v0.8.0

What's new in v0.8.0

Added

• v0Compatible on every tool that reads a policy through opa or
  conftest: the rego_eval family, rego_compile_query,
  rego_explain_decision, rego_explain_undefined, rego_test,
  rego_test_multiroot, rego_coverage_gaps, rego_bench, opa_exec,
  rego_check, rego_check_schema, rego_format, rego_parse_ast,
  rego_inspect, rego_describe_policy, rego_generate_test_skeleton,
  rego_infer_input_schema, rego_verify, opa_bundle_build,
  conftest_test, conftest_verify and conftest_push. rego_policy_diff
  takes it per side, so a legacy policy can be diffed against its migrated
  copy. OPA 1.x refuses pre-1.0 Rego without it, so a policy that had not
  been migrated could not be evaluated or tested, including the original a
  migrated copy has to be compared against. OPA reads the query as v0 too,
  so the future keywords are imported for it and in and every work
  there as they do against a v1 policy. rego_deps has no such option,
  since opa deps has none, and the Regal tools need none, since Regal
  reads either version.
• rego_eval takes inputs, up to 50 input documents, and returns a result
  or an error for each. One process runs per document, so an input that
  raises a runtime error does not take the others with it. A policy that
  does not compile, or data that does not load, fails the call once, and
  after an input times out the inputs not yet started are reported with the
  code NOT_EVALUATED rather than run. partial with inputs needs
  unknowns that leave part of input known: with none, or with
  unknowns: ["input"], opa ignores each document and every entry would
  get the same residual.

Changed

• rego_migrate_v1 migrates the policies opa fmt --rego-v1 refuses. A rule
  named contains, every, if or in is renamed along with every
  reference to it in the module, including one through an import of its own
  package, and so is an import whose path or alias v1 reserves. re_match
  and net.cidr_overlap become regex.match and net.cidr_contains, and a
  with that mocks them follows the rename. Where the rename would change
  behaviour, because the module calls both names and mocks either, or binds
  regex or net itself, the old name gets a helper instead. all, any,
  set_diff and the cast_* built-ins are replaced by helper functions,
  appended to the module, that return what each built-in did for every
  argument; all() in particular skips the undefined elements of a
  comprehension, which the usual every rewrite does not. The output lists
  each rewrite by line. When the formatter still refuses, the error names
  its first message and says which line it means, instead of calling a type
  error a syntax error, and a source that parses only as v1 is returned
  unchanged rather than rejected.
• rego_migrate_v1 given inputs evaluates the original as v0 and the
  result as v1 on each and reports any rule whose value or type differs.
  An input on which the whole package fails is compared rule by rule, both
  sides read the same clock, and queries compares expressions too, which
  is the only way a function is compared. Since this runs the policy,
  http.send included, the tool is now annotated as open-world and not
  read-only.
• rego_eval and its variants, rego_compile_query and
  rego_explain_decision no longer require source or paths, and an
  empty source counts as none. A query on its own evaluates, which is how
  a built-in gets tried out. When such a query reads data and comes back
  undefined, the result says nothing was loaded.
• opa_exec reports a policy that does not load or activate as
  INVALID_REGO, naming opa's reason, where it returned EVAL_ERROR with
  the reason inside log lines in details. This applies to bundle and
  dataPaths alike.
• conftest_test, conftest_verify and conftest_push report a policy
  that does not compile as INVALID_REGO, and one that fails while running
  as EVAL_ERROR, where they returned UNKNOWN_ERROR, and point at
  v0Compatible when the policy is pre-1.0 Rego.

Fixed

• opa_exec loads dataPaths the way opa eval --data loads them. Each
  entry used to reach opa exec as a bundle of its own, so a .rego file
  failed with "gzip: invalid header", two directories failed as bundles with
  overlapping roots, and a data file not named data.json, data.yaml or
  data.yml was skipped. Plain files and directories are now built into one
  bundle first, which adds one opa build to the call. A directory
  therefore contributes every JSON and YAML file in it, so one that loaded
  before now fails if it holds conflicting files, such as test fixtures, or
  files that do not parse as data, such as JSONC editor settings or chart
  templates; pass it as bundle to load it as before. A .tar.gz inside
  such a directory is not loaded, which opa eval --data would do, and is
  named in warnings. An archive, whatever its name, and a directory
  holding a .manifest are still loaded as bundles.
• rego_infer_input_schema said nothing when a file did not parse and built
  the schema from the rest, so a pre-1.0 policy came back as one that reads
  no input at all. It now names the files it left out, and fails with
  INVALID_REGO when none parsed.
• rego_check_schema with a schema directory said a policy it could not
  parse, such as a pre-1.0 one checked without v0Compatible, carried no
  schemas: annotations. The parse error is reported instead, and a path
  whose annotations opa cannot read for another reason is an error rather
  than a pass. A check that passes also warns when the schema lets through
  input fields it does not name, as a schema with no properties does, so
  a misspelled field would not have been caught.
• rego_policy_diff reports opa's error when a side fails to evaluate, and
  points at v0CompatibleA or v0CompatibleB when that side is pre-1.0
  Rego; it used to return only an empty stderr.
• rego_deps points at rego_migrate_v1 when a policy fails to parse
  because it is pre-1.0 Rego.
• rego_format_write rejects v0Compatible together with v1Compatible,
  as the other tools that take both do, rather than applying v0.
• On Windows, a policy or data path whose name starts with - was read by
  opa as a flag.