dependabot[bot]
6608a9f05e
ci(deps): bump the github-actions group across 1 directory with 11 updates ( #763 )
...
Bumps the github-actions group with 11 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout ) | `6` | `7` |
| [actions/setup-python](https://github.com/actions/setup-python ) | `6.2.0` | `7.0.0` |
| [actions/setup-java](https://github.com/actions/setup-java ) | `5.2.0` | `5.6.0` |
| [actions/setup-go](https://github.com/actions/setup-go ) | `6.4.0` | `7.0.0` |
| [actions/setup-dotnet](https://github.com/actions/setup-dotnet ) | `5.2.0` | `6.0.0` |
| [actions/setup-node](https://github.com/actions/setup-node ) | `6.4.0` | `7.0.0` |
| [github/codeql-action/init](https://github.com/github/codeql-action ) | `4.35.2` | `4.37.3` |
| [ruby/setup-ruby](https://github.com/ruby/setup-ruby ) | `1.306.0` | `1.321.0` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action ) | `4.35.2` | `4.37.3` |
| [MarcoIeni/release-plz-action](https://github.com/marcoieni/release-plz-action ) | `0.5.128` | `0.5.131` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ) | `4.35.2` | `4.37.3` |
Updates `actions/checkout` from 6 to 7
- [Release notes](https://github.com/actions/checkout/releases )
- [Commits](https://github.com/actions/checkout/compare/v6...v7 )
Updates `actions/setup-python` from 6.2.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases )
- [Commits](a309ff8b42...5fda3b95a4https://github.com/actions/setup-java/releases )
- [Commits](be666c2fcd...03ad4de099https://github.com/actions/setup-go/releases )
- [Commits](4a3601121d...b7ad1dad31https://github.com/actions/setup-dotnet/releases )
- [Commits](c2fa09f4bd...a98b56852chttps://github.com/actions/setup-node/releases )
- [Commits](48b55a011b...8207627860https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](95e58e9a2c...e4fba868fahttps://github.com/ruby/setup-ruby/releases )
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb )
- [Commits](c4e5b13161...95ef2b042fhttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](95e58e9a2c...e4fba868fahttps://github.com/marcoieni/release-plz-action/releases )
- [Commits](1528104d2c...2eb1d8bcb7https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](95e58e9a2c...e4fba868fasupport@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-24 18:19:20 -07:00
dependabot[bot]
3c3cafcb90
ci(deps): bump the github-actions group across 1 directory with 5 updates ( #690 )
...
Bumps the github-actions group with 5 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [actions/setup-node](https://github.com/actions/setup-node ) | `6.3.0` | `6.4.0` |
| [github/codeql-action](https://github.com/github/codeql-action ) | `4.35.1` | `4.35.2` |
| [ruby/setup-ruby](https://github.com/ruby/setup-ruby ) | `1.300.0` | `1.306.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact ) | `7.0.0` | `7.0.1` |
| [PyO3/maturin-action](https://github.com/pyo3/maturin-action ) | `1.50.1` | `1.51.0` |
Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](53b83947a5...48b55a011bhttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](c10b8064de...95e58e9a2chttps://github.com/ruby/setup-ruby/releases )
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb )
- [Commits](e65c17d16e...c4e5b13161https://github.com/actions/upload-artifact/releases )
- [Commits](bbbca2ddaa...043fb46d1ahttps://github.com/pyo3/maturin-action/releases )
- [Commits](04ac600d27...e83996d129support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-30 15:45:19 -05:00
Anand Krishnamoorthi
b9eca934a8
build(csharp): prepare NuGet package for nuget.org publishing ( #668 )
...
* build(csharp): rename NuGet package to Microsoft.Regorus
Align the NuGet package identity with the Microsoft.Regorus
namespace and the Microsoft.* reserved prefix on nuget.org
in preparation for publishing the package.
