v0.3.0

Added

• regodrill check: parses and compiles Rego files like opa check of the same OPA version (1.21.3), with the same output for --format pretty|json, --v0-compatible, --max-errors and --ignore. Editors can check Rego with the regodrill binary alone: the Rego Syntax Support extension uses it for the Rego embedded in Gatekeeper templates when opa is not installed. CI compares both commands byte for byte (testdata/check). #13

Fixed

• Every release asset has a build provenance attestation, the WebAssembly build included: 0.1.0 and 0.2.0 attest only the native archives and checksums.txt. #12

See the changelog. Full diff: v0.2.0...v0.3.0.

Install

Download the archive for your platform below, or:

$ go install github.com/adamaKomi/regodrill/cmd/regodrill@v0.3.0

regodrill_0.3.0.wasm is a wasip1 build for environments that can only run WebAssembly (same verdicts, slower, no parallelism).

Verify

$ sha256sum -c checksums.txt --ignore-missing
$ gh attestation verify regodrill_0.3.0_linux_amd64.tar.gz --repo adamaKomi/regodrill

Built with OPA 1.21.3 as a library.

v0.2.0

Added

• ruleLine in the JSON report: the line where each mutant's rule definition starts, so editors can show results per rule. The report's schemaVersion stays 1 (the field is additive, see the report format). The Rego Syntax Support extension uses it for its allow: 3/5 mutants killed CodeLens. #9

Fixed

• One-line else clauses without braces (else := 2 if input.c >= 4) are mutated like other bodies. OPA gives such a body the location of the whole clause, so their comparisons and constants were skipped, and NOT_TOGGLE produced a stillborn mutant there. #9
• regodrill version reports the module version when installed with go install (0.1.0 printed 0.1.0-dev). #10

Changed

• Release notes start from GitHub's generated notes instead of a list of commits. #10

See the changelog. Full diff: v0.1.0...v0.2.0.

Install

Download the archive for your platform below, or:

$ go install github.com/adamaKomi/regodrill/cmd/regodrill@v0.2.0

regodrill_0.2.0.wasm is a wasip1 build for environments that can only run WebAssembly (same verdicts, slower, no parallelism).

Verify

$ sha256sum -c checksums.txt --ignore-missing
$ gh attestation verify regodrill_0.2.0_linux_amd64.tar.gz --repo adamaKomi/regodrill

Built with OPA 1.21.3 as a library.

v0.1.0

First release of regodrill: mutation testing for Rego (Open Policy Agent) policies. It changes your policies one small step at a time (>= becomes >, a condition is removed, a role is dropped from a set), runs your own tests on each change, and reports the changes that no test notices.

Highlights

• Ten mutation operators: COMP_BOUNDARY, COMP_NEGATE, EXPR_REMOVE, NOT_TOGGLE, DEFAULT_FLIP, RULE_REMOVE, CONST_STRING, CONST_NUMBER, COLLECTION_DROP, QUANT_WEAKEN. Each mutant is one visible text change.
• Loads policies, tests and data like opa test; Rego v1 by default, --v0-compatible for v0.
• Test selection that never changes a verdict, and a fast evaluation of plain tests: all of gatekeeper-library (2,426 mutants) in about 14 seconds.
• Mutants that cannot compile are mostly avoided (1.9 % on gatekeeper-library); mutants equal to the original policy are not run.
• Reports: text, JSON (format) and SARIF 2.1.0 for GitHub code scanning.
• # regodrill:ignore annotations, .regodrill.yaml, --threshold, --since <git ref> for pull requests, network built-ins off by default.

See the changelog and the README.

Install

Download the archive for your platform below, or:

$ go install github.com/adamaKomi/regodrill/cmd/regodrill@v0.1.0

regodrill_0.1.0.wasm is a wasip1 build for environments that can only run WebAssembly (same verdicts, slower, no parallelism).

Verify

$ sha256sum -c checksums.txt --ignore-missing
$ gh attestation verify regodrill_0.1.0_linux_amd64.tar.gz --repo adamaKomi/regodrill

Built with OPA 1.21.3 as a library.