Decoupled the Rego job check from the Go job checks in the Github PR workflow (#8203)

Added coverage for the new Rego check

Signed-off-by: seanledford <s_ledford@apple.com>

.github/workflows/pull-request.yaml

@@ -20,6 +20,7 @@ jobs:
       go: ${{ steps.changes.outputs.go }}
       wasm: ${{ steps.changes.outputs.wasm }}
       docs: ${{ steps.changes.outputs.docs }}
+      rego: ${{ steps.changes.outputs.rego }}
     steps:
     - name: Check out repository code
       uses: actions/checkout@v6
@@ -38,17 +39,18 @@ jobs:
         echo "go=true" >> $GITHUB_OUTPUT
         echo "wasm=true" >> $GITHUB_OUTPUT
         echo "docs=true" >> $GITHUB_OUTPUT
+        echo "rego=true" >> $GITHUB_OUTPUT
 
         if ! curl -s -o changed_files.json -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
           "https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files"; then
           echo "Error: Failed to fetch changed files from GitHub API"
-          echo "Defaulting to running all checks (go=true, wasm=true, docs=true)"
+          echo "Defaulting to running all checks (go=true, wasm=true, docs=true, rego=true)"
           exit 0
         fi
 
         if [ ! -s changed_files.json ]; then
           echo "Warning: No changed files found"
-          echo "Defaulting to running all checks (go=true, wasm=true, docs=true)"
+          echo "Defaulting to running all checks (go=true, wasm=true, docs=true, rego=true)"
           exit 0
         fi
 
@@ -64,15 +66,18 @@ jobs:
         go_result=$(jq -r '.changes.go // false' opa_result.json)
         wasm_result=$(jq -r '.changes.wasm // false' opa_result.json)
         docs_result=$(jq -r '.changes.docs // false' opa_result.json)
+        rego_result=$(jq -r '.changes.rego // false' opa_result.json)
 
         echo "go=${go_result}" >> $GITHUB_OUTPUT
         echo "wasm=${wasm_result}" >> $GITHUB_OUTPUT
         echo "docs=${docs_result}" >> $GITHUB_OUTPUT
+        echo "rego=${rego_result}" >> $GITHUB_OUTPUT
 
         echo "Final outputs:"
         echo "  go=${go_result}"
         echo "  wasm=${wasm_result}"
         echo "  docs=${docs_result}"
+        echo "  rego=${rego_result}"
 
   # All jobs essentially re-create the `ci-release-test` make target, but are split
   # up for parallel runners for faster PR feedback and a nicer UX.
@@ -425,7 +430,7 @@ jobs:
     name: Rego PR checks
     runs-on: ubuntu-24.04
     needs: check-changes
-    if: ${{ needs.check-changes.outputs.go == 'true' }}
+    if: ${{ needs.check-changes.outputs.rego == 'true' }}
     steps:
     - name: Checkout code
       uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

build/policy/pr-check/pr_check.rego

@@ -34,7 +34,7 @@ wasm_change_prefixes := [
 	"v1/ir",
 ]
 
-wasm_change_root_files := ["Makefile"]
+rego_and_wasm_change_root_files := ["Makefile"]
 
 docs_root_files := [
 	"builtin_metadata.json",
@@ -82,5 +82,13 @@ changes["wasm"] if {
 	strings.any_prefix_match(changed_file.filename, wasm_change_prefixes)
 } else if {
 	some changed_file in input
-	changed_file.filename in wasm_change_root_files
+	changed_file.filename in rego_and_wasm_change_root_files
+}
+
+changes["rego"] if {
+	some changed_file in input
+	endswith(changed_file.filename, ".rego")
+} else if {
+	some changed_file in input
+	changed_file.filename in rego_and_wasm_change_root_files
 }

build/policy/pr-check/pr_check_test.rego

@@ -30,6 +30,8 @@ mixed_bag_changelist := [
 	{"filename": "v1/rego/testdata/ast.json"},
 ]
 
+example_rego_changelist := [{"filename": "build/policy/pr-check/pr_check.rego"}]
+
 example_all_checks_root_changelist := [{"filename": "Makefile"}]
 
 example_docs_root_changelist := [{"filename": "netlify.toml"}]
@@ -55,6 +57,10 @@ test_run_wasm_tests_expect if {
 	pr_check.changes.wasm with input as example_wasm_changelist
 }
 
+test_run_rego_tests_expect if {
+	pr_check.changes.rego with input as example_rego_changelist
+}
+
 test_run_docs_not_go_tests_expect if {
 	pr_check.changes.docs with input as example_docs_exception_changelist
 	not pr_check.changes.go with input as example_docs_exception_changelist