- Add explicit <PackageId>Microsoft.Regorus</PackageId>
- Update PackageVersion in Directory.Packages.props
- Update version bump regex for new package name
* build(csharp): default to ProjectReference for in-repo consumers
Use ProjectReference for Regorus.Tests, Benchmarks, TestApp,
and TargetExampleApp so that local development does not require
a pre-built .nupkg. PackageReference mode remains available via
/p:UsePackageReference=true for validating the packaged NuGet.
* build(csharp): add nuget.config with source mapping and xtask integration
Add explicit NuGet configuration to ensure in-repo builds always
resolve Microsoft.Regorus from the locally built package, even
after the package is published on nuget.org.
- Add nuget.config with <clear/> and packageSourceMapping
- Update xtask to copy .nupkg into local-packages/ directory
- Pass /p:UsePackageReference=true from xtask for CI testing
- Add restore validation step to the xtask test flow
- Add .gitignore for the local-packages directory
2026-04-09 16:40:31 -05:00
dependabot[bot]
ac701b4933
ci(deps): bump the github-actions group with 11 updates ( #628 )
...
Bumps the github-actions group with 11 updates:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout ) | `4` | `6` |
| [Swatinem/rust-cache](https://github.com/swatinem/rust-cache ) | `2.8.2` | `2.9.1` |
| [actions/setup-go](https://github.com/actions/setup-go ) | `6.2.0` | `6.3.0` |
| [actions/setup-dotnet](https://github.com/actions/setup-dotnet ) | `5.1.0` | `5.2.0` |
| [actions/setup-node](https://github.com/actions/setup-node ) | `6.2.0` | `6.3.0` |
| [github/codeql-action](https://github.com/github/codeql-action ) | `4.32.4` | `4.34.1` |
| [ruby/setup-ruby](https://github.com/ruby/setup-ruby ) | `1.288.0` | `1.295.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact ) | `6.0.0` | `7.0.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact ) | `7.0.0` | `8.0.1` |
| [PyO3/maturin-action](https://github.com/pyo3/maturin-action ) | `1.50.0` | `1.50.1` |
| [MarcoIeni/release-plz-action](https://github.com/marcoieni/release-plz-action ) | `0.5.127` | `0.5.128` |
Updates `actions/checkout` from 4 to 6
- [Release notes](https://github.com/actions/checkout/releases )
- [Commits](https://github.com/actions/checkout/compare/v4...v6 )
Updates `Swatinem/rust-cache` from 2.8.2 to 2.9.1
- [Release notes](https://github.com/swatinem/rust-cache/releases )
- [Changelog](https://github.com/Swatinem/rust-cache/blob/master/CHANGELOG.md )
- [Commits](779680da71...c19371144dhttps://github.com/actions/setup-go/releases )
- [Commits](7a3fe6cf4c...4b73464bb3https://github.com/actions/setup-dotnet/releases )
- [Commits](baa11fbfe1...c2fa09f4bdhttps://github.com/actions/setup-node/releases )
- [Commits](6044e13b5d...53b83947a5https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](89a39a4e59...3869755554https://github.com/ruby/setup-ruby/releases )
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb )
- [Commits](09a7688d3b...319994f95fhttps://github.com/actions/upload-artifact/releases )
- [Commits](b7c566a772...bbbca2ddaahttps://github.com/actions/download-artifact/releases )
- [Commits](37930b1c2a...3e5f45b2cfhttps://github.com/pyo3/maturin-action/releases )
- [Commits](b1bd829e37...04ac600d27https://github.com/marcoieni/release-plz-action/releases )
- [Commits](f708778669...1528104d2csupport@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-24 12:35:38 -05:00
dependabot[bot]
4054d1b6b6
build(deps): bump the per-dependency group with 12 updates ( #593 )
...
