This allows us to show the results of example evaluation before the user
clicks evaluate, but also for chatbots to see the output when viewing
without interaction.
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
Abstract Unix sockets (paths prefixed with @) exist only in the
kernel socket namespace and have no filesystem representation.
Calling os.Chmod on them fails with "no such file or directory".
The --unix-socket-perm flag (added in v0.53.0 via PR #5888) defaults
to "755" and always triggers a chmod on the socket path after the
listener is created. This makes it impossible to use abstract Unix
sockets with OPA >= v0.53.0.
The fix adds a guard to skip chmod when the socket path starts with
"@", matching the existing guard that already skips os.Remove for
abstract sockets a few lines above.
Amp-Thread-ID: https://ampcode.com/threads/T-019d9906-2625-774e-8f1c-a0c288630be4
Signed-off-by: Ben Abderrazak <babderrazak@squareup.com>
Signed-off-by: Ben Apprederisse <bena@squareup.com>
Co-authored-by: Amp <amp@ampcode.com>
* docs/ecosystem: Add Vulnetix to the OPA Ecosystem
Vulnetix is a CLI security scanner that evaluates SCA, IaC, container,
secrets, SAST, license and SBOM findings using Rego, with 250+ built-in
rules and support for custom policy-as-code rule repositories. Adding it
to the ecosystem helps users discover an OPA-powered option for unified,
policy-driven security scanning.
Signed-off-by: Christopher Langton <chris@vulnetix.com>
* docs/ecosystem: Update Vulnetix entry links
Point the entry to the Vulnetix CLI repository and link to the custom
rules and CI/agent integration docs so readers can go directly to the
policy-as-code and integration material.
Signed-off-by: Christopher Langton <chris@vulnetix.com>
---------
Signed-off-by: Christopher Langton <chris@vulnetix.com>
This should make the tests pass in CI, giving us a green nightly build.
On the next OCP release, we can revert this and go back to pulling the
latest release/tag.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* topdown: add failing tests for graph.reachable_paths with shared ancestors
Adds a regression test (shared_ancestor) reproducing the bug reported in
#5871: given a graph where node 4 has edges to both 3 and 2, and 3 also
has an edge to 2, graph.reachable_paths from 5 drops the path [5,4,2,1].
Also corrects the expected result for the existing cycle_1022_3 test, which
was asserting the buggy output ([one,five,six] truncated) rather than the
correct complete path [one,five,six,seven,eight,three].
Signed-off-by: David Marne <david.marne@workiva.com>
* topdown: fix graph.reachable_paths dropping paths with shared ancestors
graph.reachable_paths had two bugs that caused paths to be silently dropped
when a node is reachable via multiple routes (diamond-shaped graphs).
Bug 1: the `reached` set was mutated and shared across sibling recursive
calls. After branch A finished traversal and added nodes to `reached`,
branch B would see those nodes as already visited and terminate early,
emitting a truncated path instead of continuing.
Fix: copy `reached` once per pathBuilder invocation and pass the copy to
all recursive calls. Each branch now has its own ancestor-only visited set.
Bug 2: ast.NewArray stores the slice it receives directly (elems: a)
without copying. When sibling calls appended to a shared backing array,
the in-place write by one sibling corrupted the already-committed path
term of a previous sibling.
Fix: pass append([]*ast.Term(nil), path...) to each recursive call,
giving each branch its own independent backing array.
Signed-off-by: David Marne <david.marne@workiva.com>
---------
Signed-off-by: David Marne <david.marne@workiva.com>
These currently fail, as laid out in #8461.
With this change, we'll return a controlled error, and don't let the
user run into an NPE or a cryptic error.
Fixes#8461.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
```rego
test_something if {
something
with input.foo as 1
with input.bar as 2
}
```
Would previously be formatted as:
```rego
test_something if {
something with input.foo as 1
with input.bar as 2
}
```
Now the formatter allows also the first `with` to be indented
as the rest if the first `with` is found below the line where
the expression begins.
