mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
83ce8c35800a21a3ad4ab30a0842eacbd36283c8
454 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Mark Birger
|
83ce8c3580 |
Fix RVM evaluation of default-only rules (#664)
Default-only rules (e.g., `default deny := true` with no conditional body) returned Undefined in the RVM instead of the default value. Compiler: - compute_rule_type: return Complete when rule exists only in default_rules map - compile_worklist_rule: emit register slots and data-tree entries for default-only rules (else branch) VM: - execute_call_rule_common + execute_call_rule_suspendable: check default_literal_index before returning Undefined when definitions is empty Tests: - 3 new RVM cases (default_rules.yaml): bool, object, entry-point - 3 new interpreter cases (default/basic.yaml): matching coverage Co-authored-by: Mark Birger <markbirger@microsoft.com> |
||
|
Anand Krishnamoorthi
|
e5ac9a2734 |
feat(rvm): new instructions and loop semantics for Azure Policy support (#659)
The Rego VM was designed around Rego's semantics, but Azure Policy needs a few things Rego doesn't: host-supplied context alongside input/data, undefined-to-null coercion for missing fields, skip-undefined collection behavior for wildcard aliases, and non-vacuous iteration over non-array values. This commit adds five new instructions to bridge those gaps: LoadContext / LoadMetadata — give programs access to host-supplied evaluation context and cached program metadata at runtime. ArrayPushDefined — like ArrayPush but silently drops undefined values, so wildcard alias collection (field[*].property) excludes absent nested properties instead of leaking undefined entries into the array. ReturnUndefinedIfNotTrue — early return with Undefined when a guard condition isn't satisfied, without tripping a VM assertion failure. This models "condition doesn't match" cleanly. CoalesceUndefinedToNull — turns Undefined into Null in-place so that downstream builtins see null rather than short-circuiting on undefined. The loop engine also gains an Azure Policy mode: when the source language is "azure_policy", an Every loop over a non-array value (scalars, null, objects) iterates once over a virtual Null element instead of being vacuously true. This matches how field[*] behaves on non-array fields in Azure Policy — the condition body runs once against Null, which typically evaluates to false. On the plumbing side: the VM gets a context field with set_context(), metadata is cached as a Value on program load, and map_limit_error is inlined into memory_check since it had only one call site. Four new YAML test suites (~880 lines) cover the new instructions and context/metadata loading, along with instruction parser, display, and assembly listing support for everything added here. |
||
|
Anand Krishnamoorthi
|
8f740e2f6f |
feat(azure-policy): add policy rule and policy definition parsers (#660)
Extend the Azure Policy parser to handle complete policyRule and
policyDefinition JSON structures, not just standalone constraints.
Policy rule parser (policy_rule.rs):
- Parse top-level { "if": ..., "then": ... } objects
- Extract effect kind (deny, audit, append, modify, etc.) into typed AST
- Parse "details" structurally when it is an object to pull out
existenceCondition as a first-class Constraint; fall back to opaque
JSON for non-object details (e.g. append array form)
- Detect duplicate/missing keys for "if", "then", "effect", "details"
Policy definition parser (policy_definition.rs):
- Handle both wrapped ARM envelope ({ "properties": { ... } }) and
unwrapped (properties-level keys at top level) forms
- Type-extract displayName, description, mode, metadata, parameters,
and policyRule; everything else goes into extra
- Parse parameter definitions with type, defaultValue, allowedValues,
and metadata; detect duplicate parameter names
- Duplicate key detection throughout
Grammar documentation (docs/azure-policy/azurepolicy.ebnf):
- Add formal EBNF grammar covering policy-rule, then-block,
constraints, conditions, all 19 operators, count expressions,
JSON values, and ARM template expressions
Test harness changes:
- Add parse_level field to YAML test cases: "constraint" (default),
"policy_rule", or "policy_definition"
- Un-skip three parse_errors cases that needed policy_rule-level parsing
- Add policy_rule.yaml with 12 cases covering all 9 effect kinds,
existenceCondition, parameterized effects, complex conditions, and
extra key handling
- Add policy_definition.yaml with wrapped, unwrapped, parameterized,
missing-policyRule, and duplicate-key error cases
|
||
|
Anand Krishnamoorthi
|
687be2850b |
feat: add Azure Policy constraint parser (#658)
Add constraint.rs module that parses Azure Policy JSON constraints into span-annotated AST nodes: - Logical combinators: allOf, anyOf, not - Leaf conditions: field/value with all 19 operators - Count blocks: field-count and value-count with where clauses Public API: parse_constraint() parses a standalone constraint from JSON. Includes YAML-driven test suite with 6 test files covering operators, fields, expressions, logical combinators, count, and parse errors. |