Bumps the per-dependency group with 12 updates:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout ) | `4.3.1` | `6.0.2` |
| [actions/setup-python](https://github.com/actions/setup-python ) | `5.6.0` | `6.2.0` |
| [actions/setup-java](https://github.com/actions/setup-java ) | `4.8.0` | `5.2.0` |
| [actions/setup-go](https://github.com/actions/setup-go ) | `5.1.0` | `6.2.0` |
| [actions/setup-dotnet](https://github.com/actions/setup-dotnet ) | `4.1.0` | `5.1.0` |
| [actions/setup-node](https://github.com/actions/setup-node ) | `4.4.0` | `6.2.0` |
| [github/codeql-action](https://github.com/github/codeql-action ) | `3.32.2` | `4.32.2` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact ) | `4.6.2` | `6.0.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact ) | `5.0.0` | `7.0.0` |
| [PyO3/maturin-action](https://github.com/pyo3/maturin-action ) | `63b75c597b83e247fbf4fb7719801cc4220ae9f3` | `b1bd829e37fef14c63f19162034228a2f3dc1021` |
| [MarcoIeni/release-plz-action](https://github.com/marcoieni/release-plz-action ) | `0.5.108` | `0.5.126` |
| [oxidize-rb/actions](https://github.com/oxidize-rb/actions ) | `1.2.6` | `1.4.4` |
Updates `actions/checkout` from 4.3.1 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](34e114876b...de0fac2e45https://github.com/actions/setup-python/releases )
- [Commits](a26af69be9...a309ff8b42https://github.com/actions/setup-java/releases )
- [Commits](https://github.com/actions/setup-java/compare/v4.8.0...be666c2fcd27ec809703dec50e508c2fdc7f6654 )
Updates `actions/setup-go` from 5.1.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/v5.1.0...7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 )
Updates `actions/setup-dotnet` from 4.1.0 to 5.1.0
- [Release notes](https://github.com/actions/setup-dotnet/releases )
- [Commits](https://github.com/actions/setup-dotnet/compare/v4.1.0...baa11fbfe1d6520db94683bd5c7a3818018e4309 )
Updates `actions/setup-node` from 4.4.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](49933ea528...6044e13b5dhttps://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/v3.32.2...45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 )
Updates `actions/upload-artifact` from 4.6.2 to 6.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](ea165f8d65...b7c566a772https://github.com/actions/download-artifact/releases )
- [Commits](634f93cb29...37930b1c2ahttps://github.com/pyo3/maturin-action/releases )
- [Commits](63b75c597b...b1bd829e37https://github.com/marcoieni/release-plz-action/releases )
- [Commits](8724d33cd9...52440b50d3https://github.com/oxidize-rb/actions/releases )
- [Commits](7ca44a16e2...e5f9a49a78support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-12 06:30:19 -06:00
Anand Krishnamoorthi
8f7ca44bdf
chore(dependabot): expand coverage and pin workflows ( #579 )
...
- Expand dependabot coverage across Rust subcrates and other ecosystems.
- Group updates per dependency and ignore vendored mimalloc crates.
- Pin GitHub Actions to exact SHAs in existing workflows.
2026-02-11 17:43:48 -06:00
Anand Krishnamoorthi
455d2aa588
chore(nuget): Add support for macosx ( #553 )
...
Additionally
- Include more metadata in nuget package
- Also generate snupkg for native symbols.
We intentionally don't add the symbols for native rust shared library
to the nuget package since that could increase the size of the nuget.
We will revisit that later.
- update licenses of all the bindings.
closes #551
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2026-02-03 00:09:52 +05:30
Anand Krishnamoorthi
e68e852ee3
feat(xtask): consolidate CI workflows onto xtask helpers ( #542 )
...
- split the xtask crate into structured modules for
- bindings
- ci
- dev
- util
- no-std
- Adding commands for
- ci-release/ci-debug
- MUSL/no-std
- per- binding language smoke tests
- developer tasks (fmt, clippy, pre-commit, pre-push)
- refresh Cargo manifests/locks, binding readmes, and shared FFI helpers so every binding reuses the same preparation steps
- refactor GitHub Actions (release/debug, extensions, CodeQL, clippy, bindings) to call the new xtask commands
- Use rust-cache in ci workflows (microsoft qdk also does this)
- extend README with a contributor workflow section describing how xtask mirrors CI expectations
- update pre-commit and pre-push hooks to use the xtask dev commands
WORKAROUND:
When dotnet is run from an xtask, codeql tracer intercepts it an routes to a nonexistent binary.
