Let's see if this works, it's a bit experimental at this point.
The twist comparred to how it's been done in EOPA (for example) is that
we're running the benchmarks post-merge, and report back if at the end
we find a failing check. This way, the PR goes green without having to
wait for the benchmarks, but there's still a connection between PR and
benchmark.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* e2e/cli: add test for debug `print()` logging
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* ci: add *.txtar to "golang_change_suffixes"
This is so that e2e/cli testscript definitions cause CI runs.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
---------
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
We have fixed most of the broken links! But,
https://github.com/open-policy-agent/opa/issues/8464 is mostly not useful now
as we are checking the docs site internal links which are already checked at
build time which is done in PRs.
This change makes two jobs, one for the repo, and one for the docs site. The
OPA domain is ignored for website checks.
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
Disabled by default. To enable, `not` future keyword must be present in capabilities and imported into Rego module.
Implements: #8391
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
The testcase generator had a bug where very large numbers would be
parsed incorrectly, truncating the lower bits off their values.
This was discovered to be caused by the YAML library defaulting
to parsing all numeric values into floating point numbers, which
lose precision at larger sizes.
The fix was to provide the YAML unmarshaling function with the
appropriate equivalent of `(*json.Decoder).UseNumber()` at the
callsite. This causes the YAML library to use `json.Number`
types by default, just as we expect almost everywhere else in
Rego.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net>
This PR contains fixes for all findings by the static analysis
tool zizmor, and reduces the attack surface available in our
GH Actions workflows by a decent margin.
The most notable change: our post-tag workflow now does not
use the actions cache, to prevent cache poisoning attacks.
This will drive up release publishing times, but eliminates
an attack vector on those releases.
Other changes:
- We also update all of our Slack alerting steps to use the
official slackapi/slack-github-action project, instead of the
archived project we were using before.
- A new `yaml` change detection category to has been added
to the `check-changes` job, allowing later jobs and steps
in the pull-request workflow to run conditionally on
YAML-based changes.
- An explicit linting job that runs the zizmor Github Actions
static analysis tool on the repo when YAML changes are
detected.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net>
Due the way that wasmtime-go does its versioning, it seems to fly under
the radar of dependabot: that will never propose major version bumps, I
suppose.
Signed-off-by: Stephan Renatus <stephan@styra.com>
* build: bump go (1.24.6 -> 1.24.7)
https://groups.google.com/g/golang-announce/c/PtW9VW21NPs
* ci: run go stuff if .go-version changed
* Makefile: change debian base image
There is no 1.24.7-bullseye, because that distribution is EOL
* build: remove GOOS from Makefile call
Some change either in the debian trixie golang image, or in golang's
toolchain made this necessary: Prior to this commit, `GOOS` was set to
windows, causing a cross-build. We don't want a crossbuild for this
utility, we want to invoke the Linux binary (on the Linux host) to do
its job on a Windows binary (cross-built from the Linux host).
---------
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
The assertions are stricter now, e.g. we're also checking that nothing
is emitted to stderr.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This commit fixes an issue when upgrading codebases to OPA v1.7.0.
In PR #7797, we introduced the ability to provide "branding"
information in OPA commands and help messages, which would
allow easier customized OPA distributions in the future.
However, this changeset removed the public symbol `cmd.RootCommand`,
and required refactoring to use `cmd.Command`, which breaks automated
upgrades, such as those done by Dependabot.
This PR adds back the missing symbol, with the original/default "OPA"
branding provided. This should allow existing codebases to upgrade
without requiring any code changes.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net>
This change allows users that build their own executable or "spin" of
OPA to give it a name, and have it reference itself properly in help
texts.
It's a vanity thing, but I think some people would appreciate it, hat
tip to the international association of pedants.
Signed-off-by: Stephan Renatus <stephan@styra.com>
Co-authored-by: kevinstyra <83973046+kevinstyra@users.noreply.github.com>
Closing the circle here, or something.
Not a lot of Rego used in OPA yet, but some in examples and tests. The little
there is should be linted though, and it'd be good if any new addition of policies got
linted by default. But more than anything, the "ignore configuration" provided here
avoids having developers seeing thousands of issues reported by Regal when they
open the OPA project in VS Code or their editor of choice.
Someone might want to look into un-ignoring the doc directory at some point, as it's
probably a good idea to have the docs follow best practices.
Signed-off-by: Anders Eknert <anders@styra.com>
The new command is based on generating JSON for docusaurus consumption
rather than markdown. This is less error prone as manipulation of
markdown is better contained.
