This commit fixes a copy/paste error from #8356 that resulted
in the YAML detection logic of the `check-changes` job setting
the wrong result for the job step's yaml changes output.
This bug caused downstream jobs to not see that YAML files were
altered at all in a PR, and YAML-specific jobs like the linter
and zizmor passes would not be run.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net>
All these snippets are now rule-indexed:
```rego
allow if input.role in {"admin", "user"}
allow if "admin" in input.roles
allow if { # minimal var tracking
x := input.role
x in {"admin", "user"}
}
```
Fixes#1841.
* ast: move debug helpers to index_debug.go, add mermaid output
* ast: add reverse case, e.g. "admin" in input.roles
Here, we need to react differntly when input.roles is an array, a set
or an object.
NB(sr): I thought we'd never have to deal with sets, because they are
not coming from JSON -- i.e. they cannot be input or data. But it seems
we allow input to be any *ast.Term, so we need to deal with ast.Set,
too. Added a case to the existing code for this, when input.role is LHS.
* ast: treat ref[_] = "foo" like `"foo" in ref`
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This is useful for using in docs pages where we want to be able to offer the
reader a definition for a term inline. Some such cases have been added as part
of this PR to get us started with some more technical terms early in our
docs.
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
Surprisingly, this sailed up as the major source of B/op in the Regal
linting itself benchmark. I guess we never paid attention to it in the
past as there were many worse culprits.
With help from @tsandall we tracked this down to Regal's frequent use
of walk, and how that'd unify the path-value array. Not sure if there
are any other noteworthy scenarios that lead on to this path, but at
least us `walk` enthusiasts get to start the weekend in the best possible
way.
No surprises wrt the fix here. Just cram everything into a single struct that
can be reused across requests via a sync pool. Not particularly elegant, but
fairly limited, so I hope to get this in even if the impact should be minimal
outside of `walk` heavy integrations.
RegalLintingItself benchmark, main vs change. Ns/op and # allocs largely
unchanged, while the difference in B/op is rather massive for a simple
change!
```
348015056 ns/op 1260364874 B/op 31868705 allocs/op
343963417 ns/op 1122163613 B/op 31874931 allocs/op
```
Signed-off-by: Anders Eknert <anders.eknert@apple.com>
This PR contains fixes for all findings by the static analysis
tool zizmor, and reduces the attack surface available in our
GH Actions workflows by a decent margin.
The most notable change: our post-tag workflow now does not
use the actions cache, to prevent cache poisoning attacks.
This will drive up release publishing times, but eliminates
an attack vector on those releases.
Other changes:
- We also update all of our Slack alerting steps to use the
official slackapi/slack-github-action project, instead of the
archived project we were using before.
- A new `yaml` change detection category to has been added
to the `check-changes` job, allowing later jobs and steps
in the pull-request workflow to run conditionally on
YAML-based changes.
- An explicit linting job that runs the zizmor Github Actions
static analysis tool on the repo when YAML changes are
detected.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net>
The concern expressed in this comment has been determined to be unwarranted, so removing it to not cause future confusion.
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
Those tests never intended an Else return, but I stumbled upon one case
returning one:
```
$ go test ./v1/ast
--- FAIL: TestBaseDocEqIndexing (0.00s)
--- FAIL: TestBaseDocEqIndexing/functions:_glob.match_in_function,_arg_matching_non-glob_rule (0.00s)
index_test.go:823: unexpected else rule(s): map[glob_f(a) = true if { a = 12 }:[glob_f(a) = true if { a = 12 }]]
FAIL
FAIL github.com/open-policy-agent/opa/v1/ast 1.525s
FAIL
```
This change fixes it.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Discussed this with @srenatus, and we weren't sure if the value of
a `Location`s `File` got interned while parsing, or if we had to pay
for a unique string per Location. It turns out that they indeed share
the same memory location, which was "bad" as it otherwise would have
been an easy win. Oh well, one we already won then, I guess.
Signed-off-by: Anders Eknert <anders.eknert@apple.com>
This is almost what do in nightlies, but:
1. Not pulling docker images, trivy can do that -- we don't deal with
changing tags here (latest, edge), but concrete ones that don't get
overwritten in dockerhub ever.
2. It's a different, since we don't want nightly to turn red when there
is a vulnerability in the latest release, it's two separate concerns.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* docs: Add workflow to auto update regal docs
We want to automate the process of importing the
latest regal release's docs.
