mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
3f65685149103aa58b8a8379cb3a01141d98ca24
490 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
copilot-swe-agent[bot]
|
3f65685149 | Update python binding to pyo3 0.29.0 | ||
|
copilot-swe-agent[bot]
|
ae9cae8d22 | Initial plan | ||
|
Anand Krishnamoorthi
|
ed6ae465b0 |
refactor(value): migrate Value::Object to Object storage abstraction (#736)
Builds on #57. Swap Value::Object's payload from Rc<BTreeMap<Value, Value>> to Rc<Object> and migrate all call sites to the Object API. as_object / as_object_mut keep their names but return &Object / &mut Object. The mutable accessor handles Rc::make_mut internally, so callers no longer do it themselves. Object grows into_value() and From<Object> for Value. Value's serializer now delegates to Object::serialize, dropping a duplicate non-string-key stringification path. RVM IterationState::Object is rewritten around ObjectCursor: O(log n) steps over a shared Rc<Object>, no eager pair snapshot. Snapshot independence is preserved by Rc copy-on-write; setup_next_iteration advances the cursor inline and advance() becomes a no-op for this variant. A new iteration_state_object_is_snapshot_independent_of_source test covers CoW against a mutated alias. Value::Set still wraps Rc<BTreeSet<Value>>; the matching Set abstraction and its swap ship in follow-up PRs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|
Mark Birger
|
bd90453dd3 |
tests/opa: normalize path separators in folder filter on Windows (#742)
`run_opa_tests` builds `path_dir_str` from `path.strip_prefix(...).to_string_lossy()`,
which on Windows yields strings with backslash separators (e.g.
`v0\aggregates`). The folder filter then does an exact-string
comparison against the CLI arguments:
let run_test = folders.is_empty()
|| folders.iter().any(|f| &path_dir_str == f);
CLI arguments use forward slashes (`v0/aggregates`), so on Windows
the comparison never matches, no tests are selected, and the function
bails with `"no matching tests found"`. This blocks the
`cargo xtask pre-push` hook for any Windows contributor.
Normalize `path_dir_str` to use forward slashes at construction
time. Reproduces before the fix as `cargo test ... --test opa --
v1/aggregates` exiting 1 with `no matching tests found`; after the
fix the same command runs 72 cases and the full hook command runs
2861 / 0 across 188 folders.
The duplicate platform check at the `is_rego_v0_test` site
(`path_dir_str.starts_with("v0/") || path_dir.starts_with("v0\\")`)
is left intact to keep the change minimal — the backslash branch
becomes redundant but is harmless.
Co-authored-by: Mark Birger <markbirger@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
||
|
Anand Krishnamoorthi
|
11940ddb04 |
Introduce Object storage abstraction (#735)
Add an opaque Object type for the key→value storage backing Value::Object. It exposes a small set of methods (get, insert, remove, iter, iter_sorted, cursor, serde) and keeps the backing store private, so future representations -- inline small-map, hash-backed, lazy, arena, FFI-callback -- can plug in without touching the call sites that name this type. Nothing in the engine uses Object yet. Value::Object still wraps Rc<BTreeMap<Value, Value>>; the payload swap and call-site migration come in the next PR. Object stands on its own unit tests in the meantime. docs/value/object.md walks through the design, the precedents it follows (serde_json::Map, toml::Table, simdjson DOM), and the concrete workloads the abstraction is meant to unlock. A matching Set abstraction follows in a separate PR. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|
Anand Krishnamoorthi
|
5b7010ba16 |
chore(rvm): add debug-mode invariant assertions (#737)
Encode VM stack/context/register lifecycle invariants as debug_assert!s. Zero cost in release; surfaces violations during debug-mode tests and CI. Invariants covered: - reset_execution_state postcondition: all stacks empty, registers resized to base and Undefined, rule_cache reset, pc/executed counters zeroed, builtins_cache cleared, execution_state Ready. - Per-opcode invariant check (assert_vm_invariants) invoked at the top of run_stackless_loop and jump_to iterations: state is Ready/Running, registers non-empty, rule_cache sized to program, execution stack bounded by a debug-only sanity ceiling (DEBUG_MAX_EXECUTION_STACK_DEPTH = 4096; not a production limit). - resume() precondition: execution_state is Suspended. - execute_suspendable_entry precondition: clean state (callers reset immediately before). - Rule finalize: call_rule_stack pop matches the finalized rule_index. - IterationState::advance: Single iterator not advanced past consumption, Array index not at usize::MAX before saturating_add. All assertions are gated by #[cfg(debug_assertions)] (directly or via debug_assert!) so release builds are unaffected. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|
dependabot[bot]
|
ba7d29b134 |
build(deps): bump the rust-dependencies group across 5 directories with 5 updates (#734)
* build(deps): bump the rust-dependencies group across 5 directories with 5 updates Bumps the rust-dependencies group with 4 updates in the / directory: [serde_json](https://github.com/serde-rs/json), spin, [dashmap](https://github.com/xacrimon/dashmap) and [toml_edit](https://github.com/toml-rs/toml). Bumps the rust-dependencies group with 3 updates in the /bindings/ffi directory: [serde_json](https://github.com/serde-rs/json), spin and [dashmap](https://github.com/xacrimon/dashmap). Bumps the rust-dependencies group with 2 updates in the /bindings/java directory: [serde_json](https://github.com/serde-rs/json) and spin. Bumps the rust-dependencies group with 2 updates in the /bindings/python directory: [serde_json](https://github.com/serde-rs/json) and spin. Bumps the rust-dependencies group with 3 updates in the /bindings/wasm directory: [serde_json](https://github.com/serde-rs/json), spin and [wasm-bindgen-test](https://github.com/wasm-bindgen/wasm-bindgen). Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `dashmap` from 6.1.0 to 6.2.1 - [Release notes](https://github.com/xacrimon/dashmap/releases) - [Commits](https://github.com/xacrimon/dashmap/compare/v6.1.0...v6.2.1) Updates `toml_edit` from 0.25.11+spec-1.1.0 to 0.25.12+spec-1.1.0 - [Commits](https://github.com/toml-rs/toml/compare/v0.25.11...v0.25.12) Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `dashmap` from 6.1.0 to 6.2.1 - [Release notes](https://github.com/xacrimon/dashmap/releases) - [Commits](https://github.com/xacrimon/dashmap/compare/v6.1.0...v6.2.1) Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `dashmap` from 6.1.0 to 6.2.1 - [Release notes](https://github.com/xacrimon/dashmap/releases) - [Commits](https://github.com/xacrimon/dashmap/compare/v6.1.0...v6.2.1) Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `dashmap` from 6.1.0 to 6.2.1 - [Release notes](https://github.com/xacrimon/dashmap/releases) - [Commits](https://github.com/xacrimon/dashmap/compare/v6.1.0...v6.2.1) Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `spin` from 0.10.0 to 0.12.0 Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150) Updates `wasm-bindgen-test` from 0.3.71 to 0.3.72 - [Release notes](https://github.com/wasm-bindgen/wasm-bindgen/releases) - [Changelog](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/CHANGELOG.md) - [Commits](https://github.com/wasm-bindgen/wasm-bindgen/commits) Updates `spin` from 0.10.0 to 0.12.0 --- updated-dependencies: - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: dashmap dependency-version: 6.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: toml_edit dependency-version: 0.25.12+spec-1.1.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: dashmap dependency-version: 6.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: dashmap dependency-version: 6.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: dashmap dependency-version: 6.2.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: wasm-bindgen-test dependency-version: 0.3.72 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): refresh Cargo lockfiles * build(deps): refresh Cargo lockfiles --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Anand Krishnamoorthi
