68eaef29dc
Add the latest videos to the README presentations section ( #8523 )
...
* Add the latest videos to the README presentations section
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
* support merge queues in files changed check
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
* zizmor ignore
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
* zizmor ignore on run line
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
* run PR checks as well so that the required PR check summary is run
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
* give github action lint permission to upload
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
---------
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-04-16 18:17:49 +00:00
069dc91cae
add merge_group build trigger to benchmarks ( #8522 )
...
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-04-16 10:48:16 -05:00
cd955f69d0
workflows: attempt to fix slack notifications
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-04-15 11:03:19 +02:00
ef9c47973b
workflows/nightly: use OCP ref (temporary workaround)
...
This should make the tests pass in CI, giving us a green nightly build.
On the next OCP release, we can revert this and go back to pulling the
latest release/tag.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-04-15 11:03:19 +02:00
159fe6b28d
workflows: fix nightly and release-vuln-check
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-04-15 09:17:01 +02:00
e7ccaed26f
benchmarks: bump nodejs (24 -> 25)
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-04-15 09:17:01 +02:00
a57f2ef42d
cicd: Split link checker into docs & repo checks ( #8492 )
...
We have fixed most of the broken links! But,
https://github.com/open-policy-agent/opa/issues/8464 is mostly not useful now
as we are checking the docs site internal links which are already checked at
build time which is done in PRs.
This change makes two jobs, one for the repo, and one for the docs site. The
OPA domain is ignored for website checks.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-04-07 15:05:44 +01:00
8479b69566
build(deps): bump actions/setup-go in the gha-dependencies group ( #8469 )
...
Bumps the gha-dependencies group with 1 update: [actions/setup-go](https://github.com/actions/setup-go ).
Updates `actions/setup-go` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/4b73464bb391d4059bd26b0524d20df3927bd417...4a3601121dd01d1626a1e23e37211e3254c1c06c )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-version: 6.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-01 09:32:00 -05:00
bad337a637
nightly: add OCP+Regal builds to catch breaking changes ( #8460 )
...
* nightly: add OCP build to catch breaking changes
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
* nightly: add Regal build + e2e test run w/ opa main
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
* .github: Add linter ignores for secrets-outside-env.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net >
---------
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
Signed-off-by: Philip Conrad <philip@chariot-chaser.net >
Co-authored-by: Philip Conrad <philip@chariot-chaser.net >
2026-04-01 08:23:49 +02:00
a9aaac3070
workflows: remove trivy from nightly+release-vuln-check
...
Rationale: it's been under attack and it's not clear if its benefits right
now outweigh the risks.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-03-30 14:27:52 +02:00
9fd6f93be1
build(deps): bump the gha-dependencies group with 5 updates ( #8440 )
...
Bumps the gha-dependencies group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action ) | `2.1.1` | `3.0.1` |
| [actions/download-artifact](https://github.com/actions/download-artifact ) | `8.0.0` | `8.0.1` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action ) | `3.12.0` | `4.0.0` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) | `0.5.0` | `0.5.2` |
| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action ) | `3.7.0` | `4.0.0` |
Updates `slackapi/slack-github-action` from 2.1.1 to 3.0.1
- [Release notes](https://github.com/slackapi/slack-github-action/releases )
- [Commits](https://github.com/slackapi/slack-github-action/compare/91efab103c0de0a537f72a35f6b8cda0ee76bf0a...af78098f536edbc4de71162a307590698245be95 )
Updates `actions/download-artifact` from 8.0.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c )
Updates `docker/setup-buildx-action` from 3.12.0 to 4.0.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases )
- [Commits](https://github.com/docker/setup-buildx-action/compare/8d2750c68a42422c14e847fe6c8ac0403b4cbd6f...4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd )
Updates `zizmorcore/zizmor-action` from 0.5.0 to 0.5.2
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d...71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 )
Updates `docker/setup-qemu-action` from 3.7.0 to 4.0.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases )
- [Commits](https://github.com/docker/setup-qemu-action/compare/c7c53464625b32c7a7e944ae62b3e17d2b600130...ce360397dd3f832beb865e1373c09c0e9f86d70a )
---
updated-dependencies:
- dependency-name: slackapi/slack-github-action
dependency-version: 3.0.1
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
- dependency-name: actions/download-artifact
dependency-version: 8.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gha-dependencies
- dependency-name: docker/setup-buildx-action
dependency-version: 4.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.5.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gha-dependencies
- dependency-name: docker/setup-qemu-action
dependency-version: 4.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-23 11:53:53 +01:00
654e445018
build(deps): bump the gha-dependencies group with 4 updates
...
