxdepth 1 -mindepth 1 -not -name "staging.tfvars"  -name "*.tfvars")