||
|
Anand Krishnamoorthi
|
95bffcb5f9 |
feat(rvm): extend program metadata and bump serialization to v6 (#654)
Add typed metadata support to RVM programs so that language frontends can store language identity and arbitrary annotations alongside the compiled bytecode. Program metadata: - Add `language` field to identify the source language (e.g. "rego", "azure_policy") so the VM can adjust semantics at runtime - Add `annotations` map (BTreeMap<String, MetadataValue>) for frontend-specific key-value metadata - Add MetadataValue enum with String, Bool, Integer, Float, Array, and Object variants, plus full serde support - Add to_value() conversion for runtime access from VM instructions - Add has_host_await flag with recompute_host_await_presence() Serialization: - Bump binary format version from 5 to 6 - Add JSON serialization for the new metadata fields Assembly listing: - Display language and annotations in the program header Compiler: - Track has_host_await during Rego compilation |
||
|
dependabot[bot]
|
db8a9abf13 |
build(deps): bump minitest in /bindings/ruby in the per-dependency group (#656)
Bumps the per-dependency group in /bindings/ruby with 1 update: [minitest](https://github.com/minitest/minitest). Updates `minitest` from 6.0.2 to 6.0.3 - [Changelog](https://github.com/minitest/minitest/blob/master/History.rdoc) - [Commits](https://github.com/minitest/minitest/compare/v6.0.2...v6.0.3) --- updated-dependencies: - dependency-name: minitest dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: per-dependency ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
421ee6af9b |
build(deps): bump the rust-dependencies group across 2 directories with 3 updates (#657)
Bumps the rust-dependencies group with 2 updates in the / directory: [toml_edit](https://github.com/toml-rs/toml) and [zip](https://github.com/zip-rs/zip2). Bumps the rust-dependencies group with 1 update in the /bindings/wasm directory: [wasm-bindgen-test](https://github.com/wasm-bindgen/wasm-bindgen). Updates `toml_edit` from 0.25.8+spec-1.1.0 to 0.25.10+spec-1.1.0 - [Commits](https://github.com/toml-rs/toml/compare/v0.25.8...v0.25.10) Updates `zip` from 8.4.0 to 8.5.0 - [Release notes](https://github.com/zip-rs/zip2/releases) - [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md) - [Commits](https://github.com/zip-rs/zip2/compare/v8.4.0...v8.5.0) Updates `wasm-bindgen-test` from 0.3.66 to 0.3.67 - [Release notes](https://github.com/wasm-bindgen/wasm-bindgen/releases) - [Changelog](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/CHANGELOG.md) - [Commits](https://github.com/wasm-bindgen/wasm-bindgen/commits) --- updated-dependencies: - dependency-name: toml_edit dependency-version: 0.25.10+spec-1.1.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: zip dependency-version: 8.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: wasm-bindgen-test dependency-version: 0.3.67 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Anand Krishnamoorthi
|
64f71dee34 |
feat: add Azure Policy core JSON parser and expression parser (#655)
Add the foundational parsing infrastructure for Azure Policy JSON: - ExprParser: ARM template expression parser for "[...]" strings, supporting function calls, dot access, index access, and literals - Parser (core): recursive-descent JSON tokenizer-to-AST parser that reads directly from Lexer tokens with no intermediate serde_json step - ParseError: structured error types with span context for diagnostics - Helper functions: field classification, operator kind parsing, and ARM template expression detection These components are consumed by the policy-aware parsing modules (constraint, policy_rule, policy_definition) in a subsequent PR. |
||
|
Anand Krishnamoorthi
|
648ba40126 |
feat: add Azure Policy AST types (#653)
Add span-annotated AST types for Azure Policy conditions and rules. - PolicyDefinition, PolicyRule with if/then/details structure - Condition enum: field conditions, value conditions, logical combinators (allOf, anyOf, not), and count expressions - Operator enums for all 19 Azure Policy constraint operators (equals, contains, greater, matchInsensitively, etc.) - Expr enum for field references, literal values (number, string, bool), template function calls, and policy function invocations - Value types with span tracking for error reporting |
||
|
Anand Krishnamoorthi
|
126cc12eb5 |
refactor: consolidate RVM instruction variants and clean up VM internals (#651)
Merge the three separate Assert* instructions (AssertNot, AssertCondition,
AssertNotUndefined) into a single `Guard { register, mode }` instruction
with a GuardMode enum. This cuts duplicated match arms across display,
listing, parser, dispatch, and all compiler emit sites.