Bumps the gha-dependencies group with 4 updates: [actions/setup-go](https://github.com/actions/setup-go ), [actions/setup-node](https://github.com/actions/setup-node ), [actions/upload-artifact](https://github.com/actions/upload-artifact ) and [actions/download-artifact](https://github.com/actions/download-artifact ).
Updates `actions/setup-go` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5...4b73464bb391d4059bd26b0524d20df3927bd417 )
Updates `actions/setup-node` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/6044e13b5dc448c55e2357c09f80417699197238...53b83947a5a98c8d113130e565377fae1a50d02f )
Updates `actions/upload-artifact` from 6.0.0 to 7.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f )
Updates `actions/download-artifact` from 7.0.0 to 8.0.0
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/37930b1c2abaa49bbe596cd826c3c89aef350131...70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-version: 6.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
- dependency-name: actions/setup-node
dependency-version: 6.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
- dependency-name: actions/upload-artifact
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
- dependency-name: actions/download-artifact
dependency-version: 8.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-10 09:37:08 +01:00
5116e8d7ab
gha: bump trivy-action
...
dependabot didn't do it because of our configured 7 day cooldown.
But hopefully this fixes the workflows that use it.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-03-10 09:36:41 +01:00
f205d9716c
nightly+release-vuln-check: add links to slack msg payloads
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-03-04 16:32:17 +01:00
c715c7caaf
build(deps): bump the gha-dependencies group with 3 updates
...
Bumps the gha-dependencies group with 3 updates: [github/codeql-action](https://github.com/github/codeql-action ), [lycheeverse/lychee-action](https://github.com/lycheeverse/lychee-action ) and [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ).
Updates `github/codeql-action` from 4.32.0 to 4.32.4
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/b20883b0cd1f46c72ae0ba6d1090936928f9fa30...89a39a4e59826350b863aa6b6252a07ad50cf83e )
Updates `lycheeverse/lychee-action` from 2.7.0 to 2.8.0
- [Release notes](https://github.com/lycheeverse/lychee-action/releases )
- [Commits](https://github.com/lycheeverse/lychee-action/compare/a8c4c7cb88f0c7386610c35eb25108e448569cb0...8646ba30535128ac92d33dfc9133794bfdd9b411 )
Updates `aquasecurity/trivy-action` from 0.34.0 to 0.34.1
- [Release notes](https://github.com/aquasecurity/trivy-action/releases )
- [Commits](https://github.com/aquasecurity/trivy-action/compare/c1824fd6edce30d7ab345a9989de00bbd46ef284...e368e328979b113139d6f9068e03accaed98a518 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.32.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gha-dependencies
- dependency-name: lycheeverse/lychee-action
dependency-version: 2.8.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
- dependency-name: aquasecurity/trivy-action
dependency-version: 0.34.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gha-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-01 18:44:20 +01:00
eb18827f62
fix release-vulnerability-check.yaml
...
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-02-26 21:14:37 +01:00
167df6b57a
fix nightly.yaml by moving secret to env ( #8381 )
...
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2026-02-26 13:32:46 -06:00
b4b04a6219
ci: Fix check-changes job skipping over YAML changes. ( #8377 )
...
This commit fixes a copy/paste error from #8356 that resulted
in the YAML detection logic of the `check-changes` job setting
the wrong result for the job step's yaml changes output.
This bug caused downstream jobs to not see that YAML files were
altered at all in a PR, and YAML-specific jobs like the linter
and zizmor passes would not be run.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net >
2026-02-25 11:11:28 -05:00
dc7995efe7
workflows/benchmark: persist credentials, we need them for pushing
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-02-24 14:35:42 +01:00
019086bc3c
ci: Harden and update all GH Actions workflows.
...
This PR contains fixes for all findings by the static analysis
tool zizmor, and reduces the attack surface available in our
GH Actions workflows by a decent margin.