|
acf7f7a25e |
chore: release (#731)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>regorus-v0.10.1 |
||
|
Anand Krishnamoorthi
|
86b4a279fa |
fix(ffi): eliminate aliasing UB + add Azure Policy JSON compilation FFI (#727)
* fix(ffi): eliminate aliasing UB via to_shared_ref migration Add to_shared_ref() helper that creates &T (shared reference) from raw pointers instead of &mut T. This eliminates undefined behavior caused by violating Rust's aliasing invariant when C# SafeHandle permits concurrent FFI calls on the same handle. With &mut T, the compiler may assume exclusive (noalias) access and reorder or elide reads/writes — a miscompilation risk when another thread holds a reference to the same object. Switching to &T removes that assumption; actual mutation is mediated by the interior RwLock inside Handle<T>, which is the sole synchronization mechanism. Migrated sites: - rvm.rs: 20 non-drop call sites - engine.rs: 30 non-drop call sites + with_unwind_guard for timer fns - compiled_policy.rs: 2 call sites - Fix null-data UB in regorus_program_deserialize_binary Drop paths retain to_ref() where exclusive access is guaranteed by the caller contract (preventing use-after-free). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * feat(ffi): add Azure Policy JSON compilation FFI and C# bindings - AliasRegistry builder pattern: RegorusAliasRegistryBuilder (mutable, single-threaded) + RegorusAliasRegistry (immutable, Arc-wrapped) - Azure Policy JSON compilation: regorus_compile_azure_policy_rule and regorus_compile_azure_policy_definition with alias registry support - regorus_rvm_set_context for host-supplied ambient data - C# AliasRegistryBuilder and AliasRegistry classes with convenience factories (FromJson, FromManifest, Empty) - C# AzurePolicyCompiler static class for policy rule/definition compilation - Compile functions take *const RegorusAliasRegistry (read-only via to_shared_ref for concurrent compilation safety) - Fix pre-existing clippy warnings across multiple crates Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|
Anand Krishnamoorthi
|
5467cd9e69 |
refactor(azure_policy): reduce AliasRegistry allocations via Rc sharing (#725)
Replace the compiler's two cloned BTreeMap fields (alias_map and alias_modifiable) with a single Option<Rc<AliasRegistry>>. This eliminates cloning two 73K-entry maps on every compilation by sharing the registry through a reference-counted pointer. Additional improvements: - alias_map()/alias_modifiable_map() return &BTreeMap (zero-copy) - Safe .get() indexing in ingest_alias_entries and build_object_from_keys - Null-tolerant deserialization for AliasEntry.paths (~97% of real Azure catalog entries emit "paths": null) All changes are within the azure_policy feature gate. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|
Copilot
|
dae3052781 |
fix(interpreter,rvm): correct partial object rule iteration and classification (#718)
Partial object rules with dynamic keys (e.g. `violations[k] if { ... }`)
only produced a single entry instead of collecting all bindings. Two
independent bugs caused this:
1. Interpreter: the early-return optimization in eval_output_expr_in_loop
checked whether the rule_ref was constant but never verified whether
the key expression was also constant. A variable key like `k` was
treated as constant output, causing the loop to exit after the first
iteration. Fixed by gating early-return on key_expr constness.
2. RVM: compute_rule_type incorrectly classified `p[k] if { ... }` as
PartialSet instead of PartialObject. OPA v1 semantics define this
form as a partial object (key -> true). Fixed the classification and
added compiler error guards for patterns the RVM codegen cannot yet
handle (constant keys, nested bracket keys), ensuring graceful
fallback to the interpreter.
The OPA test harness now skips RVM validation per-case when partial
object compiler errors are raised, rather than blanket-skipping entire
folders. This preserves RVM coverage for unrelated tests in the same
folders.
Closes #712
Co-authored-by: Anand Krishnamoorthi <anakrish@microsoft.com>
|
||
|
Anand Krishnamoorthi
|
3111bf58f2 |
perf(normalizer): use Rc<str> interning to reduce alias resolution allocations (#726)
Replace per-alias heap allocations with reference-counted string interning throughout the normalizer's alias resolution pipeline: - Store alias ARM path segments as Vec<Rc<str>> instead of Vec<String>, enabling zero-alloc BTreeMap lookups via Rc::clone (refcount bump) rather than Value::from() (heap allocation per lookup) - Pre-compute lowercased short name (short_name_lc: Rc<str>) at registry-load time, enabling allocation-free insertion for the common case of non-dotted, non-collision alias short names - Add rc_lowercase() fast-path that skips allocation when the input string is already lowercase ASCII (common for ARM property names) - Update set_nested_lowercased/set_nested_inner/set_nested_in_btree to thread Rc<str> through intermediate object construction, avoiding String temporaries at every nesting level - Replace to_ascii_lowercase().starts_with() in is_root_field_collision with a zero-alloc byte-level comparison Measured 27-49% improvement in normalization time across a range of Azure Policy alias-heavy resource types (293-608 aliases per type). Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> |
||
|
Anand Krishnamoorthi
|
be3fde7706 |
fix(copilot): robust diff computation for cloud agent environments (#709)
The cloud agent checks out a branch like copilot/review-pr-NNN which may not have upstream/main or origin/main refs available for merge-base. Changes: - Use gh pr diff as primary method (always works in PR context) - Fall back to git merge-base for local non-PR usage - Remove path filters (*.rs *.toml examples/) — review full diff - Remove head -2000 truncation — let agents see everything - Explicitly fetch origin/main in copilot-setup-steps.yml as backup Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|
dependabot[bot]
|
d2c483e93e |
build(deps): bump the rust-dependencies group across 5 directories with 2 updates (#724)
* build(deps): bump the rust-dependencies group across 5 directories with 2 updates Bumps the rust-dependencies group with 2 updates in the / directory: [hashbrown](https://github.com/rust-lang/hashbrown) and [jsonschema](https://github.com/Stranger6667/jsonschema). Bumps the rust-dependencies group with 2 updates in the /bindings/ffi directory: [hashbrown](https://github.com/rust-lang/hashbrown) and [jsonschema](https://github.com/Stranger6667/jsonschema). Bumps the rust-dependencies group with 2 updates in the /bindings/java directory: [hashbrown](https://github.com/rust-lang/hashbrown) and [jsonschema](https://github.com/Stranger6667/jsonschema). Bumps the rust-dependencies group with 2 updates in the /bindings/python directory: [hashbrown](https://github.com/rust-lang/hashbrown) and [jsonschema](https://github.com/Stranger6667/jsonschema). Bumps the rust-dependencies group with 2 updates in the /bindings/wasm directory: [hashbrown](https://github.com/rust-lang/hashbrown) and [jsonschema](https://github.com/Stranger6667/jsonschema). Updates `hashbrown` from 0.17.0 to 0.17.1 - [Release notes](https://github.com/rust-lang/hashbrown/releases) - [Changelog](https://github.com/rust-lang/hashbrown/blob/main/CHANGELOG.md) - [Commits](https://github.com/rust-lang/hashbrown/compare/v0.17.0...v0.17.1) Updates `jsonschema` from 0.46.4 to 0.46.5 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/ruby-v0.46.4...ruby-v0.46.5) Updates `hashbrown` from 0.17.0 to 0.17.1 - [Release