github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-07-18 01:13:56 +00:00
Code Issues Projects Releases Wiki Activity

tests/static-checks: parse rego with opa and regorus

Browse Source 
Ensure rego policies in tree can be parsed using opa and regorus.

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
This commit is contained in:
Paul Meyer 2025-06-06 15:43:10 +02:00
parent 107e7dfdf6
commit 64906e6973
1 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
tests/static-checks.sh
View File

@ -1362,6 +1362,38 @@ static_check_dockerfiles()
popd popd
} }
static_check_rego()
{
local rego_files
rego_files=$(git ls-files | grep -E '.*\.rego$')
interpreters=("opa" "regorus")
for interpreter in "${interpreters[@]}"
do
if ! command -v "${interpreter}" &>/dev/null; then
die "Required rego interpreter '${interpreter}' not found in PATH"
fi
done
found_unparsable=0
for file in ${rego_files}
do
for interpreter in "${interpreters[@]}"
do
if ! ${interpreter} parse "${file}" > /dev/null; then
info "Failed to parse Rego file '${file}' with ${interpreter}"
found_unparsable=1
else
info "Successfully parsed Rego file '${file}' with ${interpreter}"
fi
done
done
if [[ ${found_unparsable} -ne 0 ]]; then
die "Unparsable rego files found"
fi
}
# Run the specified function (after first checking it is compatible with the # Run the specified function (after first checking it is compatible with the
# users architectural preferences), or simply list the function name if list # users architectural preferences), or simply list the function name if list
# mode is active. # mode is active.
@ -1505,6 +1537,7 @@ main()
--list) list_only="true" ;; --list) list_only="true" ;;
--no-arch) handle_funcs="arch-agnostic" ;; --no-arch) handle_funcs="arch-agnostic" ;;
--only-arch) handle_funcs="arch-specific" ;; --only-arch) handle_funcs="arch-specific" ;;
--rego) func=static_check_rego ;;
--repo) repo="$2"; shift ;; --repo) repo="$2"; shift ;;
--scripts) func=static_check_shell ;; --scripts) func=static_check_shell ;;
--vendor) func=static_check_vendor;; --vendor) func=static_check_vendor;;