Adds the YAML test runner that exercises the companion test data PRs, plus
several compiler fixes surfaced during testing:
- Removed parameter register caching that produced wrong results inside
short-circuiting allOf/anyOf blocks; added literal-index caching for
parameter defaults to avoid repeated O(n) literal-table scans
- Simplified cross-resource effect details to only emit roleDefinitionIds
and type (deployment templates are not evaluated for compliance)
- Replaced guid/uniqueString builtins with clear "unsupported" errors
- Normalized datetime output to ISO 8601 with Z suffix
- Added azure_policy parser MAX_COL constant (8192) for long template
expressions, keeping the global DEFAULT_MAX_COL at 1024
- Added rvm to azure_policy feature dependencies since the compiler
targets RVM bytecode
Also restructures the example binary into examples/regorus/ with new
azure-policy-eval and azure-policy-aliases subcommands, adds C# alias
normalization tests, and documents Azure Policy support in the README.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- split the xtask crate into structured modules for
- bindings
- ci
- dev
- util
- no-std
- Adding commands for
- ci-release/ci-debug
- MUSL/no-std
- per- binding language smoke tests
- developer tasks (fmt, clippy, pre-commit, pre-push)
- refresh Cargo manifests/locks, binding readmes, and shared FFI helpers so every binding reuses the same preparation steps
- refactor GitHub Actions (release/debug, extensions, CodeQL, clippy, bindings) to call the new xtask commands
- Use rust-cache in ci workflows (microsoft qdk also does this)
- extend README with a contributor workflow section describing how xtask mirrors CI expectations
- update pre-commit and pre-push hooks to use the xtask dev commands
WORKAROUND:
When dotnet is run from an xtask, codeql tracer intercepts it an routes to a nonexistent binary.
Therefore in codeql workflow, xtask is not used for c# and instead dotnet is directly invoked.
Tracked by #545closes#475
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Lints are added (deny) at crate level.
In each offending file, the failing lints are explicitly allowed.
Each file will be fixed in subsequent PRs.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Major changes:
- Implement the `net.cidr_contains` builtin
- Enable the v0 and v1 test for `net.cidr_contains`
- Add the `netip` crate to standardize CIDR searching and other
operations
Key Concept:
- Allow users to leverage the `net.cidr_contains` builtin to check
whether an IPv4 or IPv6 CIDR contains a specified IP address or
subnet.
Testing:
- All tests passing.
Signed-off-by: tjons <tylerschade99@gmail.com>
Cryptographic builtins are removed due to various reasons like FIPS
compliance. Users needing crypto builtins are encouraged to use
extensions.
Deprecated functions are also removed.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Remove dependency on jsonwebtoken which brings in the ring crate.
Ring crate triggers governance violations.
Support for JWT will be implemented in future using a more governance
compliant crate.
BREAKING CHANGE
Prior to this PR, support for jwt builtins was minimially implemented.
Only io.jwt.decode and io.jwt.decode_verify was implemented.
With this PR, those builtins will no longer be available. They are
planned to be implemented in the future. In the meantime, they can be
brought back in via Engine::add_extension.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Removed cryptographically insecure sha1. This existed only for OPA
compatibility.
Also exclude bindings from main workspace
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Regorus now defaults to rego v1. `import rego.v1` is no longer needed.
Additionally, `future` keywords are automatically imported.
See
https://www.openpolicyagent.org/docs/latest/v0-upgrade/#changes-to-rego-in-opa-v10
to understand the differences between rego v1 and v0.
BREAKING CHANGE:
v0 style policies will error out by default. To enable v0 behavior, call engine.set_rego_v0(true) before
loading policies.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Also add test to lock down example policy path.
Also Fix clippy warning by using unwrap_or_default
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- Disable default features in dependencies
- Use anyhow::Error::msg to map errors. Note: anyhow will itself be removed later.
- lazy_static/spin_no_std used in no_std environments
- ensure_no_std binary is built to target thumbv7m-none-eabi to ensure that
there are no std dependencies. thumbv7m-none-eabi target has no std support.
- The opa-no-std feature enables only those Regorus features that work with no_std.
- Enable tests with no_std
- Update sizes of regorus binary in README.md
- Ensure that regorus example can be built with only std
- Ensure that regorus example can be built with no_std
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- Use eval_rule
- Show functions add_policy, add_data, set_input
- Show Engine, Value types
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
The feature does not interoperate well with other serde_json features like untagged enums.
Fixes#199
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
* Ruby binding
* use relative regorus crate in ruby instead of a published version, also cargo fmt
* remove unnecessary Cargo.toml, include the top level Cargo.lock in ruby gem
* ruby bindings continued- add eval_rule, fix _json methods, update README.md
also added rubocop-minitest and rubocop-rake, and added more test coverage
* update README.md to include Ruby bindings
Closes#191
* Add `time` to opa.passing. Disable WASM from rust.yml
Bindings will be tested using a separate workflow.
Also remove scripts that are no longer useful
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
* Remove alpha tag from version
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
---------
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Implement `import rego.v1`
https://www.openpolicyagent.org/docs/latest/policy-language/#the-regov1-import
- `if` required before rule body
- import rego.v1 automatically imports future.keywords
- handle import shadowing
- data, input cannot be shadowed
- deprecated functions as disallowed
- rules must have assignment or body
- `contains` required for parital set
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
- Separate out public, unstable and internal APIs.
- Cleanup README.md and include it as the crate documentation.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