notes](https://github.com/rust-lang/hashbrown/releases) - [Changelog](https://github.com/rust-lang/hashbrown/blob/main/CHANGELOG.md) - [Commits](https://github.com/rust-lang/hashbrown/compare/v0.17.0...v0.17.1) Updates `jsonschema` from 0.46.4 to 0.46.5 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/ruby-v0.46.4...ruby-v0.46.5) Updates `hashbrown` from 0.17.0 to 0.17.1 - [Release notes](https://github.com/rust-lang/hashbrown/releases) - [Changelog](https://github.com/rust-lang/hashbrown/blob/main/CHANGELOG.md) - [Commits](https://github.com/rust-lang/hashbrown/compare/v0.17.0...v0.17.1) Updates `jsonschema` from 0.46.4 to 0.46.5 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/ruby-v0.46.4...ruby-v0.46.5) Updates `hashbrown` from 0.17.0 to 0.17.1 - [Release notes](https://github.com/rust-lang/hashbrown/releases) - [Changelog](https://github.com/rust-lang/hashbrown/blob/main/CHANGELOG.md) - [Commits](https://github.com/rust-lang/hashbrown/compare/v0.17.0...v0.17.1) Updates `jsonschema` from 0.46.4 to 0.46.5 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/ruby-v0.46.4...ruby-v0.46.5) Updates `hashbrown` from 0.17.0 to 0.17.1 - [Release notes](https://github.com/rust-lang/hashbrown/releases) - [Changelog](https://github.com/rust-lang/hashbrown/blob/main/CHANGELOG.md) - [Commits](https://github.com/rust-lang/hashbrown/compare/v0.17.0...v0.17.1) Updates `jsonschema` from 0.46.4 to 0.46.5 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/ruby-v0.46.4...ruby-v0.46.5) --- updated-dependencies: - dependency-name: hashbrown dependency-version: 0.17.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.46.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: hashbrown dependency-version: 0.17.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.46.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: hashbrown dependency-version: 0.17.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.46.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: hashbrown dependency-version: 0.17.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.46.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: hashbrown dependency-version: 0.17.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.46.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): refresh Cargo lockfiles --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
093e50f0a1 |
build(deps): bump the rust-dependencies group across 5 directories with 4 updates (#717)
* build(deps): bump the rust-dependencies group across 5 directories with 4 updates Bumps the rust-dependencies group with 3 updates in the / directory: [hashbrown](https://github.com/rust-lang/hashbrown), [jsonschema](https://github.com/Stranger6667/jsonschema) and [lru](https://github.com/jeromefroe/lru-rs). Bumps the rust-dependencies group with 3 updates in the /bindings/ffi directory: [hashbrown](https://github.com/rust-lang/hashbrown), [jsonschema](https://github.com/Stranger6667/jsonschema) and [lru](https://github.com/jeromefroe/lru-rs). Bumps the rust-dependencies group with 3 updates in the /bindings/java directory: [hashbrown](https://github.com/rust-lang/hashbrown), [jsonschema](https://github.com/Stranger6667/jsonschema) and [lru](https://github.com/jeromefroe/lru-rs). Bumps the rust-dependencies group with 3 updates in the /bindings/python directory: [hashbrown](https://github.com/rust-lang/hashbrown), [jsonschema](https://github.com/Stranger6667/jsonschema) and [lru](https://github.com/jeromefroe/lru-rs). Bumps the rust-dependencies group with 4 updates in the /bindings/wasm directory: [hashbrown](https://github.com/rust-lang/hashbrown), [jsonschema](https://github.com/Stranger6667/jsonschema), [lru](https://github.com/jeromefroe/lru-rs) and [wasm-bindgen-test](https://github.com/wasm-bindgen/wasm-bindgen). Updates `hashbrown` from 0.16.1 to 0.17.0 - [Release notes](https://github.com/rust-lang/hashbrown/releases) - [Changelog](https://github.com/rust-lang/hashbrown/blob/main/CHANGELOG.md) - [Commits](https://github.com/rust-lang/hashbrown/compare/v0.16.1...v0.17.0) Updates `jsonschema` from 0.45.1 to 0.46.4 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/ruby-v0.45.1...ruby-v0.46.4) Updates `lru` from 0.16.4 to 0.18.0 - [Changelog](https://github.com/jeromefroe/lru-rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/jeromefroe/lru-rs/compare/0.16.4...0.18.0) Updates `hashbrown` from 0.16.1 to 0.17.0 - [Release notes](https://github.com/rust-lang/hashbrown/releases) - [Changelog](https://github.com/rust-lang/hashbrown/blob/main/CHANGELOG.md) - [Commits](https://github.com/rust-lang/hashbrown/compare/v0.16.1...v0.17.0) Updates `jsonschema` from 0.45.1 to 0.46.4 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/ruby-v0.45.1...ruby-v0.46.4) Updates `lru` from 0.16.4 to 0.18.0 - [Changelog](https://github.com/jeromefroe/lru-rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/jeromefroe/lru-rs/compare/0.16.4...0.18.0) Updates `hashbrown` from 0.16.1 to 0.17.0 - [Release notes](https://github.com/rust-lang/hashbrown/releases) - [Changelog](https://github.com/rust-lang/hashbrown/blob/main/CHANGELOG.md) - [Commits](https://github.com/rust-lang/hashbrown/compare/v0.16.1...v0.17.0) Updates `jsonschema` from 0.45.1 to 0.46.4 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/ruby-v0.45.1...ruby-v0.46.4) Updates `lru` from 0.16.4 to 0.18.0 - [Changelog](https://github.com/jeromefroe/lru-rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/jeromefroe/lru-rs/compare/0.16.4...0.18.0) Updates `hashbrown` from 0.16.1 to 0.17.0 - [Release notes](https://github.com/rust-lang/hashbrown/releases) - [Changelog](https://github.com/rust-lang/hashbrown/blob/main/CHANGELOG.md) - [Commits](https://github.com/rust-lang/hashbrown/compare/v0.16.1...v0.17.0) Updates `jsonschema` from 0.45.1 to 0.46.4 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/ruby-v0.45.1...ruby-v0.46.4) Updates `lru` from 0.16.4 to 0.18.0 - [Changelog](https://github.com/jeromefroe/lru-rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/jeromefroe/lru-rs/compare/0.16.4...0.18.0) Updates `hashbrown` from 0.16.1 to 0.17.0 - [Release notes](https://github.com/rust-lang/hashbrown/releases) - [Changelog](https://github.com/rust-lang/hashbrown/blob/main/CHANGELOG.md) - [Commits](https://github.com/rust-lang/hashbrown/compare/v0.16.1...v0.17.0) Updates `jsonschema` from 0.45.1 to 0.46.4 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/ruby-v0.45.1...ruby-v0.46.4) Updates `lru` from 0.16.4 to 0.18.0 - [Changelog](https://github.com/jeromefroe/lru-rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/jeromefroe/lru-rs/compare/0.16.4...0.18.0) Updates `wasm-bindgen-test` from 0.3.70 to 0.3.71 - [Release notes](https://github.com/wasm-bindgen/wasm-bindgen/releases) - [Changelog](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/CHANGELOG.md) - [Commits](https://github.com/wasm-bindgen/wasm-bindgen/commits) --- updated-dependencies: - dependency-name: hashbrown dependency-version: 0.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.46.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: lru dependency-version: 0.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: hashbrown dependency-version: 0.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.46.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: lru dependency-version: 0.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: hashbrown dependency-version: 0.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.46.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: lru dependency-version: 0.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: hashbrown dependency-version: 0.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.46.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: lru dependency-version: 0.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: hashbrown dependency-version: 0.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.46.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: lru dependency-version: 0.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: wasm-bindgen-test dependency-version: 0.3.71 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): refresh Cargo lockfiles --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Anand Krishnamoorthi