Existing Rego files that have been formatted before should remain
the same when reformatted, and none of the existing formatter tests
have required changes. Only users who actively place the first `with`
in a group on a line below will now see that the formatter respects
their wish, and will indent it the same way as the following `with`s.
Signed-off-by: Anders Eknert <anders.eknert@apple.com>
Previously, initializing a new WASM resolver always used a background
context. This prevented callers from passing down an existing context
for timeouts, cancellation, or tracing.
This change introduces `NewWithContext` in `v1/resolver/wasm` which accepts
a context and propagates it to `Entrypoints()`. The existing `New`
function has been updated to wrap `NewWithContext` using a background
context to preserve backwards compatibility. `LoadWasmResolversFromStore`
has been updated to pass the provided context appropriately.
Signed-off-by: Dominik Schulz <dschulz@google.com>
* type checker: identify compatible type from reference
* Update unifiesObjectsStatic to allow static keys with dynamic properties to be optional, similar to unify1Object
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
- The tokenTLSConfig is cloned from DefaultTLSConfig(c) (which
includes RootCAs) and then InsecureSkipVerify is set explicitly from
c.AllowInsecureTLS, since DefaultTLSConfig only sets it when the service
URL is https, but the token URL is always https regardless.
- New test configures a service with tls.ca_cert pointing to the token
server's CA cert, without allow_insecure_tls. This directly reproduces
the bug report — before the fix, this would fail with x509: certificate
signed by unknown authority. Also removes some duplication we had
before.
Fixes#8473.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* distributedtracing: export Prometheus metrics via OTLP
Add support for pushing OPA's existing Prometheus metrics to an
OpenTelemetry collector via OTLP, eliminating the need for a dedicated
scraper sidecar. Uses the OTel Prometheus bridge to read from OPA's
prometheus.Registry and export through an OTLP metric exporter (gRPC
or HTTP), reusing the same address and TLS configuration as traces.
New config fields: distributed_tracing.metrics (bool, default false)
and distributed_tracing.metrics_export_interval_ms (int, default 60000).
Fixes#7591
Signed-off-by: Michael Munch <mm.munk@gmail.com>
* metricsexport: decouple metrics export into top-level config section
Extract metrics export from distributed_tracing into its own
metrics_export config section with independent type (otlp/grpc,
otlp/http), address, and TLS settings. This allows exporting
Prometheus metrics via OTLP without enabling tracing, and to a
different endpoint than traces.
- Extract shared TLS helpers into internal/tlsutil
- Add MetricsExport field to top-level Config
- Create internal/metricsexport package with Init, config parsing
- Remove metrics fields from distributedtracing
- Update runtime to call metricsexport.Init separately
- Move e2e tests to v1/test/e2e/metricsexport
- Add Metrics Export section to configuration docs
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Michael Munch <mm.munk@gmail.com>
* ci: retrigger checks
Signed-off-by: Michael Munch <mm.munk@gmail.com>
* go.mod: upgrade dependencies downgraded during rebase
Modules like containerd, go-sqlbuilder, OpenTelemetry, and golang.org/x/*
were at older versions than main after a rebase. Upgrade them to match or
exceed main.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Michael Munch <mm.munk@gmail.com>
* Update internal/distributedtracing/distributedtracing_test.go
Signed-off-by: Michael Munch <mm.munk@gmail.com>
---------
Signed-off-by: Michael Munch <mm.munk@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Move event status message to prominent banner at top of page.
Replace heading-only note as it was not clear.
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
We have fixed most of the broken links! But,
https://github.com/open-policy-agent/opa/issues/8464 is mostly not useful now
as we are checking the docs site internal links which are already checked at
build time which is done in PRs.
This change makes two jobs, one for the repo, and one for the docs site. The
OPA domain is ignored for website checks.
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
Charlie Egan