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
* docs: Remove review CC
This is not needed when we have reviewer set too.
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
---------
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
* topdown: fix BenchmarkFunctionArgumentCounts query
The benchmark was using `test.f(...)` syntax which OPA interprets as a
built-in function call, causing "unsupported built-in" errors. Rules from
compiled modules must be referenced via the `data` prefix.
Changed query from `test.f(...)` to `data.test.f(...)` to properly
reference the rule defined in the test package.
Signed-off-by: alex60217101990 <alex6021710@gmail.com>
* topdown: remove warmup stunts from benchmarks
Go's benchmark framework automatically handles warmup iterations through
its internal iteration count management.
Removed:
- Explicit warmup loops
- Manual GC() and ReadMemStats() calls
- Custom b.StopTimer() usage
- Hand-calculated allocPerOp and mallocsPerOp metrics
- b.ReportMetric() calls for standard metrics
Signed-off-by: alex60217101990 <alex6021710@gmail.com>
---------
Signed-off-by: alex60217101990 <alex6021710@gmail.com>
Reduce memory waste in bindings allocation by using
compile-time size hints for function evaluation.
Before: All bindings pre-allocated 16-slot arrays regardless of usage
After: Dynamic sizing based on known argument counts
Memory improvements:
- 20 bindings: 10.7% less memory, 13.3% faster
- 50 bindings: 20.7% less memory, 8.3% faster
- Transition cost: 22.4% faster for large binding sets
Implementation:
- Add newBindingsWithSize() constructor with size hint parameter
- Add newBindingsArrayHashmapWithSize() for smart array/map selection
- Add childWithBindingSizeHint() method for eval context creation
- Apply optimization in evalOneRule() using len(args) as hint
Fixes#7266
Signed-off-by: alex60217101990 <alex6021710@gmail.com>
This allows testing of regal docs changes without
pulling them from a remote, useful if testing
changes to content with docusaurus bits in.
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
The `json.patch` built-in is quite versatile, and compared to
patching via e.g. `object.union` et. al. often communicates
intent better, IMO. But while it uses some fairly advanced
logic for complex patch operations, it doesn't perform all that
great on simple ones. This is a first and pretty basic attempt
to improve that somewhat by picking the most low-hangig performance
fruits, like avoiding repeated allocations of temporary term pointers.
The main allocation source is the creation of EditTree's, and this
remains a problem. I have created a sync pool but only managed to
get the outermost edit tree to recycle, as I found it really hard
to track where it's safe to release those created in the deeply
nested calls. Additionally, I managed to trigger stack overflows
trying to recycle child trees, so there seems to be some circular
refs? Or I just did something wrong.
If someone wants to look into this and pick up where
I left, that'd be great!
- Add InternedIntRange for testing, primarily
- Intern keys used in json.patch patches
- Clean up json.X built-in benchmarks
- Reduce allocations in edit tree function
- Avoid using intermediate data structures
for JSON patches
- Some unrelated interning fixes to reduce noise
in tests and benchmarks (e.g. do less stuff in
var inits)
Selected benchmark that I used while working on this:
**Before**
```
BenchmarkJSONPatchAddShallowScalar/object-10-16 147853 8008 ns/op 9667 B/op 206 allocs/op
BenchmarkJSONPatchAddShallowScalar/array-10-16 201704 5889 ns/op 7256 B/op 173 allocs/op
BenchmarkJSONPatchAddShallowScalar/set-10-16 182566 6733 ns/op 8103 B/op 156 allocs/op
```
**After**
```
BenchmarkJSONPatchAddShallowScalar/object-10-16 197414 6066 ns/op 7256 B/op 133 allocs/op
BenchmarkJSONPatchAddShallowScalar/array-10-16 278121 4427 ns/op 5285 B/op 100 allocs/op
BenchmarkJSONPatchAddShallowScalar/set-10-16 233884 4839 ns/op 6243 B/op 113 allocs/op
```
Signed-off-by: Anders Eknert <anders.eknert@apple.com>
Implements RegisterStorageBackend() to allow Go module users to inject custom
storage implementations during early-stage package init (hardcoded at build time).
Previously this was only possible through params.StoreBuilder which required
direct SDK usage.
Key changes:
- Add RegisterStorageBackend() and StorageBackendBuilder type in v1/runtime
- Modify storage initialization to check registered backends
Fixes#8277
Signed-off-by: alex60217101990 <alex6021710@gmail.com>
Stephan Renatus