|
47124623ab |
chore: bump version to 0.10.0 across all bindings (#710)
Update regorus core crate and all language bindings (ffi, java, python, wasm, ruby, csharp) to version 0.10.0. - Centralize C# package version via Directory.Packages.props - Remove redundant C# version suffix properties from project files - Regenerate all binding Cargo.lock files including Ruby - Fix xtask to read/write RegorusPackageVersion from Directory.Packages.props instead of parsing VersionPrefix from the csproj (which now uses an MSBuild property indirection) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>regorus-v0.10.0 |
||
|
Anand Krishnamoorthi
|
88c7ef8228 |
feat(copilot): add multi-agent code review skills (#707)
Add Copilot review skills, project instructions, and coding agent setup for automated code review on regorus PRs. Files added: - .github/copilot-instructions.md — project context (no_std, 9 bindings, dual execution paths, deny lints, security-critical evaluation) - .github/skills/code-review/SKILL.md — fast single-agent review (~2 min) - .github/skills/deep-review/SKILL.md — multi-agent deep review (~12 min) - .github/copilot-setup-steps.yml — minimal coding agent environment Development and testing methodology: The skills were developed iteratively (v3 through v11.4) against a 460-line SARIF output module on the feature/sarif-output branch, which served as a controlled test bed with 25 known issues of varying severity (correctness, safety, API design, platform, security, performance). Each version was tested by running the skill via the Copilot CLI, then mapping discovered findings against the ground truth set to measure recall and precision. Key iterations: - v3: baseline single-agent (8/25 recall, 32%) - v7: 3 parallel agents + verification (14/25, 56%) - v10c: model diversity + adversarial pass (10/25, 40%) - v11.3: merged adversarial-verifier architecture (12/25 + 2 novel, 0 noise) - v11.4: domain expertise prompting (12/25 + 2 novel, 0 noise, full report) The final architecture uses 3 parallel discovery agents (with cross-model diversity and context asymmetry), risk-triggered micro-passes, and a single adversarial verifier that both validates candidates via disproval and hunts blind spots. Agents are prompted to reason from policy-author perspective across Rego/OPA, Azure Policy, and RVM workloads. Combined CR+DR catches 16-17/25 ground truth with zero false positives and produces verified findings with confidence levels, test gap analysis, and agent performance metrics. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|
Anand Krishnamoorthi
|
87f22a79ca |
fix: harden regex builtins with compiled-size limit (#705)
Add a 100KB cap on compiled regex NFA size via RegexBuilder::size_limit() to block patterns that blow up in memory or CPU. Regex compilation now goes through a single helper (compile_regex_for_builtin) so the limit is enforced consistently across all regex builtins. While doing this, found and fixed a pre-existing bug: resource-limit errors (time, memory, instruction count) raised inside builtins were quietly swallowed to Undefined when strict_builtin_errors was off (the default). This is a problem because `not regex.match(...)` would see Undefined and flip to true -- silently wrong. The same issue now applies to the new regex size limit. Fixed by teaching the three error-absorption paths (interpreter builtin call, RVM builtin dispatch, and RVM rule-execution loop) to recognize LimitError and let it propagate instead of eating it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|
Anand Krishnamoorthi
|
c312e30372 |
build(deps): update all Rust dependencies and fix lockfile refresh workflow (#704)
* build(deps): update all Rust dependencies to latest versions Bulk-update all Cargo.lock files across the workspace and bindings to their latest compatible versions. This supersedes the individual per-directory dependabot PRs (#678-#682) that fail CI due to version skew when only one lockfile is updated. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: refresh ALL Cargo lockfiles on dependabot PRs Dependabot security updates bypass the grouped-updates config and create per-directory PRs (one per Cargo.lock). This causes version skew — e.g. rand gets bumped in bindings/ruby but stays old elsewhere, breaking the build. Fix by unconditionally refreshing all lockfiles whenever any Cargo manifest or lockfile changes, rather than only the affected directory. Also harden the workflow against expression injection: - Move head.ref and base_ref to env vars (not inline ${{ }}) - Validate refs via git check-ref-format --branch - Validate SHA format (hex, 40 chars) before use - Fetch base branch by ref (not bare SHA) for reliable diffing - Add security boundary comment on untrusted code checkout - Add version comment on pinned checkout action SHA Ref: https://github.com/dependabot/dependabot-core/issues/7547 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|
dependabot[bot]
|
bbf7ad7854 |
build(deps): bump com.google.code.gson:gson (#702)
Bumps the per-dependency group in /bindings/java with 1 update: [com.google.code.gson:gson](https://github.com/google/gson). Updates `com.google.code.gson:gson` from 2.13.2 to 2.14.0 - [Release notes](https://github.com/google/gson/releases) - [Changelog](https://github.com/google/gson/blob/main/CHANGELOG.md) - [Commits](https://github.com/google/gson/compare/gson-parent-2.13.2...gson-parent-2.14.0) --- updated-dependencies: - dependency-name: com.google.code.gson:gson dependency-version: 2.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: per-dependency ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
3c3cafcb90 |
ci(deps): bump the github-actions group across 1 directory with 5 updates (#690)
Bumps the github-actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/setup-node](https://github.com/actions/setup-node) | `6.3.0` | `6.4.0` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.35.1` | `4.35.2` | | [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.300.0` | `1.306.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` | | [PyO3/maturin-action](https://github.com/pyo3/maturin-action) | `1.50.1` | `1.51.0` | Updates `actions/setup-node` from 6.3.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits]( |
||
|
dependabot[bot]
|
b734e47c1c |
build(deps): bump the per-dependency group across 1 directory with 5 updates (#703)
Bumps the per-dependency group with 4 updates in the /bindings/ruby directory: [minitest](https://github.com/minitest/minitest), [rake](https://github.com/ruby/rake), [rake-compiler-dock](https://github.com/rake-compiler/rake-compiler-dock) and [rubocop](https://github.com/rubocop/rubocop). Updates `minitest` from 6.0.3 to 6.0.5 - [Changelog](https://github.com/minitest/minitest/blob/master/History.rdoc) - [Commits](https://github.com/minitest/minitest/compare/v6.0.3...v6.0.5) Updates `rake` from 13.3.1 to 13.4.2 - [Release notes](https://github.com/ruby/rake/releases) - [Changelog](https://github.com/ruby/rake/blob/master/History.rdoc) - [Commits](https://github.com/ruby/rake/compare/v13.3.1...v13.4.2) Updates `rake-compiler-dock` from 1.11.0 to 1.12.0 - [Release notes](https://github.com/rake-compiler/rake-compiler-dock/releases) - [Changelog](https://github.com/rake-compiler/rake-compiler-dock/blob/main/CHANGELOG.md) - [Commits](https://github.com/rake-compiler/rake-compiler-dock/compare/v1.11.0...v1.12.0) Updates `rubocop` from 1.86.0 to 1.86.1 - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](https://github.com/rubocop/rubocop/compare/v1.86.0...v1.86.1) Updates `rb_sys` from 0.9.125 to 0.9.127 - [Release notes](https://github.com/oxidize-rb/rb-sys/releases) - [Commits](https://github.com/oxidize-rb/rb-sys/compare/v0.9.125...v0.9.127) --- updated-dependencies: - dependency-name: minitest dependency-version: 6.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: per-dependency - dependency-name: rake dependency-version: 13.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: per-dependency - dependency-name: rake-compiler-dock dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: per-dependency - dependency-name: rubocop dependency-version: 1.86.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: per-dependency - dependency-name: rb_sys dependency-version: 0.9.127 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: per-dependency ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Copilot
