Skip to content

policy eval should fail if no execution path is met #2334

@migmartri

Description

@migmartri

For example, if I have this policy

apiVersion: workflowcontract.chainloop.dev/v1
kind: Policy
metadata:
    name: test-http
    description: HTTP policy that validates Chainloop platform version against expected version 1.2.3
spec:
    policies:
        - path: test-http.rego
          kind: SBOM_CYCLONEDX_JSON

and I run it like this

chainloop policy develop eval --kind EVIDENCE --material ./empty.json -p test-http.yaml

I get

chainloop policy develop eval --kind EVIDENCE --material ./empty.json -p test-http.yaml
[
   {
      "violations": [],
      "skip_reasons": [],
      "skipped": false,
      "ignored": true
   }
]

with no indication if it was executed or not, in fact it was not.

As a minimum I'd make the policy fail indicating that no execution branch matched the criteria, and ideally we should show logging information that tells the user which path it was taken, even the script executed,

cc/ @jiparis

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions