diff --git a/.github/workflows/pull-request.yaml b/.github/workflows/pull-request.yaml index 6a1c45ab63..3b5e5ab42a 100644 --- a/.github/workflows/pull-request.yaml +++ b/.github/workflows/pull-request.yaml @@ -20,6 +20,7 @@ jobs: go: ${{ steps.changes.outputs.go }} wasm: ${{ steps.changes.outputs.wasm }} docs: ${{ steps.changes.outputs.docs }} + rego: ${{ steps.changes.outputs.rego }} steps: - name: Check out repository code uses: actions/checkout@v6 @@ -38,17 +39,18 @@ jobs: echo "go=true" >> $GITHUB_OUTPUT echo "wasm=true" >> $GITHUB_OUTPUT echo "docs=true" >> $GITHUB_OUTPUT + echo "rego=true" >> $GITHUB_OUTPUT if ! curl -s -o changed_files.json -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \ "https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files"; then echo "Error: Failed to fetch changed files from GitHub API" - echo "Defaulting to running all checks (go=true, wasm=true, docs=true)" + echo "Defaulting to running all checks (go=true, wasm=true, docs=true, rego=true)" exit 0 fi if [ ! -s changed_files.json ]; then echo "Warning: No changed files found" - echo "Defaulting to running all checks (go=true, wasm=true, docs=true)" + echo "Defaulting to running all checks (go=true, wasm=true, docs=true, rego=true)" exit 0 fi @@ -64,15 +66,18 @@ jobs: go_result=$(jq -r '.changes.go // false' opa_result.json) wasm_result=$(jq -r '.changes.wasm // false' opa_result.json) docs_result=$(jq -r '.changes.docs // false' opa_result.json) + rego_result=$(jq -r '.changes.rego // false' opa_result.json) echo "go=${go_result}" >> $GITHUB_OUTPUT echo "wasm=${wasm_result}" >> $GITHUB_OUTPUT echo "docs=${docs_result}" >> $GITHUB_OUTPUT + echo "rego=${rego_result}" >> $GITHUB_OUTPUT echo "Final outputs:" echo " go=${go_result}" echo " wasm=${wasm_result}" echo " docs=${docs_result}" + echo " rego=${rego_result}" # All jobs essentially re-create the `ci-release-test` make target, but are split # up for parallel runners for faster PR feedback and a nicer UX. @@ -425,7 +430,7 @@ jobs: name: Rego PR checks runs-on: ubuntu-24.04 needs: check-changes - if: ${{ needs.check-changes.outputs.go == 'true' }} + if: ${{ needs.check-changes.outputs.rego == 'true' }} steps: - name: Checkout code uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 diff --git a/build/policy/pr-check/pr_check.rego b/build/policy/pr-check/pr_check.rego index 0e2ececf0d..2a8f6199bf 100644 --- a/build/policy/pr-check/pr_check.rego +++ b/build/policy/pr-check/pr_check.rego @@ -34,7 +34,7 @@ wasm_change_prefixes := [ "v1/ir", ] -wasm_change_root_files := ["Makefile"] +rego_and_wasm_change_root_files := ["Makefile"] docs_root_files := [ "builtin_metadata.json", @@ -82,5 +82,13 @@ changes["wasm"] if { strings.any_prefix_match(changed_file.filename, wasm_change_prefixes) } else if { some changed_file in input - changed_file.filename in wasm_change_root_files + changed_file.filename in rego_and_wasm_change_root_files +} + +changes["rego"] if { + some changed_file in input + endswith(changed_file.filename, ".rego") +} else if { + some changed_file in input + changed_file.filename in rego_and_wasm_change_root_files } diff --git a/build/policy/pr-check/pr_check_test.rego b/build/policy/pr-check/pr_check_test.rego index d406dcc005..a8596665e6 100644 --- a/build/policy/pr-check/pr_check_test.rego +++ b/build/policy/pr-check/pr_check_test.rego @@ -30,6 +30,8 @@ mixed_bag_changelist := [ {"filename": "v1/rego/testdata/ast.json"}, ] +example_rego_changelist := [{"filename": "build/policy/pr-check/pr_check.rego"}] + example_all_checks_root_changelist := [{"filename": "Makefile"}] example_docs_root_changelist := [{"filename": "netlify.toml"}] @@ -55,6 +57,10 @@ test_run_wasm_tests_expect if { pr_check.changes.wasm with input as example_wasm_changelist } +test_run_rego_tests_expect if { + pr_check.changes.rego with input as example_rego_changelist +} + test_run_docs_not_go_tests_expect if { pr_check.changes.docs with input as example_docs_exception_changelist not pr_check.changes.go with input as example_docs_exception_changelist