|
b148d64b2b |
Make git rev-parse in build.rs optional with graceful fallback (#701)
* Initial plan * Make git rev-parse optional in build.rs, fall back to empty string Agent-Logs-Url: https://github.com/microsoft/regorus/sessions/070084fe-288a-4029-b4a0-006ff18f8c94 Co-authored-by: anakrish <35780660+anakrish@users.noreply.github.com> * Use \"unknown\" as fallback for GIT_HASH; also honour GIT_HASH env var override Agent-Logs-Url: https://github.com/microsoft/regorus/sessions/50f82bf4-0ccc-4dbf-8455-6182849f02d4 Co-authored-by: anakrish <35780660+anakrish@users.noreply.github.com> * Fix cargo fmt formatting in build.rs Agent-Logs-Url: https://github.com/microsoft/regorus/sessions/0f7a9eec-20c7-4b8c-873d-4f5bae8b13c1 Co-authored-by: anakrish <35780660+anakrish@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: anakrish <35780660+anakrish@users.noreply.github.com> |
||
|
Anand Krishnamoorthi
|
4c92fb4d92 |
feat(azure_policy): test runner, compiler fixes, and example program (#700)
Adds the YAML test runner that exercises the companion test data PRs, plus several compiler fixes surfaced during testing: - Removed parameter register caching that produced wrong results inside short-circuiting allOf/anyOf blocks; added literal-index caching for parameter defaults to avoid repeated O(n) literal-table scans - Simplified cross-resource effect details to only emit roleDefinitionIds and type (deployment templates are not evaluated for compliance) - Replaced guid/uniqueString builtins with clear "unsupported" errors - Normalized datetime output to ISO 8601 with Z suffix - Added azure_policy parser MAX_COL constant (8192) for long template expressions, keeping the global DEFAULT_MAX_COL at 1024 - Added rvm to azure_policy feature dependencies since the compiler targets RVM bytecode Also restructures the example binary into examples/regorus/ with new azure-policy-eval and azure-policy-aliases subcommands, adds C# alias normalization tests, and documents Azure Policy support in the README. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|
Anand Krishnamoorthi
|
7f42115b63 |
test(azure_policy): add foundation test cases (#698)
YAML-driven test cases for the core Azure Policy compiler. These cover alias resolution, field conditions, logical operators, type coercion, count expressions, template functions, effect compilation, and policy definition parsing. 24 files, each a self-contained scenario exercised by the test runner in the companion code PR. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|
Anand Krishnamoorthi
|
afdb894d85 |
test(azure_policy): add end-to-end policy test cases (#699)
50 end-to-end test cases derived from real Azure built-in policies. Each file contains a complete policy definition, sample resources, and expected evaluation results. Coverage spans storage, networking, compute, security, monitoring, database, identity, governance, and update management scenarios. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|
Anand Krishnamoorthi
|
b989888dab |
feat(azure-policy): implement effect compilation and metadata population (#691)
Replace the stub implementations in effects.rs, effects_modify_append.rs,
and metadata.rs with full working code.
Effect compilation dispatches all effect kinds (Deny, Audit, Modify, Append,
AuditIfNotExists, DeployIfNotExists, etc.) including parameterized effects
that resolve at runtime via [parameters('effect')]. Cross-resource effects
(AINE/DINE) emit a HostAwait to fetch the related resource and evaluate an
optional existenceCondition against it. Modify and Append effects compile
their operation/detail arrays, including template expressions in values.
Metadata recording tracks which policy features are used during compilation
(field kinds, aliases, operators, resource types, count, wildcards) and
writes them into the program annotations so the runtime can inspect
capabilities without re-analyzing the AST. Definition-level metadata
(display name, category, version, parameter names, etc.) is also extracted.
Detail field values in AINE/DINE (type, name, resourceGroupName) are compiled
as expressions rather than frozen as literals, so template expressions like
[field('name')] are properly evaluated at runtime.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
|
||
|
Anand Krishnamoorthi
|
ad82227ddb |
feat(azure-policy): implement count/count.where compilation (#688)
Implement the full count loop compiler, replacing the stubs in count.rs, count_any.rs, and count_bindings.rs with a single consolidated module. Handles both field-based and value-based count nodes. Field counts walk the resource via resolve_alias_path then iterate the wildcard array; value counts operate on an arbitrary collection expression. For nested wildcard paths like A[*].B[*].C, the compiler emits recursive ForEach loops, drilling one wildcard level at a time. When an outer count binding already covers a prefix, the inner loop starts from the bound element register instead of re-walking from the resource root. Existence patterns (count > 0, count == 0) are recognized and lowered to LoopMode::Any, which exits on the first match rather than counting every element. Count-binding resolution threads the current-element register through inner field references and current() calls so that nested conditions can address fields relative to the loop variable. Also fixes the bound_len arithmetic in conditions_wildcard.rs with a cleaner strip_prefix call, and removes the nested-wildcard bail in split_count_wildcard_path since the compiler now handles them. |
||
|
Anand Krishnamoorthi
|
f50a9744ff |
feat(azure-policy): implement condition, expression, field, and template dispatch compilation (#686)
Fill in the compiler stubs for the evaluation layer. Condition and wildcard compilation: - Compile allOf/anyOf/not constraints, operator conditions with value-condition guards, and implicit allOf for unbound [*] fields via recursive Every loops. - Defensively lowercase prefix/suffix path segments in wildcard handling for consistency with the collect path. Expression and field compilation: - Parse ARM template expressions and dispatch calls to parameters, field, current, resourceGroup, subscription, and others. - Compile all FieldKind variants (type, id, name, location, tags, aliases, dynamic if/concat), resolve resource paths, and collect wildcard values via ForEach loops. Template function dispatch: - Wire up 50+ ARM template functions covering string, numeric, encoding, collection, date/time, logical, and comparison categories. Compiler infrastructure (core.rs): - Add emit helpers: load_literal, emit_builtin_call, emit_chained_index_literal_path, load_input, load_context, emit_coalesce_undefined_to_null, add_literal_u16, and get_or_add_builtin_index. - Add alias resolution via resolve_alias_path and strip_fq_prefix. Misc cleanup: - Handle ARM template `[[` escape sequences in json_value_to_runtime and add a test for it. - Tighten module visibility (pub -> pub(crate)/pub(super)) where appropriate. - Add span context to bail errors in stubs so diagnostics carry source locations. - Take CountBinding by reference in compile_from_binding. - Suppress clippy warnings on the no-op memory_check stub. |
||
|
Anand Krishnamoorthi
|