Therefore in codeql workflow, xtask is not used for c# and instead dotnet is directly invoked.
Tracked by #545
closes #475
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2026-01-27 07:42:21 +05:30
Anand Krishnamoorthi
fd59bb5a91
feat(memory): Allocator-backed global memory limits ( #544 )
...
Policy evaluation at scale needs to be able to set memory limits
so that a bad policy does not hog memory or to ensure that
policy evaluation itself does not use too much memory which could
cause other components to suffer.
This PR introduces capability to set and enforce global memory limits.
It also lays the groundwork for enabling per evaluation limits in future.
Once a global memory limit is set, Regorus maintains per thread counters
to track memory activity (allocation, deallocation) of a thread.
These counters are periodically flushed to global memory counters.
Per thread counters avoid the contention that updating global counters
on each alloc/free would cause.
Policy evaluation periodically checks these counters and raises errors
if allocated memory has exceeded the configured limit.
Currently memory limit capability is exposed only to FFI and C#.
Also update mimalloc to v2.2.6
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2026-01-24 07:08:54 +05:30
Anand Krishnamoorthi
80686d6ed1
feat(ffi): unwind safety: shield FFI entrypoints with panic guard ( #546 )
...
This PR implements widely accepted Rust programming practices for
dealing with panics across ABI (programming language) boundaries.
- Add panic_guard.rs to wrap FFI calls and prevent panic across FFI/ABI boundary (undefined behavior).
- Capture per-thread backtraces via a temporary panic hook
- After a panic, subsequent invocations are poisoned.
- Integrate with_unwind_guard across the engine, schema registry, and target registry exportis
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2026-01-21 09:20:10 +05:30
Anand Krishnamoorthi
c43c94559a
feat: modernize GitHub Actions with security hardening and centralized Rust toolchain ( #470 )
...
Security Improvements:
- Pin all GitHub Actions to specific commit hashes instead of version tags
- Update actions/checkout from v4 to commit 08eba0b27e820071cde6df949e0beb9ba4906955
- Update actions/setup-python from v5 to commit a26af69be951a213d495a4c3e4e4022e16d87065 (v5.6.0)
- Update actions/setup-java from v4 to commit dded0888837ed1f317902acf8a20df0ad188d165 (v5.0.0)
- Update actions/setup-node from v4 to commit 1e60f620b9541d16bece96c5465dc8ee9832be0b (v4.4.0)
- Update actions/setup-go from v5 to commit 41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed (v5.1.0)
- Update actions/setup-dotnet from v4 to commit 3e891b0cb619bf60e2c25674b222b8940e2c1c25 (v4.1.0)
- Update actions/upload-artifact from v4 to commit ea165f8d65b6e75b540449e92b4886f43607fa02 (v4.6.2)
- Update actions/download-artifact from v4 to commit 634f93cb2916e3fdff6788551b99b062d0335ce0 (v5.0.0)
- Update github/codeql-action from v3 to commit 01fe2e8c43536ad5e1085bad5e7cd6fbc8a30988 (v3.29.11)
Rust Toolchain Consolidation:
- Create custom composite action .github/actions/toolchains/rust/action.yml
- Standardize on Rust 1.89.0 (latest stable) with clippy and rustfmt components
- Add optional targets parameter for cross-compilation support
- Replace dtolnay/rust-toolchain@stable across 16 workflows
This creates a more secure, maintainable, and consistent CI/CD pipeline
with centralized Rust toolchain management across all workflows.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-08-26 12:42:02 -05:00
Anand Krishnamoorthi
cc917ea75d
feat: Complete target system with C# bindings and resource inference ( #458 )
...
