* Update baseline-browser-mapping to version 2.9.19
Addresses issue in build
[baseline-browser-mapping] The data in this module is over two
months old. To ensure accurate Baseline data, please update: `npm i
baseline-browser-mapping@latest -D`
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
* Add fmt and lint config for docs
This is based on dprint and eslint. Some vendored paths are ignored.
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
* Format and lint docs project
Markdown linting will be added in another PR.
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
---------
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
This action triggers on the first of the month, but seemed to have some
issues where the results were not shown in the issue.
I've tried to fix this and the existing errors i found running the tool
locally.
Fixes https://github.com/open-policy-agent/opa/issues/7741
Signed-off-by: Charlie Egan <charlie@styra.com>
This change updates the OPA release process and introduces the
creation of a release candidate prior to the stable release.
The goal is to minimize bugs and regressions in the stable
release and also give users early access to test out features
and bug fixes that will end up in the stable release.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Initial support for #4518.
Configuration uses the 'services' config for registries, via the "type: oci" field.
Bundles configured to pull from that service will then use OCI.
```
services:
ghcr-registry:
url: https://ghcr.io
type: oci
bundles:
authz:
service: ghcr-registry
resource: ghcr.io/${ORGANIZATION}/${REPOSITORY}:${TAG}
persist: true
polling:
min_delay_seconds: 60
max_delay_seconds: 120
persistence_directory: ${PERSISTENCE_PATH}
```
Service credentials are supported: if you want to pull from a private registry,
use
```
services:
ghcr-registry:
url: https://ghcr.io
type: oci
credentials:
bearer:
token: ${GH_PAT}
```
If no `persistence_directory` is configured, the data is stored in a directory under /tmp.
See docs/devel/OCI.md for manual steps to test this feature with some
OCI registry (like ghcr.io).
Signed-off-by: carabasdaniel <dani@aserto.com>
This URL is tied to the branch name which we changed to main a few
months ago. Needed to update the URL.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This is taken as-is from CONTRIBUTING.md for starters. The subsection
markup has been adjusted as there can only be one "# header 1" in a
document. Also done some light copy-editing.
Also adds the DEVELOPMENT.md content, slightly reformatted because of
bugs in our old hugo version. Code blocks in lists would look all wonky.
Both CONTRIBUTING.md and DEVELOPMENT.md now refer to the corresponding
website sections. As of now, it'll be `edge`, we can flip it to `latest`
after the next release.
Fixes#3751.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
The release patch will include a new file in the repo so we need to
use git add to include that file.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously we had some required configuration for the Github Actions,
and forks of OPA would need to set them _and_ have the underlying
infra configured (eg, docker registries, s3 bucket, etc).
Now it will check if the secrets are set, and if any required ones
are missing it will skip the steps.
This significantly lowers the bar for OPA forks to be able to run the
normal action workflows without getting errors. The only lost
functionality is primarily around publishing release assets, which
is not required for dev forks, and other forks can opt int to pieces
they care about (eg, only want to publish docker images and no
s3 release assets).
Signed-off-by: Patrick East <east.patrick@gmail.com>
We previously supported overriding via an environment variable, but
this meant for anyone who wanted to run their own telemetry endpoint
they would _always_ have to specify it while running their OPA's.
This change allows for someone to build OPA and encode the custom
url as the default. Ex:
```
make build TELEMETRY_URL=http://localhost:9876/custom/
```
Signed-off-by: Patrick East <east.patrick@gmail.com>
We are using a 3rd party action to simplify this. It appears to be
relatively well used, and the code looked pretty safe. It only has
access to the slack webhook secret, which is itself restricted in
permissions, so the risk is minimal.
It is configured to post a message for jobs that fail to the OPA
slack in the #development channel.
Signed-off-by: Patrick East <east.patrick@gmail.com>
With the new GitHub actions workflows the steps changed for releasing
bugfix changes. This commit updates to the latest steps and makes a
few clarifications/corrections.
Signed-off-by: Patrick East <east.patrick@gmail.com>
We will run the golang race detector nightly (to start with.. we'll
adjust the workflow as needed).
One thing to note is that currently cgo is required for the race
detector, so we have to enable it when running this make target.
Fixes: #2388
Signed-off-by: Patrick East <east.patrick@gmail.com>
This includes some refactors to the build steps. High level items:
* Add variables for DOCKER_IMAGE, S3_RELEASE_BUCKET to allow for forks
of OPA to re-use the GitHub actions with their own s3 buckets and
docker orgs/image names.
* Unify the release build steps to use `make release` and the binaries
being located under `_release/$(VERSION)`. All CI targets now rely
on binaries being in that `RELEASE_DIR`, including image building
steps The `make build` target is unaffected.