f727096a1d |
feat(azure-policy): add compiler skeleton with core types and stubs (#674)
Add the compiler module structure with: - core.rs: Compiler struct, CountBinding, new(), compile() pipeline, register allocation, span/emit helpers - mod.rs: module declarations, public entry points (compile_policy_rule, compile_policy_definition, etc.) - utils.rs: pure helper functions (path splitting, JSON conversion) - Stub files for conditions, expressions, fields, template dispatch, count, effects, and metadata — real implementations follow in subsequent commits. |
||
|
Anand Krishnamoorthi
|
ce235356bc |
build: fix rand advisory and harden python CI caching (#675)
Update Cargo.lock to move rand to 0.10.1 so cargo-deny stops failing on RUSTSEC-2026-0097. Also tighten the Python workflow cache boundaries by keying rust-cache to pinned runner images. The workflow now keeps Ubuntu 22.04, Ubuntu 24.04, and Windows 2022 caches separate, which avoids reusing host build artifacts across runner image changes. That is the class of issue behind the intermittent GLIBC mismatch seen in CI. |
||
|
Anand Krishnamoorthi
|
3d34021dea |
azure-policy parser: allow overriding the column-width limit (#673)
Some Azure Policy JSON documents contain very long lines — ARM template expressions with deeply nested if()/concat() calls can easily exceed the default 1024-column lexer limit. Add Parser::new_with_max_col() and corresponding parse_policy_rule_with_max_col() / parse_policy_definition_with_max_col() entry points so callers can raise the limit when needed. Also bump ExprParser's own default to 65536 since template expressions are routinely thousands of characters wide. |
||
|
dependabot[bot]
|
35521ce900 |
build(deps): bump the rust-dependencies group across 5 directories with 6 updates (#671)
Bumps the rust-dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [semver](https://github.com/dtolnay/semver) | `1.0.27` | `1.0.28` | | [jsonschema](https://github.com/Stranger6667/jsonschema) | `0.45.0` | `0.45.1` | | [indexmap](https://github.com/indexmap-rs/indexmap) | `2.13.0` | `2.13.1` | | [toml_edit](https://github.com/toml-rs/toml) | `0.25.10+spec-1.1.0` | `0.25.11+spec-1.1.0` | | [zip](https://github.com/zip-rs/zip2) | `8.5.0` | `8.5.1` | Bumps the rust-dependencies group with 3 updates in the /bindings/ffi directory: [semver](https://github.com/dtolnay/semver), [jsonschema](https://github.com/Stranger6667/jsonschema) and [indexmap](https://github.com/indexmap-rs/indexmap). Bumps the rust-dependencies group with 3 updates in the /bindings/java directory: [semver](https://github.com/dtolnay/semver), [jsonschema](https://github.com/Stranger6667/jsonschema) and [indexmap](https://github.com/indexmap-rs/indexmap). Bumps the rust-dependencies group with 4 updates in the /bindings/python directory: [semver](https://github.com/dtolnay/semver), [jsonschema](https://github.com/Stranger6667/jsonschema), [indexmap](https://github.com/indexmap-rs/indexmap) and [pyo3](https://github.com/pyo3/pyo3). Bumps the rust-dependencies group with 3 updates in the /bindings/wasm directory: [semver](https://github.com/dtolnay/semver), [jsonschema](https://github.com/Stranger6667/jsonschema) and [indexmap](https://github.com/indexmap-rs/indexmap). Updates `semver` from 1.0.27 to 1.0.28 - [Release notes](https://github.com/dtolnay/semver/releases) - [Commits](https://github.com/dtolnay/semver/compare/1.0.27...1.0.28) Updates `jsonschema` from 0.45.0 to 0.45.1 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/ruby-v0.45.0...ruby-v0.45.1) Updates `indexmap` from 2.13.0 to 2.13.1 - [Changelog](https://github.com/indexmap-rs/indexmap/blob/main/RELEASES.md) - [Commits](https://github.com/indexmap-rs/indexmap/compare/2.13.0...2.13.1) Updates `toml_edit` from 0.25.10+spec-1.1.0 to 0.25.11+spec-1.1.0 - [Commits](https://github.com/toml-rs/toml/compare/v0.25.10...v0.25.11) Updates `zip` from 8.5.0 to 8.5.1 - [Release notes](https://github.com/zip-rs/zip2/releases) - [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md) - [Commits](https://github.com/zip-rs/zip2/compare/v8.5.0...v8.5.1) Updates `semver` from 1.0.27 to 1.0.28 - [Release notes](https://github.com/dtolnay/semver/releases) - [Commits](https://github.com/dtolnay/semver/compare/1.0.27...1.0.28) Updates `jsonschema` from 0.45.0 to 0.45.1 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/ruby-v0.45.0...ruby-v0.45.1) Updates `indexmap` from 2.13.0 to 2.13.1 - [Changelog](https://github.com/indexmap-rs/indexmap/blob/main/RELEASES.md) - [Commits](https://github.com/indexmap-rs/indexmap/compare/2.13.0...2.13.1) Updates `semver` from 1.0.27 to 1.0.28 - [Release notes](https://github.com/dtolnay/semver/releases) - [Commits](https://github.com/dtolnay/semver/compare/1.0.27...1.0.28) Updates `jsonschema` from 0.45.0 to 0.45.1 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/ruby-v0.45.0...ruby-v0.45.1) Updates `indexmap` from 2.13.0 to 2.13.1 - [Changelog](https://github.com/indexmap-rs/indexmap/blob/main/RELEASES.md) - [Commits](https://github.com/indexmap-rs/indexmap/compare/2.13.0...2.13.1) Updates `semver` from 1.0.27 to 1.0.28 - [Release notes](https://github.com/dtolnay/semver/releases) - [Commits](https://github.com/dtolnay/semver/compare/1.0.27...1.0.28) Updates `jsonschema` from 0.45.0 to 0.45.1 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/ruby-v0.45.0...ruby-v0.45.1) Updates `indexmap` from 2.13.0 to 2.13.1 - [Changelog](https://github.com/indexmap-rs/indexmap/blob/main/RELEASES.md) - [Commits](https://github.com/indexmap-rs/indexmap/compare/2.13.0...2.13.1) Updates `pyo3` from 0.28.2 to 0.28.3 - [Release notes](https://github.com/pyo3/pyo3/releases) - [Changelog](https://github.com/PyO3/pyo3/blob/main/CHANGELOG.md) - [Commits](https://github.com/pyo3/pyo3/compare/v0.28.2...v0.28.3) Updates `semver` from 1.0.27 to 1.0.28 - [Release notes](https://github.com/dtolnay/semver/releases) - [Commits](https://github.com/dtolnay/semver/compare/1.0.27...1.0.28) Updates `jsonschema` from 0.45.0 to 0.45.1 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/ruby-v0.45.0...ruby-v0.45.1) Updates `indexmap` from 2.13.0 to 2.13.1 - [Changelog](https://github.com/indexmap-rs/indexmap/blob/main/RELEASES.md) - [Commits](https://github.com/indexmap-rs/indexmap/compare/2.13.0...2.13.1) --- updated-dependencies: - dependency-name: semver dependency-version: 1.0.28 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.45.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: indexmap dependency-version: 2.13.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: toml_edit dependency-version: 0.25.11+spec-1.1.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: zip dependency-version: 8.5.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: semver dependency-version: 1.0.28 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.45.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: indexmap dependency-version: 2.13.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: semver dependency-version: 1.0.28 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.45.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: indexmap dependency-version: 2.13.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: semver dependency-version: 1.0.28 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.45.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: indexmap dependency-version: 2.13.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: pyo3 dependency-version: 0.28.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: semver dependency-version: 1.0.28 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.45.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: indexmap dependency-version: 2.13.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
478a88430e |
ci(deps): bump ruby/setup-ruby in the github-actions group (#670)
Bumps the github-actions group with 1 update: [ruby/setup-ruby](https://github.com/ruby/setup-ruby).