Signed-off-by: Charlie Egan <charlie@styra.com>
Some things added on this branch:
- icons and client logos at known paths
- some spam redirects
- some redirects for docs/latest/foo /docs/foo
- redirects for the two ‘moved’ pages (k8s and envoy intros)
I am going to be monitoring the traffic this week on Netlify to make
sure we have a good coverage with redirects where needed.
We also now prompt users to file issues directly from the 404 pages
which should help flag things we miss too.
Brace yourselves! For there are many touched files here. No changes
in semantics however.
Spent a long time trying out the various optional rules gocritic
provides, and settled for a few of them. There are more I really
like, but that would take many hours to address across the codebase.
Perhaps others find gocritic too pedantic? If so, we can merge the
fixes without enabling the rule.
Signed-off-by: Anders Eknert <anders@styra.com>
And update code to conform to the rule.
- Replace unnecessary fmt.Sprintf with string concatenation
- Replace fmt.Sprint with more efficient strconv.Itoa
- Replace static fmt.Errorf calls with more efficient errors.New
Thanks @srenatus for pushing me down this rabbit hole!
Signed-off-by: Anders Eknert <anders@styra.com>
All packages, except for `cmd` and `internal`, have been moved into a new `v1` root package.
Old packages are kept for backwards-compatibility reasons. All contained code is replaced with simple type aliases and proxy functions to `v1` implementations.
Old packages default to the Rego v0 syntax, new `v1` packages default to the Rego v1 syntax.
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
This change updates the WASM Rego test generation docker
command to address CVE-2022-24765 in Git which could cause
it to execute arbitrary commands.
The error was seen when running the `make wasm-rego-test` target on
darwin/arm64.
Fixes: #6703
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Not sure where to put this really as we don't have much in terms of docs
on the CLI outside of the generated ones. If there are more places where
this could be mentioned, let me know and I'll add it there too.
Signed-off-by: Anders Eknert <anders@styra.com>
At the moment we have some entries with . chars in their ids, this makes
the hugo page look up break, so now these are validated to be
sausage-case-values.
Signed-off-by: Charlie Egan <charlie@styra.com>
The `hub` tool is deprecated in favor of the GitHub CLI and
is removed from GitHub's action runner images.
Fixes: #6326
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
* We are having trouble managing the complexity of having ecosystem pages shown in the versioned area of the OPA docs site (see website: link ecosystem from edge #6170)
* We have invested in the OPA ecosystem data recently and it makes sense to make it more prominent.
* The data in the OPA Ecosystem is harder to use when nested in docs as some Hugo functions are unavailable to nested sections.
This PR implements a solution by:
* Pages that were under /docs/version/ecosystem, /docs/version/integrations etc have been moved to /ecosystem and /integrations.
* Redirects have been created for the old pages in the netlify config.
Signed-off-by: Charlie Egan <charlie@styra.com>
This PR makes it possible to browse integrations, organizations and related softwares. Previously, these details were only available as modals on the ecosystem page.
There are also some changes to the policy enforcement on the docs content, the validation rules are much the same but have been updated to reflect that the content is stored in a new place. I have used some generated JSON in Hugo rather than using GitHub api requests to validate the files since it's A) faster, B) I think more simple, and C) easier to get Hugo to process the markdown frontmatter.
Much of the hackery in this PR (Hugo function partials to look up sets of files and get the data from them) is due to the fact that we can't use Hugo's native sections feature. All of our content is nested under docs, this means that all our pages are in the same section so custom lookups have been implemented as function partials instead to work around this.
Signed-off-by: Charlie Egan <charlie@styra.com>
This commit fixes an issue around Windows paths in `opa inspect`, and
updates the `build/binary-smoke-test.sh` script to check for the problem
in the future.
Fixes: #5503
Signed-off-by: harikannan512 <harikannan512@gmail.com>
Instead of a hard-coded "/", we're now using os.PathSeparator to process
the file path. It's also cleaned before displaying.
Fixes part of #5503.
Signed-off-by: shm12 <shm.bia@gmail.com>
In situations involving PE, it's possible that we walk over an AST that
contains objects taken from the store. With the lazy-objects
optimization, those objects had been neglected: the walker code only
cared for `*object`, not the `Object` interface, for performance reasons.
Now, we'll include the `Object` interface, which covers our lazy
objects, and thus include them in AST walks.
Fixes#5479.
* smoke test: update bundle to use some data
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Before, the commit integrating the 0.46.2 and 0.47.1 patch releases failed to
trigger a website build.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Stephan Renatus