* feat: Add Schema Registry and Validation Framework
This commit introduces a comprehensive schema registry and validation framework, providing schema-based validation of resources and policy effects.
- Thread-safe, in-memory registry for schema storage and management
- Global registry patterns for effects and resources
- Concurrent access with proper error handling
- Unicode schema names support
- JSON Schema-compliant validation for all primitive types
- Advanced constraint validation (patterns, ranges, length limits)
- Discriminated union support with anyOf schemas
- Detailed error reporting with nested validation paths
- Discriminated subobject validation for polymorphic schemas
- **Registry Tests**: All registry operations
- **Effect Tests**: Policy effect validation
- **Resource Tests**: Resource validation
- **Validation Tests**: Core validation engine
- Thread-safety, error handling, integration scenarios, edge cases
- **Dependencies**: dashmap, once_cell, regex
- **Thread Safety**: Minimal locking with Rc<Schema> sharing
- **Error Types**: TypeMismatch, OutOfRange, PatternMismatch, etc.
- Complete schema registry and validation subsystem
- Comprehensive test coverage
- Foundation for policy validation in Regorus
Benchmarks:
- Criterion benchmarks for basic types, effects and Azure resources
- Performance range: 3.22ns (string) to 34.74µs (Azure VM resource schema validation)
- String withs patterns validation: 30.2µs. Need to explore whether regex caching helps
bring this down.
- Azure policy effects: 188ns-1.4µs
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
* feat: Complete target system with C# bindings and resource inference
- Add comprehensive target system with TargetRegistry and target-aware compilation
- Implement resource type inference from policy equality expressions
- Create modular C# bindings with separate wrapper classes for each concept
- Add thread-safe CompiledPolicy with reference counting for safe disposal
- Enhance FFI with detailed error propagation and target functionality
- Create TargetExampleApp demonstrating Azure Policy integration
- Add CI/CD pipeline testing for all C# applications
- Support target definitions with schema validation and resource selectors
- Implement PolicyModule struct and target-aware compilation methods
- Add comprehensive test coverage for target functionality
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
---------
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-08-19 20:23:43 -05:00
Denis Komissarov
c5b2b0df97
build: Run format and clippy during C# binding build ( #451 )
2025-08-04 19:57:38 -05:00
Denis Komissarov
168b2a9c88
build: Support manually generating C# bindings via Github action and add a README ( #423 )
2025-07-03 12:31:32 -05:00
Anand Krishnamoorthi
8ee1cf3298
fix: Clippy warnings ( #424 )
...
Also schedule works to be run at 8:00 AM everyday.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-07-02 20:04:27 -05:00
Anthony Martin
962c0cc459
Add C# test examples ( #397 )
2025-04-23 08:01:51 -05:00
Anand Krishnamoorthi
c28bde3f56
build: Check-in Cargo.lock files and lockdown .net ( #384 )
...
Use frozen and locked builds
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-03-31 07:55:47 -07:00
Anand Krishnamoorthi
2858b63cd4
feat: Regorus nuget package ( #383 )
...
Organize C# binding example into separate Regorus nuget package and
a test app.
The nuget package targets netstandard 2.0 and 2.1.
The test app is tested for netframework 8.0.
Implement IDisposable for Engine cleanup.
Also remove net40 example. Can be added back later if needed.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2025-03-25 11:31:13 -07:00
Jie Yang
fb5151e0e4
add extension_list example ( #281 )
...
- Created an example of extension policy
- Added C# binding support of .NET framework 4.0 and created a Nuget
spec for it.
- Added a pytest in python bindings to test the extension policy and the
python binding
- Restructured the example and Csharp binding directories due to above
changes.
- Added copyrights.
- Added a Windows workflow for .NET 4.0 build and test.
2024-07-16 11:08:37 +05:30
Anand Krishnamoorthi
9894f00829
Fix bindings and add CI tests ( #247 )
...
Also update version numbers of binding Rust projects to match Regorus
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com >
2024-05-22 08:15:42 -07:00
