This PR adds support for tracking Git tags instead of branches. It is a revival of #517 with some additions to add support for tags in the OPAL scopes as well.

Fixes Issue

Changes proposed

Why tracking git tags instead of branch

In a way this could be considered "against" how git is supposed to be used - some say tags should be immutable. However, mutable tags are defacto sometimes used, the most clear example being using a "latest" tag or a "v1-latest" tag.

Using tags this way could let you use a policy repo with a single base branch, while still giving control of what is rolled out in each env. Consider the traditional dev/prod setup:

• the dev instance of OPAL is tracking the base branch (ex. master)
• the prodinstance of OPAL is tracking a prod tag which can be moved at will once the changes in dev/master is tested properly.

This current way of doing this is to have multiple long lived branches in the same repo - this can be cumbersome and lead to a bunch of manual merging of branches.

Changes

• Add env variable POLICY_REPO_TAG and cli arg --policy-repo-tag, defaulting to None. When used, OPAL will track the tag.

POLICY_REPO_TAG and POLICY_REPO_MAIN_BRANCH

The two variables are obviously dependent on eachother. My idea was to not break default behaviour.

Check List (Check all the applicable boxes)

• I sign off on contributing this submission to open-source
• My code follows the code style of this project.
• My change requires changes to the documentation.
• I have updated the documentation accordingly.
• All new and existing tests passed.
• This PR does not contain plagiarized content.
• The title of my pull request is a short description of the requested changes.

Screenshots

Note to reviewers