Updates `ruby/setup-ruby` from 1.299.0 to 1.300.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](
|
||
|
Anand Krishnamoorthi
|
b9eca934a8 |
build(csharp): prepare NuGet package for nuget.org publishing (#668)
* build(csharp): rename NuGet package to Microsoft.Regorus Align the NuGet package identity with the Microsoft.Regorus namespace and the Microsoft.* reserved prefix on nuget.org in preparation for publishing the package. - Add explicit <PackageId>Microsoft.Regorus</PackageId> - Update PackageVersion in Directory.Packages.props - Update version bump regex for new package name * build(csharp): default to ProjectReference for in-repo consumers Use ProjectReference for Regorus.Tests, Benchmarks, TestApp, and TargetExampleApp so that local development does not require a pre-built .nupkg. PackageReference mode remains available via /p:UsePackageReference=true for validating the packaged NuGet. * build(csharp): add nuget.config with source mapping and xtask integration Add explicit NuGet configuration to ensure in-repo builds always resolve Microsoft.Regorus from the locally built package, even after the package is published on nuget.org. - Add nuget.config with <clear/> and packageSourceMapping - Update xtask to copy .nupkg into local-packages/ directory - Pass /p:UsePackageReference=true from xtask for CI testing - Add restore validation step to the xtask test flow - Add .gitignore for the local-packages directory |
||
|
Anand Krishnamoorthi
|
4d35744c4f |
feat(rvm): implement Azure Policy condition evaluation (#661)
Add VM support for Azure Policy's condition operators and allOf/anyOf short-circuit logic, gated behind cfg(feature = "azure_policy"). Policy conditions (equals, contains, like, match, exists, and their negations — 21 total) are encoded as a single PolicyCondition instruction with a PolicyOp sub-opcode rather than bloating the Instruction enum with 21 variants. The dispatch handles Azure Policy's quirky comparison semantics: case-insensitive string comparison, string↔number coercion, null vs undefined distinction, and element-wise collection membership. allOf/anyOf blocks use four instructions — LogicalBlockStart, AllOfNext/AnyOfNext, and LogicalBlockEnd — that wire up a result register and short-circuit on the first failing (allOf) or passing (anyOf) child. Helper functions for case-folded comparison, wildcard/glob matching, and type coercion live in builtins::azure_policy::helpers. Two YAML test suites (~2200 lines) exercise the full operator matrix and the allOf/anyOf control flow. |
||
|
Mark Birger
|
83ce8c3580 |
Fix RVM evaluation of default-only rules (#664)
Default-only rules (e.g., `default deny := true` with no conditional body) returned Undefined in the RVM instead of the default value. Compiler: - compute_rule_type: return Complete when rule exists only in default_rules map - compile_worklist_rule: emit register slots and data-tree entries for default-only rules (else branch) VM: - execute_call_rule_common + execute_call_rule_suspendable: check default_literal_index before returning Undefined when definitions is empty Tests: - 3 new RVM cases (default_rules.yaml): bool, object, entry-point - 3 new interpreter cases (default/basic.yaml): matching coverage Co-authored-by: Mark Birger <markbirger@microsoft.com> |
||
|
Anand Krishnamoorthi
|
e5ac9a2734 |
feat(rvm): new instructions and loop semantics for Azure Policy support (#659)
The Rego VM was designed around Rego's semantics, but Azure Policy needs a few things Rego doesn't: host-supplied context alongside input/data, undefined-to-null coercion for missing fields, skip-undefined collection behavior for wildcard aliases, and non-vacuous iteration over non-array values. This commit adds five new instructions to bridge those gaps: LoadContext / LoadMetadata — give programs access to host-supplied evaluation context and cached program metadata at runtime. ArrayPushDefined — like ArrayPush but silently drops undefined values, so wildcard alias collection (field[*].property) excludes absent nested properties instead of leaking undefined entries into the array. ReturnUndefinedIfNotTrue — early return with Undefined when a guard condition isn't satisfied, without tripping a VM assertion failure. This models "condition doesn't match" cleanly. CoalesceUndefinedToNull — turns Undefined into Null in-place so that downstream builtins see null rather than short-circuiting on undefined. The loop engine also gains an Azure Policy mode: when the source language is "azure_policy", an Every loop over a non-array value (scalars, null, objects) iterates once over a virtual Null element instead of being vacuously true. This matches how field[*] behaves on non-array fields in Azure Policy — the condition body runs once against Null, which typically evaluates to false. On the plumbing side: the VM gets a context field with set_context(), metadata is cached as a Value on program load, and map_limit_error is inlined into memory_check since it had only one call site. Four new YAML test suites (~880 lines) cover the new instructions and context/metadata loading, along with instruction parser, display, and assembly listing support for everything added here. |
||
|
Anand Krishnamoorthi
|
8f740e2f6f |
feat(azure-policy): add policy rule and policy definition parsers (#660)
Extend the Azure Policy parser to handle complete policyRule and
policyDefinition JSON structures, not just standalone constraints.
Policy rule parser (policy_rule.rs):
- Parse top-level { "if": ..., "then": ... } objects
- Extract effect kind (deny, audit, append, modify, etc.) into typed AST
- Parse "details" structurally when it is an object to pull out
existenceCondition as a first-class Constraint; fall back to opaque
JSON for non-object details (e.g. append array form)
- Detect duplicate/missing keys for "if", "then", "effect", "details"
Policy definition parser (policy_definition.rs):
- Handle both wrapped ARM envelope ({ "properties": { ... } }) and
unwrapped (properties-level keys at top level) forms
- Type-extract displayName, description, mode, metadata, parameters,
and policyRule; everything else goes into extra
- Parse parameter definitions with type, defaultValue, allowedValues,
and metadata; detect duplicate parameter names
- Duplicate key detection throughout
Grammar documentation (docs/azure-policy/azurepolicy.ebnf):
- Add formal EBNF grammar covering policy-rule, then-block,
constraints, conditions, all 19 operators, count expressions,
JSON values, and ARM template expressions
Test harness changes:
- Add parse_level field to YAML test cases: "constraint" (default),
"policy_rule", or "policy_definition"
- Un-skip three parse_errors cases that needed policy_rule-level parsing
- Add policy_rule.yaml with 12 cases covering all 9 effect kinds,
existenceCondition, parameterized effects, complex conditions, and
extra key handling
- Add policy_definition.yaml with wrapped, unwrapped, parameterized,
missing-policyRule, and duplicate-key error cases
|
||
|
Anand Krishnamoorthi
|
687be2850b |
feat: add Azure Policy constraint parser (#658)
Add constraint.rs module that parses Azure Policy JSON constraints into span-annotated AST nodes: - Logical combinators: allOf, anyOf, not - Leaf conditions: field/value with all 19 operators - Count blocks: field-count and value-count with where clauses Public API: parse_constraint() parses a standalone constraint from JSON. Includes YAML-driven test suite with 6 test files covering operators, fields, expressions, logical combinators, count, and parse errors. |
||
|
Anand Krishnamoorthi
|
95bffcb5f9 |
feat(rvm): extend program metadata and bump serialization to v6 (#654)
Add typed metadata support to RVM programs so that language frontends can store language identity and arbitrary annotations alongside the compiled bytecode. Program metadata: - Add `language` field to identify the source language (e.g. "rego", "azure_policy") so the VM can adjust semantics at runtime - Add `annotations` map (BTreeMap<String, MetadataValue>) for frontend-specific key-value metadata - Add MetadataValue enum with String, Bool, Integer, Float, Array, and Object variants, plus full serde support - Add to_value() conversion for runtime access from VM instructions - Add has_host_await flag with recompute_host_await_presence() Serialization: - Bump binary format version from 5 to 6 - Add JSON serialization for the new metadata fields Assembly listing: - Display language and annotations in the program header Compiler: - Track has_host_await during Rego compilation |