* Add a wrapper to allow the CI to run the various golang target
stages separately, but sharing the same docker configuration.
* Conditionally specify `-it` for docker run commands based on whether
A tty is available.
* Added scripts to automate drafting a release with binary assets vi
the `hub` CLI.
* The release process triggered on a tag being pushed will now use the
same binaries from `make release` for the docker images as well as
the ones attached to the release (which are available under
https://openpolicyagent.org/downloads/).
The actions themselves are split into 3 workflows:
pull-request.yaml:
Triggers on pull requests. This will run all the normal tests/checks
as before on Travis, however they are now split into separate jobs.
In addition to what was done on Travis we will now have Codecov
results included.
post-merge.yaml:
Triggers after a change is pushed to master. This will run tests and
build+publish the `edge` and `dev` artifacts to dockerhub and s3.
post-tag.yaml:
Triggers after a tag has been pushed. Similar to post-merge.yaml it
will run tests and build+publish release artifacts (for the tagged
version). It will also create a draft release on GitHub with the
same artifacts and notes from the CHANGELOG.md. If a release already
exists it will be updated to include the assets, however the release
notes will _not_ be added.
The RELEASE.md steps have been updated and include notes on the new
steps.
Signed-off-by: Patrick East <east.patrick@gmail.com>
I realized the documented instructions, while valid, were not what I
have actually been doing (which IMO is both easier and produces a better
end result). This updates the steps to include using the helper to
generate the release patch and updating the CHANGELOG on both
branches.
Signed-off-by: Patrick East <east.patrick@gmail.com>
Adds some additional links on some workflow steps and removes an older
unused section.
There is also a little bit more detail on the desired commit message
format.
Signed-off-by: Patrick East <east.patrick@gmail.com>
This commit replaces the existing PEG generated parser with a parser
implemented by hand. The new parser is more efficient (avoiding old
problems with pathological input cases like {{{{{{{{{}}}}}}}} and
deeply-nested composites in general) and offers better opportunities
for improved error reporting (which has been improved already but
there is still room to grow.)
During the test process of implementing the new parser, we identified
a few issues that were present in the old parser. Those issues are
fixed by this commit.
Fixes#1251Fixes#501Fixes#2198Fixes#2199Fixes#2200Fixes#2201Fixes#2202Fixes#2203
Co-authored-by: Torin Sandall <torinsandall@gmail.com>
Co-authored-by: Patrick East <east.patrick@gmail.com>
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Signed-off-by: Patrick East <east.patrick@gmail.com>
This adds in a new CLI sub command `opa bench` which will load
and evaluate similar to `opa eval` but will perform benchmark testing
of the query.
There is also a new `--bench` option for `opa test` which will
similarly perform benchmarking, except on the unit tests.
Both use the golang testing frameworks benchmark tooling, and the
output format is compliant with the go benchmark standard when using
the newly added `gobench` output format option.
They both support specifying a `--count` to run the benchmark a
number of times and a `--benchmem` option to report memory statistics.
To help enable using the `opa test` command better with the benchmark
option there is now a `--run`/`-r` option that can be provided to
specify a regex for what test cases should be run. The regex supports
anything that is supported by re2:
https://github.com/google/re2/wiki/Syntax
These changes required updating to Go 1.13 to get the ability to
report custom metrics with the benchmark results
https://golang.org/pkg/testing/#B.ReportMetric To get Netlify on board
we needed to add a `.go-version` file to the root of the repo. This is
now the single source of truth for the OPA golang version.
Fixes: #1424
Signed-off-by: Patrick East <east.patrick@gmail.com>
This switches to use goimports configured for the opa directory to
do the formatting checks (which now includes ordering of imports).
It will _not_ change imports, only the order of them.
Signed-off-by: Patrick East <east.patrick@gmail.com>
As discussed in #1639.
Note that .dockerignore had to be changed as to *not* skip what's needed
for the build: vendor, obviously, and .git for the compiled-in version
information.
parts:
- .travis.yml: don't bother about golang anymore
- docs/devel/DEVELOPMENT.md: update
- Makefile: update hint
Signed-off-by: Stephan Renatus <srenatus@chef.io>
The release-builder image is no longer required because we only need
the base Go image to build the OPA binaries. The nodejs dependency was
only required for the docs which are handled by netlify now.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
The process is pretty easy, just add a new line in RELEASES with the
version number. Once that git tag is available it will start to show
up on subsequent builds.
Signed-off-by: Patrick East <east.patrick@gmail.com>
Charlie Egan