Drop the unnecessary `#[repr(C)]` from the Instruction enum. It was never
exposed across FFI, so the C-compatible 4-byte discriminant was pure waste.
Without it Rust picks a 1-byte discriminant, shrinking every instruction
from 8 bytes to 6. A new `instruction_size` unit test locks this at 6.
While touching these files, also clean up several long-standing issues:
- Deduplicate the iteration-state setup in loops.rs by extracting a shared
resolve_iteration_state() helper -- the stack-based and stackless paths
had near-identical 40-line blocks.
- Collapse the ExitWithSuccess / ExitWithFailure match arms into one.
- In rules.rs, stop cloning Arc<Program> just to borrow a RuleInfo -- clone
the small RuleInfo struct directly and extract a get_rule_info() helper.
- Move the memory check into dispatch (runs per instruction) and remove the
now-dead enforce_memory_check() entry-point calls.
- Apply map_or_else style throughout listing.rs for consistency.
|
||
|
dependabot[bot]
|
1a8fc08773 |
build(deps): bump wasm-bindgen-test (#650)
Bumps the rust-dependencies group with 1 update in the /bindings/wasm directory: [wasm-bindgen-test](https://github.com/wasm-bindgen/wasm-bindgen). Updates `wasm-bindgen-test` from 0.3.65 to 0.3.66 - [Release notes](https://github.com/wasm-bindgen/wasm-bindgen/releases) - [Changelog](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/CHANGELOG.md) - [Commits](https://github.com/wasm-bindgen/wasm-bindgen/commits) --- updated-dependencies: - dependency-name: wasm-bindgen-test dependency-version: 0.3.66 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
c164917d63 |
build(deps): bump rb_sys in /bindings/ruby in the per-dependency group (#649)
Bumps the per-dependency group in /bindings/ruby with 1 update: [rb_sys](https://github.com/oxidize-rb/rb-sys). Updates `rb_sys` from 0.9.124 to 0.9.125 - [Release notes](https://github.com/oxidize-rb/rb-sys/releases) - [Commits](https://github.com/oxidize-rb/rb-sys/compare/v0.9.124...v0.9.125) --- updated-dependencies: - dependency-name: rb_sys dependency-version: 0.9.125 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: per-dependency ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
6a6cc659b7 |
build(deps): bump the rust-dependencies group across 3 directories with 4 updates (#647)
Bumps the rust-dependencies group with 2 updates in the / directory: [toml_edit](https://github.com/toml-rs/toml) and [zip](https://github.com/zip-rs/zip2). Bumps the rust-dependencies group with 1 update in the /bindings/python directory: [ordered-float](https://github.com/reem/rust-ordered-float). Bumps the rust-dependencies group with 1 update in the /bindings/wasm directory: [wasm-bindgen-test](https://github.com/wasm-bindgen/wasm-bindgen). Updates `toml_edit` from 0.22.27 to 0.25.8+spec-1.1.0 - [Commits](https://github.com/toml-rs/toml/compare/v0.22.27...v0.25.8) Updates `zip` from 0.6.6 to 8.4.0 - [Release notes](https://github.com/zip-rs/zip2/releases) - [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md) - [Commits](https://github.com/zip-rs/zip2/commits/v8.4.0) Updates `ordered-float` from 5.2.0 to 5.3.0 - [Release notes](https://github.com/reem/rust-ordered-float/releases) - [Commits](https://github.com/reem/rust-ordered-float/compare/v5.2.0...v5.3.0) Updates `wasm-bindgen-test` from 0.3.64 to 0.3.65 - [Release notes](https://github.com/wasm-bindgen/wasm-bindgen/releases) - [Changelog](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/CHANGELOG.md) - [Commits](https://github.com/wasm-bindgen/wasm-bindgen/commits) --- updated-dependencies: - dependency-name: toml_edit dependency-version: 0.25.8+spec-1.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: zip dependency-version: 8.4.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: rust-dependencies - dependency-name: ordered-float dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: wasm-bindgen-test dependency-version: 0.3.65 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
a86cf1119f |
ci(deps): bump the github-actions group across 1 directory with 3 updates (#646)
Bumps the github-actions group with 3 updates in the / directory: [actions/setup-go](https://github.com/actions/setup-go), [github/codeql-action](https://github.com/github/codeql-action) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `actions/setup-go` from 6.3.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits]( |
||
|
Anand Krishnamoorthi
|
989ca6df2e |
ci(dependabot): restore cargo dependency grouping (#645)