The most notable change: our post-tag workflow now does not
use the actions cache, to prevent cache poisoning attacks.
This will drive up release publishing times, but eliminates
an attack vector on those releases.
Other changes:
- We also update all of our Slack alerting steps to use the
official slackapi/slack-github-action project, instead of the
archived project we were using before.
- A new `yaml` change detection category to has been added
to the `check-changes` job, allowing later jobs and steps
in the pull-request workflow to run conditionally on
YAML-based changes.
- An explicit linting job that runs the zizmor Github Actions
static analysis tool on the repo when YAML changes are
detected.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net >
2026-02-23 07:00:32 +01:00
01229ed520
workflows: skip docs/ in release-vulnerability-check
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-02-18 11:17:50 +01:00
43fca92d4b
workflows: bump trivy-action (0.34.0, trivy 0.69.1)
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-02-18 11:17:50 +01:00
fd9c46c47a
workflows: add nightly vuln checks for released versions/images
...
This is almost what do in nightlies, but:
1. Not pulling docker images, trivy can do that -- we don't deal with
changing tags here (latest, edge), but concrete ones that don't get
overwritten in dockerhub ever.
2. It's a different, since we don't want nightly to turn red when there
is a vulnerability in the latest release, it's two separate concerns.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-02-18 09:28:41 +01:00
af61658027
docs: Add workflow to auto update Regal docs ( #8318 )
...
* docs: Add workflow to auto update regal docs
We want to automate the process of importing the
latest regal release's docs.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* docs: Remove review CC
This is not needed when we have reviewer set too.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
---------
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-02-16 11:47:42 +00:00
c256ef1f39
build: bump golang 1.25.7 -> 1.26.0
...
And raise `go` version in go.mod. 1.24.x is no longer supported.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2026-02-12 08:42:05 +01:00
b29b1dad76
docs/website: Markdown linting and spell checking for documentation ( #8292 )
...
* Add markdownlint tooling to docs
Install markdownlint-cli2 with configuration file and make targets for
auto fix etc too.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* Autofixable markdown issues
mainly, replace tabs with spaces for consistent 2-space indentation
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* MD059
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* Fix a number of <link> issues
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* MD041
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* MD041
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* MD046
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* MD025
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* MD052
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* MD028
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* MD001
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* Add GH action check in PRs
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* Use 4 spaces for tabs
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* Use 4 spaces for tabs
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* docs: Add spell checking using Vale
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* Correct comment for space indentation rule
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
---------
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-02-05 10:20:13 +00:00
b1eb646ddc
docs/website: Add formatting and linting checks ( #8288 )
...
* Update baseline-browser-mapping to version 2.9.19
Addresses issue in build
[baseline-browser-mapping] The data in this module is over two
months old. To ensure accurate Baseline data, please update: `npm i
baseline-browser-mapping@latest -D`
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* Add fmt and lint config for docs
This is based on dprint and eslint. Some vendored paths are ignored.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* Format and lint docs project
Markdown linting will be added in another PR.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
---------
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-02-03 17:01:54 +00:00
e86c554932
build(deps): bump the gha-dependencies group with 5 updates
...
Bumps the gha-dependencies group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout ) | `5.0.0` | `6.0.2` |
| [actions/setup-go](https://github.com/actions/setup-go ) | `6.0.0` | `6.2.0` |
| [actions/setup-node](https://github.com/actions/setup-node ) | `6.1.0` | `6.2.0` |
| [github/codeql-action](https://github.com/github/codeql-action ) | `4.31.9` | `4.32.0` |
| [mlugg/setup-zig](https://github.com/mlugg/setup-zig ) | `2.1.0` | `2.2.1` |
Updates `actions/checkout` from 5.0.0 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases )
- [Commits](https://github.com/actions/checkout/compare/v5...v6.0.2 )
Updates `actions/setup-go` from 6.0.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/v6...7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 )
Updates `actions/setup-node` from 6.1.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/395ad3262231945c25e8478fd5baf05154b1d79f...6044e13b5dc448c55e2357c09f80417699197238 )
Updates `github/codeql-action` from 4.31.9 to 4.32.0
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/5d4e8d1aca955e8d8589aabd499c5cae939e33c7...b20883b0cd1f46c72ae0ba6d1090936928f9fa30 )
Updates `mlugg/setup-zig` from 2.1.0 to 2.2.1
- [Release notes](https://github.com/mlugg/setup-zig/releases )
- [Commits](https://github.com/mlugg/setup-zig/compare/fa65c4058643678a4e4a9a60513944a7d8d35440...d1434d08867e3ee9daa34448df10607b98908d29 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.2
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
- dependency-name: actions/setup-go
dependency-version: 6.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
- dependency-name: actions/setup-node
dependency-version: 6.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
- dependency-name: github/codeql-action
dependency-version: 4.32.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
- dependency-name: mlugg/setup-zig
dependency-version: 2.2.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-02 13:22:37 +01:00
d0350b326e
Add array.flatten built-in function ( #8232 )
...
