Conftest v1 Road map

[jalseth]

Important -- Feedback notes

Hello everyone. With OPA/Rego now at a stable v1, I think it is time to move conftest in the same direction. This discussion is to open the road map to community feed back. Everyone is welcome to comment and add any feedback you have, If there is a large amount of feedback on a specific point, we can spin that out to its own discussion.

I am planning to have this open for discussion for around two weeks. This may be shorter if there isn't much feedback, or can be extend if there are ongoing discussions.

Road map

Motivation

Conftest has helped a lot of people solve policy problems in CI since it was introduced. That said, it has grown organically and has some implementation details that make it hard to maintain and extend.

To ensure long-term stability and ease of maintenance, we are moving toward a v1.0 release. This transition focuses on:

1. Specialization: Focusing on where conftest delivers unique value: translating configuration formats to JSON for OPA evaluation.
2. Stability: Finalizing a reliable API and CLI interface to prevent future breaking changes.
3. Maintainability: Reducing the cognitive load and time commitment required by maintainers to verify issues and PRs.

---

Proposed Changes

1. New features

• GitHub Action:
  • Provide a first party GitHub Action for easy use in GitHub Actions CI.

2. Deprecations & Removals

• Plugin Command: Remove due to low adoption and high maintenance overhead for OS-specific edge cases.
• Fmt Command: Remove in favor of opa fmt or regal. These tools are purpose-built for Rego formatting and are easily installable via modern package managers.
• Explicit Protocols: Require protocol prefixes (e.g., oci://) for remote policies to remove ambiguity between local paths and remote registries.
• CycloneDX Parser: Remove because CycloneDX uses standard JSON or XML formats, which are already supported. Dedicated logic for these files is redundant.

3. Architecture & Core Interfaces

• Parser Interface Refinement:
  • io.Reader support: Transition Unmarshal to accept io.Reader. This avoids loading entire files into memory, improving efficiency for large configuration files.
  • SupportsFile(fileName string) bool: This method allows the engine to quickly identify which parser to use without attempting to read or unmarshal the file. This unblocks a clean factory pattern for directory scanning.
• Outputter Interface Refinement:
  • Reporting Decoupling: Separate "Reporting" into a specialized interface. Currently, only the stdout outputter supports reporting; this change prevents runtime errors when other formats are requested with report flags.
  • io.Writer transition: Update Options to use io.Writer instead of *os.File to simplify unit testing and allow for redirection to arbitrary buffers.
• Extensible Factory Pattern:
  • Implement a Register() API for parsers and outputters. This enables Conftest to be used as a library with a custom or restricted set of parsers.
  • Supports using Go build tags to exclude specific parsers, reducing binary size and supply chain risk by minimizing dependencies for specific use cases.

4. Performance & Scalability

• Parallel Evaluation Engine:
  • Concurrency Model: Implement a Producer-Worker-Consumer model for file discovery, parsing, and evaluation to maximize CPU utilization across all available cores.
  • rego.PreparedEvalQuery: Use prepared queries to significantly improve evaluation performance. By compiling the Rego query once and reusing it across multiple inputs, we eliminate the overhead of repeated parsing and compilation during large-scale scans.
• Thread-Safe Engine:
  • Remove stateful side-effects from the Engine (e.g., addFileInfo). Moving metadata into the input or per-query transactions is a prerequisite for parallel execution to prevent race conditions and ensure data integrity.

5. Reporting & Developer Experience

• Granular Success Tracking:
  • Update CheckResult.Successes from int to []Result. This enables tracking which specific rules passed, rather than just a count.
  • Requires the Engine to analyze the Rego AST to identify all possible deny/warn/violation rules, ensuring that "success" means a rule was evaluated and did not trigger.
• CLI Flag Consolidation:
  • Centralize flag definitions to ensure consistency between commands (e.g., test and verify) and prevent drift.
  • Namespace Logic: Merge --all-namespaces and --namespace. Default to all namespaces unless the user specifies a subset, simplifying the common use case.
  • Boolean Defaults: Ensure all boolean flags default to false. For example, --tls (default true) becomes --disable-tls (default false) to follow CLI conventions.
• Configuration Decoupling:
  • Move parser/outputter-specific flags (e.g., --proto-file-dirs) into configuration files or environment variables. This keeps the CLI surface focused on core execution.

6. Maintenance & Supply Chain Security

• Support Lifecycle: Provide bug fixes and security patches for the N-2 most recent releases.
• Release Process: Implement release branches and automated, signed SLSA L3 provenance for all build artifacts.
• Dependabot Strategy: Pin GitHub Actions to Git SHAs instead of tags and disable automatic backports to maintain a stable release branch.
• Harden the release Dockerfile: run as a non-root user, pin base images by digest, and tighten the .dockerignore to an allowlist.