||
|
dependabot[bot]
|
db8a9abf13 |
build(deps): bump minitest in /bindings/ruby in the per-dependency group (#656)
Bumps the per-dependency group in /bindings/ruby with 1 update: [minitest](https://github.com/minitest/minitest). Updates `minitest` from 6.0.2 to 6.0.3 - [Changelog](https://github.com/minitest/minitest/blob/master/History.rdoc) - [Commits](https://github.com/minitest/minitest/compare/v6.0.2...v6.0.3) --- updated-dependencies: - dependency-name: minitest dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: per-dependency ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
421ee6af9b |
build(deps): bump the rust-dependencies group across 2 directories with 3 updates (#657)
Bumps the rust-dependencies group with 2 updates in the / directory: [toml_edit](https://github.com/toml-rs/toml) and [zip](https://github.com/zip-rs/zip2). Bumps the rust-dependencies group with 1 update in the /bindings/wasm directory: [wasm-bindgen-test](https://github.com/wasm-bindgen/wasm-bindgen). Updates `toml_edit` from 0.25.8+spec-1.1.0 to 0.25.10+spec-1.1.0 - [Commits](https://github.com/toml-rs/toml/compare/v0.25.8...v0.25.10) Updates `zip` from 8.4.0 to 8.5.0 - [Release notes](https://github.com/zip-rs/zip2/releases) - [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md) - [Commits](https://github.com/zip-rs/zip2/compare/v8.4.0...v8.5.0) Updates `wasm-bindgen-test` from 0.3.66 to 0.3.67 - [Release notes](https://github.com/wasm-bindgen/wasm-bindgen/releases) - [Changelog](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/CHANGELOG.md) - [Commits](https://github.com/wasm-bindgen/wasm-bindgen/commits) --- updated-dependencies: - dependency-name: toml_edit dependency-version: 0.25.10+spec-1.1.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: zip dependency-version: 8.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: wasm-bindgen-test dependency-version: 0.3.67 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Anand Krishnamoorthi
|
64f71dee34 |
feat: add Azure Policy core JSON parser and expression parser (#655)
Add the foundational parsing infrastructure for Azure Policy JSON: - ExprParser: ARM template expression parser for "[...]" strings, supporting function calls, dot access, index access, and literals - Parser (core): recursive-descent JSON tokenizer-to-AST parser that reads directly from Lexer tokens with no intermediate serde_json step - ParseError: structured error types with span context for diagnostics - Helper functions: field classification, operator kind parsing, and ARM template expression detection These components are consumed by the policy-aware parsing modules (constraint, policy_rule, policy_definition) in a subsequent PR. |
||
|
Anand Krishnamoorthi
|
648ba40126 |
feat: add Azure Policy AST types (#653)
Add span-annotated AST types for Azure Policy conditions and rules. - PolicyDefinition, PolicyRule with if/then/details structure - Condition enum: field conditions, value conditions, logical combinators (allOf, anyOf, not), and count expressions - Operator enums for all 19 Azure Policy constraint operators (equals, contains, greater, matchInsensitively, etc.) - Expr enum for field references, literal values (number, string, bool), template function calls, and policy function invocations - Value types with span tracking for error reporting |
||
|
Anand Krishnamoorthi
|
126cc12eb5 |
refactor: consolidate RVM instruction variants and clean up VM internals (#651)
Merge the three separate Assert* instructions (AssertNot, AssertCondition,
AssertNotUndefined) into a single `Guard { register, mode }` instruction
with a GuardMode enum. This cuts duplicated match arms across display,
listing, parser, dispatch, and all compiler emit sites.
Drop the unnecessary `#[repr(C)]` from the Instruction enum. It was never
exposed across FFI, so the C-compatible 4-byte discriminant was pure waste.
Without it Rust picks a 1-byte discriminant, shrinking every instruction
from 8 bytes to 6. A new `instruction_size` unit test locks this at 6.
While touching these files, also clean up several long-standing issues:
- Deduplicate the iteration-state setup in loops.rs by extracting a shared
resolve_iteration_state() helper -- the stack-based and stackless paths
had near-identical 40-line blocks.
- Collapse the ExitWithSuccess / ExitWithFailure match arms into one.
- In rules.rs, stop cloning Arc<Program> just to borrow a RuleInfo -- clone
the small RuleInfo struct directly and extract a get_rule_info() helper.
- Move the memory check into dispatch (runs per instruction) and remove the
now-dead enforce_memory_check() entry-point calls.
- Apply map_or_else style throughout listing.rs for consistency.
|
||
|
dependabot[bot]
|
1a8fc08773 |
build(deps): bump wasm-bindgen-test (#650)
Bumps the rust-dependencies group with 1 update in the /bindings/wasm directory: [wasm-bindgen-test](https://github.com/wasm-bindgen/wasm-bindgen). Updates `wasm-bindgen-test` from 0.3.65 to 0.3.66 - [Release notes](https://github.com/wasm-bindgen/wasm-bindgen/releases) - [Changelog](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/CHANGELOG.md) - [Commits](https://github.com/wasm-bindgen/wasm-bindgen/commits) --- updated-dependencies: - dependency-name: wasm-bindgen-test dependency-version: 0.3.66 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
c164917d63 |
build(deps): bump rb_sys in /bindings/ruby in the per-dependency group (#649)
Bumps the per-dependency group in /bindings/ruby with 1 update: [rb_sys](https://github.com/oxidize-rb/rb-sys). Updates `rb_sys` from 0.9.124 to 0.9.125 - [Release notes](https://github.com/oxidize-rb/rb-sys/releases) - [Commits](https://github.com/oxidize-rb/rb-sys/compare/v0.9.124...v0.9.125) --- updated-dependencies: - dependency-name: rb_sys dependency-version: 0.9.125 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: per-dependency ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
6a6cc659b7 |
build(deps): bump the rust-dependencies group across 3 directories with 4 updates (#647)
Bumps the rust-dependencies group with 2 updates in the / directory: [toml_edit](https://github.com/toml-rs/toml) and [zip](https://github.com/zip-rs/zip2). Bumps the rust-dependencies group with 1 update in the /bindings/python directory: [ordered-float](https://github.com/reem/rust-ordered-float). Bumps the rust-dependencies group with 1 update in the /bindings/wasm directory: [wasm-bindgen-test](https://github.com/wasm-bindgen/wasm-bindgen). Updates `toml_edit` from 0.22.27 to 0.25.8+spec-1.1.0 - [Commits](https://github.com/toml-rs/toml/compare/v0.22.27...v0.25.8) Updates `zip` from 0.6.6 to 8.4.0 - [Release notes](https://github.com/zip-rs/zip2/releases) - [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md) - [Commits](https://github.com/zip-rs/zip2/commits/v8.4.0) Updates `ordered-float` from 5.2.0 to 5.3.0 - [Release notes](https://github.com/reem/rust-ordered-float/releases) - [Commits](https://github.com/reem/rust-ordered-float/compare/v5.2.0...v5.3.0) Updates `wasm-bindgen-test` from 0.3.64 to 0.3.65 - [Release notes](https://github.com/wasm-bindgen/wasm-bindgen/releases) - [Changelog](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/CHANGELOG.md) - [Commits](https://github.com/wasm-bindgen/wasm-bindgen/commits) --- updated-dependencies: - dependency-name: toml_edit dependency-version: 0.25.8+spec-1.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: zip dependency-version: 8.4.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: rust-dependencies - dependency-name: ordered-float dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: wasm-bindgen-test dependency-version: 0.3.65 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
a86cf1119f |
ci(deps): bump the github-actions group across 1 directory with 3 updates (#646)
Bumps the github-actions group with 3 updates in the / directory: [actions/setup-go](https://github.com/actions/setup-go), [github/codeql-action](https://github.com/github/codeql-action) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `actions/setup-go` from 6.3.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits]( |