Originally meant to be `array.concat_n`, but this name is better
as the behavior of this function differs from `array.concat` —
namely that `array.flatten` accepts any type of valued in the
input array. Only arrays are however flattened, and the rest
are appended directly to the flattened output.
Note that this function only flattens at the topmost level of
the input array — not recursively! A cursory look
at a few other languages suggest a single level is the common case.
But if others feel we should flstten more, I'm happy to make an update.
The C code for a Wasm implementstion here is cowboy coded, and
I did not manage to run the tests on my machine due to some
`docker` <-> `container` differences. I mostly just imitated
the existing code in the array category. I doubt it'll work
on the first try, but only CI can judge me.
Also:
- Remove `opa fmt` step from the Rego CI step, as this is done by
Regal anyway a little later in the list of tasks.
- Replace some hard-coded `docker` names in the `Makefile` with `$(DOCKER)`
- Added name of built-in function missing to the unsupportedBuiltinErr
error, as it has happened a few times now that I've used `:=` in a
query, and had no clue what built-in it referred to.
Fixes #8226
Signed-off-by: Anders Eknert <anders.eknert@apple.com >
2026-01-27 21:46:11 +00:00
bcd57a207c
Decoupled the Rego job check from the Go job checks in the Github PR workflow ( #8203 )
...
Added coverage for the new Rego check
Signed-off-by: seanledford <s_ledford@apple.com >
2026-01-12 17:27:36 +00:00
73ea88a3ad
build: Migrate PR check to OPA policy ( #8183 )
...
Signed-off-by: seanledford <s_ledford@apple.com >
2026-01-09 18:10:33 +01:00
6601188c64
runtime: Correct naming & docs for version checking ( #8191 )
...
* runtime: Correct naming of version checking code
Rename telemetry functionality to version checking to accurately reflect
current behavior following
https://github.com/open-policy-agent/opa/pull/7756 .
The system only checks GitHub releases for version updates without sending
any data about the OPA instance and so the privacy docs have been updated too.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
* Make WithTelemetryGatherers a no-op
Deprecate WithTelemetryGatherers since telemetry gathering has been removed.
The function now returns a no-op to maintain API compatibility without
breaking existing code that might uses it.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
---------
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-01-08 10:25:38 +00:00
d10b4f59b4
build: Run go get against main to spot redacted
...
This cause an issue where a transitive dep was redacted
https://github.com/klauspost/compress/issues/1114
So this might help us catch it earlier next time before release day.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2026-01-05 10:17:20 +01:00
3e24c899fc
build(deps): bump the gha-dependencies group with 9 updates
...
