And enable more staticcheck linters. I saw staticcheck failures
mentioned in another PR, so thought I'd check it out.
- `WriteString(fmt.Sprintf)` -> `fmt.Fprintf`
- Rewrite calls to deprecated `*Rule.Path()`
- Don't use `==` to compare `time.Time`
- Use inline ignores over config exclusions of paths
- Remove 'varcheck' ignores as no longer used
- Remove v0 topdown/graphql.go (!)
Signed-off-by: Anders Eknert <anders.eknert@apple.com>
Following SA1019 deprecation warnings in Go 1.21+, the legacy curve.ScalarBaseMult
and curve.IsOnCurve calls for NIST curves (like P256) are substituted with
their crypto/ecdh standard equivalents. Tests continue to parse and verify AWS V4a
signatures equivalently under the new module constraints.
Signed-off-by: kanywst <niwatakuma@icloud.com>
1. We no longer resolve the Auth plugin twice (once for *http.Client,
once for Prepare()).
2. Avoid an intermediate map for request headers because we can set it
right away (semantically equivalent via Set, not Add)
3. Simplify masked header creation
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
I deleted the regal.zip file that the script created. I assume
that shouldn't be commited? But looking at Johan's "agent" PR,
it looks like it was included. We can fix that later though.
Signed-off-by: Anders Eknert <anders.eknert@apple.com>
This commit fixes a copy/paste error from #8356 that resulted
in the YAML detection logic of the `check-changes` job setting
the wrong result for the job step's yaml changes output.
This bug caused downstream jobs to not see that YAML files were
altered at all in a PR, and YAML-specific jobs like the linter
and zizmor passes would not be run.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net>
All these snippets are now rule-indexed:
```rego
allow if input.role in {"admin", "user"}
allow if "admin" in input.roles
allow if { # minimal var tracking
x := input.role
x in {"admin", "user"}
}
```
Fixes#1841.
* ast: move debug helpers to index_debug.go, add mermaid output
* ast: add reverse case, e.g. "admin" in input.roles
Here, we need to react differntly when input.roles is an array, a set
or an object.
NB(sr): I thought we'd never have to deal with sets, because they are
not coming from JSON -- i.e. they cannot be input or data. But it seems
we allow input to be any *ast.Term, so we need to deal with ast.Set,
too. Added a case to the existing code for this, when input.role is LHS.
* ast: treat ref[_] = "foo" like `"foo" in ref`
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This is useful for using in docs pages where we want to be able to offer the
reader a definition for a term inline. Some such cases have been added as part
of this PR to get us started with some more technical terms early in our
docs.
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
Surprisingly, this sailed up as the major source of B/op in the Regal
linting itself benchmark. I guess we never paid attention to it in the
past as there were many worse culprits.
With help from @tsandall we tracked this down to Regal's frequent use
of walk, and how that'd unify the path-value array. Not sure if there
are any other noteworthy scenarios that lead on to this path, but at
least us `walk` enthusiasts get to start the weekend in the best possible
way.
No surprises wrt the fix here. Just cram everything into a single struct that
can be reused across requests via a sync pool. Not particularly elegant, but
fairly limited, so I hope to get this in even if the impact should be minimal
outside of `walk` heavy integrations.
RegalLintingItself benchmark, main vs change. Ns/op and # allocs largely
unchanged, while the difference in B/op is rather massive for a simple
change!
```
348015056 ns/op 1260364874 B/op 31868705 allocs/op
343963417 ns/op 1122163613 B/op 31874931 allocs/op
```
Signed-off-by: Anders Eknert <anders.eknert@apple.com>
This PR contains fixes for all findings by the static analysis
tool zizmor, and reduces the attack surface available in our
GH Actions workflows by a decent margin.
The most notable change: our post-tag workflow now does not
use the actions cache, to prevent cache poisoning attacks.
This will drive up release publishing times, but eliminates
an attack vector on those releases.
Other changes:
- We also update all of our Slack alerting steps to use the
official slackapi/slack-github-action project, instead of the
archived project we were using before.
- A new `yaml` change detection category to has been added
to the `check-changes` job, allowing later jobs and steps
in the pull-request workflow to run conditionally on
YAML-based changes.
- An explicit linting job that runs the zizmor Github Actions
static analysis tool on the repo when YAML changes are
detected.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net>
The concern expressed in this comment has been determined to be unwarranted, so removing it to not cause future confusion.
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
Those tests never intended an Else return, but I stumbled upon one case
returning one:
```
$ go test ./v1/ast
--- FAIL: TestBaseDocEqIndexing (0.00s)
--- FAIL: TestBaseDocEqIndexing/functions:_glob.match_in_function,_arg_matching_non-glob_rule (0.00s)
index_test.go:823: unexpected else rule(s): map[glob_f(a) = true if { a = 12 }:[glob_f(a) = true if { a = 12 }]]
FAIL
FAIL github.com/open-policy-agent/opa/v1/ast 1.525s
FAIL
```
This change fixes it.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Discussed this with @srenatus, and we weren't sure if the value of
a `Location`s `File` got interned while parsing, or if we had to pay
for a unique string per Location. It turns out that they indeed share
the same memory location, which was "bad" as it otherwise would have
been an easy win. Oh well, one we already won then, I guess.
Signed-off-by: Anders Eknert <anders.eknert@apple.com>
This is almost what do in nightlies, but:
1. Not pulling docker images, trivy can do that -- we don't deal with
changing tags here (latest, edge), but concrete ones that don't get
overwritten in dockerhub ever.
2. It's a different, since we don't want nightly to turn red when there
is a vulnerability in the latest release, it's two separate concerns.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* docs: Add workflow to auto update regal docs
We want to automate the process of importing the
latest regal release's docs.
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
* docs: Remove review CC
This is not needed when we have reviewer set too.
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
---------
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
* topdown: fix BenchmarkFunctionArgumentCounts query
The benchmark was using `test.f(...)` syntax which OPA interprets as a
built-in function call, causing "unsupported built-in" errors. Rules from
compiled modules must be referenced via the `data` prefix.
Changed query from `test.f(...)` to `data.test.f(...)` to properly
reference the rule defined in the test package.
Signed-off-by: alex60217101990 <alex6021710@gmail.com>
* topdown: remove warmup stunts from benchmarks
Go's benchmark framework automatically handles warmup iterations through
its internal iteration count management.
Removed:
- Explicit warmup loops
- Manual GC() and ReadMemStats() calls
- Custom b.StopTimer() usage
- Hand-calculated allocPerOp and mallocsPerOp metrics
- b.ReportMetric() calls for standard metrics
Signed-off-by: alex60217101990 <alex6021710@gmail.com>
---------
Signed-off-by: alex60217101990 <alex6021710@gmail.com>
Anders Eknert