Bumps the gha-dependencies group with 9 updates:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout ) | `5.0.0` | `6.0.1` |
| [actions/setup-go](https://github.com/actions/setup-go ) | `6.0.0` | `6.1.0` |
| [actions/setup-node](https://github.com/actions/setup-node ) | `6.0.0` | `6.1.0` |
| [github/codeql-action](https://github.com/github/codeql-action ) | `4.31.2` | `4.31.9` |
| [mlugg/setup-zig](https://github.com/mlugg/setup-zig ) | `2.0.5` | `2.1.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact ) | `5.0.0` | `6.0.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact ) | `6.0.0` | `7.0.0` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action ) | `3.11.1` | `3.12.0` |
| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action ) | `3.6.0` | `3.7.0` |
Updates `actions/checkout` from 5.0.0 to 6.0.1
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/08c6903cd8c0fde910a37f88322edcfb5dd907a8...8e8c483db84b4bee98b60c0593521ed34d9990e8 )
Updates `actions/setup-go` from 6.0.0 to 6.1.0
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/44694675825211faa026b3c33043df3e48a5fa00...4dc6199c7b1a012772edbd06daecab0f50c9053c )
Updates `actions/setup-node` from 6.0.0 to 6.1.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/2028fbc5c25fe9cf00d9f06a71cc4710d4507903...395ad3262231945c25e8478fd5baf05154b1d79f )
Updates `github/codeql-action` from 4.31.2 to 4.31.9
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/0499de31b99561a6d14a36a5f662c2a54f91beee...5d4e8d1aca955e8d8589aabd499c5cae939e33c7 )
Updates `mlugg/setup-zig` from 2.0.5 to 2.1.0
- [Release notes](https://github.com/mlugg/setup-zig/releases )
- [Commits](https://github.com/mlugg/setup-zig/compare/8d6198c65fb0feaa111df26e6b467fea8345e46f...fa65c4058643678a4e4a9a60513944a7d8d35440 )
Updates `actions/upload-artifact` from 5.0.0 to 6.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/330a01c490aca151604b8cf639adc76d48f6c5d4...b7c566a772e6b6bfb58ed0dc250532a479d7789f )
Updates `actions/download-artifact` from 6.0.0 to 7.0.0
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/018cc2cf5baa6db3ef3c5f8a56943fffe632ef53...37930b1c2abaa49bbe596cd826c3c89aef350131 )
Updates `docker/setup-buildx-action` from 3.11.1 to 3.12.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases )
- [Commits](https://github.com/docker/setup-buildx-action/compare/e468171a9de216ec08956ac3ada2f0791b6bd435...8d2750c68a42422c14e847fe6c8ac0403b4cbd6f )
Updates `docker/setup-qemu-action` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases )
- [Commits](https://github.com/docker/setup-qemu-action/compare/29109295f81e9208d7d86ff1c6c12d2833863392...c7c53464625b32c7a7e944ae62b3e17d2b600130 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.1
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
- dependency-name: actions/setup-go
dependency-version: 6.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
- dependency-name: actions/setup-node
dependency-version: 6.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
- dependency-name: github/codeql-action
dependency-version: 4.31.9
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: gha-dependencies
- dependency-name: mlugg/setup-zig
dependency-version: 2.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
- dependency-name: actions/upload-artifact
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
- dependency-name: actions/download-artifact
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
- dependency-name: docker/setup-buildx-action
dependency-version: 3.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
- dependency-name: docker/setup-qemu-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-01-05 08:10:30 +01:00
455db3bf90
benchmarks: install node v24
...
Because that's what notebook-kit expects.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2025-12-11 13:47:38 +01:00
4c67668759
workflow: integrate benchmarks notebook
...
This will bring an extra commit, as that's the way to do gh-pages
deployments.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2025-12-11 13:16:09 +01:00
982c9d326e
workflows/pull-request: don't upload artifact that's never downloaded
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2025-12-08 16:53:18 +01:00
02ce64bc2b
workflows/pull-request: don't build tag build in container
...
The GO_FLAGS setup through recursive Make invocations is a hassle, and we don't
use the resulting binaries anyways -- we just want to see that the build works.
We get that from a plain, on-the-runner build sans docker, too.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2025-12-08 16:53:18 +01:00
ba6824774e
download: fix when compiling with tag opa_no_oci
...
The Makefile adjustments were needed to have the test compile actually work in CI.
Previously, it was just believed to work...
Fixes #8070 .
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2025-12-08 16:53:18 +01:00
2a06682349
workflows/benchmark: fix fetch-depth
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2025-12-02 09:30:22 +01:00
340958fb2b
workflows/benchmarks: checkout code first
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2025-12-02 09:21:54 +01:00
0f3af00015
workflows/benchmark: only run for go-changes
...
Copying over a subset of the logic we use for PRs.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2025-12-02 09:19:41 +01:00
da64130e08
workflows: skip all tests in benchmarks run
...
Previously we MAY have run benchmarks with dashes in them, I'm not sure.
Gobenchdata makes it hard to see what's going on sometimes (most times).
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2025-11-28 10:30:16 +01:00
545de92907
workflow: add 'Benchmarks' workflow
...
For every merged PR, we'll run all benchmarks, record the results, and feed them
into git's `benchmarks` branch. There, gobenchdata can be used to look at them.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2025-11-25 14:32:18 +01:00
6be061f27e
workflows/pull-request: update macos versions
...
Because there was a warning about macos-13 going away displayed on github.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2025-11-10 09:49:03 +01:00
3f2e3658cc
workflows/pull-request: fix indentation of 'if:' for setup-go
...
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com >
2025-11-05 09:54:53 +01:00
44a17cd086
build(deps): bump the gha-dependencies group with 7 updates ( #8006 )
...
Bumps the gha-dependencies group with 7 updates:
| Package | From | To |
| --- | --- | --- |
| [github/codeql-action](https://github.com/github/codeql-action ) | `3.30.5` | `4.31.2` |
| [lycheeverse/lychee-action](https://github.com/lycheeverse/lychee-action ) | `2.6.1` | `2.7.0` |
| [peter-evans/create-issue-from-file](https://github.com/peter-evans/create-issue-from-file ) | `5.0.1` | `6.0.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact ) | `4.6.2` | `5.0.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact ) | `5.0.0` | `6.0.0` |
| [actions/setup-node](https://github.com/actions/setup-node ) | `5.0.0` | `6.0.0` |
| [open-policy-agent/setup-opa](https://github.com/open-policy-agent/setup-opa ) | `2.2.0` | `2.3.0` |
Updates `github/codeql-action` from 3.30.5 to 4.31.2
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/3599b3baa15b485a2e49ef411a7a4bb2452e7f93...0499de31b99561a6d14a36a5f662c2a54f91beee )
Updates `lycheeverse/lychee-action` from 2.6.1 to 2.7.0
- [Release notes](https://github.com/lycheeverse/lychee-action/releases )
- [Commits](https://github.com/lycheeverse/lychee-action/compare/885c65f3dc543b57c898c8099f4e08c8afd178a2...a8c4c7cb88f0c7386610c35eb25108e448569cb0 )
Updates `peter-evans/create-issue-from-file` from 5.0.1 to 6.0.0
- [Release notes](https://github.com/peter-evans/create-issue-from-file/releases )
- [Commits](https://github.com/peter-evans/create-issue-from-file/compare/e8ef132d6df98ed982188e460ebb3b5d4ef3a9cd...fca9117c27cdc29c6c4db3b86c48e4115a786710 )
Updates `actions/upload-artifact` from 4.6.2 to 5.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...330a01c490aca151604b8cf639adc76d48f6c5d4 )
Updates `actions/download-artifact` from 5.0.0 to 6.0.0
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/634f93cb2916e3fdff6788551b99b062d0335ce0...018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 )
Updates `actions/setup-node` from 5.0.0 to 6.0.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/a0853c24544627f65ddf259abe73b1d18a591444...2028fbc5c25fe9cf00d9f06a71cc4710d4507903 )
Updates `open-policy-agent/setup-opa` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/open-policy-agent/setup-opa/releases )
- [Commits](https://github.com/open-policy-agent/setup-opa/compare/34a30e8a924d1b03ce2cf7abe97250bbb1f332b5...950f159a49aa91f9323f36f1de81c7f6b5de9576 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.31.2
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
- dependency-name: lycheeverse/lychee-action
dependency-version: 2.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
- dependency-name: peter-evans/create-issue-from-file
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
- dependency-name: actions/upload-artifact
dependency-version: 5.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
- dependency-name: actions/download-artifact
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
- dependency-name: actions/setup-node
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: gha-dependencies
- dependency-name: open-policy-agent/setup-opa
dependency-version: 2.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gha-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-03 14:20:55 +01:00
882b28738c
website: Show latest release rather than edge ( #7988 )
...
Reverts https://github.com/open-policy-agent/opa/pull/7848 which was
done to allow new content to land faster.
Signed-off-by: Charlie Egan <charlie_egan@apple.com >
2025-10-29 11:19:23 +00:00
9cdbe568da
fix "Post Merge": setup go for ci-build-windows ( #7987 )
...
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2025-10-20 13:29:55 -05:00
62e3e09e5d
hurray! ( #7984 )
...
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com >
2025-10-17 13:17:33 -05:00
Sebastian Spaink