Without grouping, dependabot creates a separate PR per directory for the same dependency. Each individual PR fails to build due to version skew across the root workspace and binding crates. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> |
||
|
Anand Krishnamoorthi
|
d36f952133 |
feat(azure-policy): add alias normalization and denormalization (#635)
* feat: add Azure Policy alias normalization/denormalization Add normalizer and denormalizer for ARM JSON resources, enabling Azure Policy alias short names to become direct paths into a flat structure. - Normalizer: flattens properties wrappers, lowercases keys, resolves per-alias versioned ARM paths, handles sub-resource array flattening, element-level field remaps, and array base renames - Denormalizer: reverses all transformations with casing restoration - AliasRegistry: loads production alias catalogs and data policy manifests - Types: serde deserialization for ARM provider alias formats - YAML test suite: 13 test files covering normalize, denormalize, round-trip, data-plane, edge cases, malformed input, sub-resources, and registry API - Benchmark suite for normalization performance * feat: add FFI and C# bindings for alias normalization - FFI: alias_registry.rs with C-compatible API for loading catalogs, normalizing resources, and denormalizing back to ARM JSON - C#: AliasRegistry wrapper class with NativeMethods P/Invoke bindings and integration tests - Updated Cargo.lock files for new serde_json dependency |
||
|
Anand Krishnamoorthi
|
35fb5d5953 |
Fix build break (#634)
* fix: update bindings and builtins for breaking dependency upgrades - Update rand 0.10 API: use RngExt trait instead of removed Rng trait - Update jsonschema 0.45 API: replace removed BasicOutput/apply with iter_errors for schema validation - Update jni 0.22 API: migrate from deprecated JNIEnv to EnvUnowned with_env pattern, replace deprecated get_string/new_string/throw methods with their modern equivalents - Update pyo3 0.28 API: replace removed PyObject with Py<PyAny>, deprecated downcast with cast, and removed with_gil with attach Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * ci(dependabot): create per-dependency PRs for Cargo updates Remove the groups.rust-dependencies catch-all group so Dependabot opens a separate PR for each Cargo dependency update instead of bundling them all into a single PR. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * fix: enable getrandom wasm_js feature for wasm32-unknown-unknown builds Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * fix: address PR review comments - Stream iter_errors directly into BTreeSet without intermediate Vec - Use JNI_TRUE/JNI_FALSE for jboolean instead of bool coercion Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> --------- Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> |
||
|
dependabot[bot]
|
296b34171a |
build(deps): bump the rust-dependencies group across 5 directories with 16 updates (#633)
* build(deps): bump the rust-dependencies group across 5 directories with 16 updates Bumps the rust-dependencies group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [anyhow](https://github.com/dtolnay/anyhow) | `1.0.100` | `1.0.102` | | [spin](https://github.com/mvdnes/spin-rs) | `0.9.8` | `0.10.0` | | [regex](https://github.com/rust-lang/regex) | `1.12.2` | `1.12.3` | | [uuid](https://github.com/uuid-rs/uuid) | `1.20.0` | `1.22.0` | | [jsonschema](https://github.com/Stranger6667/jsonschema) | `0.30.0` | `0.45.0` | | [chrono](https://github.com/chronotope/chrono) | `0.4.43` | `0.4.44` | | [ipnet](https://github.com/krisprice/ipnet) | `2.11.0` | `2.12.0` | | [rand](https://github.com/rust-random/rand) | `0.9.2` | `0.10.0` | | [clap](https://github.com/clap-rs/clap) | `4.5.56` | `4.5.60` | | [criterion](https://github.com/criterion-rs/criterion.rs) | `0.8.1` | `0.8.2` | | [toml_edit](https://github.com/toml-rs/toml) | `0.22.27` | `0.25.8+spec-1.1.0` | | [zip](https://github.com/zip-rs/zip2) | `0.6.6` | `8.4.0` | Bumps the rust-dependencies group with 9 updates in the /bindings/ffi directory: | Package | From | To | | --- | --- | --- | | [anyhow](https://github.com/dtolnay/anyhow) | `1.0.100` | `1.0.102` | | [spin](https://github.com/mvdnes/spin-rs) | `0.9.8` | `0.10.0` | | [regex](https://github.com/rust-lang/regex) | `1.12.2` | `1.12.3` | | [uuid](https://github.com/uuid-rs/uuid) | `1.20.0` | `1.22.0` | | [jsonschema](https://github.com/Stranger6667/jsonschema) | `0.30.0` | `0.45.0` | | [chrono](https://github.com/chronotope/chrono) | `0.4.43` | `0.4.44` | | [ipnet](https://github.com/krisprice/ipnet) | `2.11.0` | `2.12.0` | | [rand](https://github.com/rust-random/rand) | `0.9.2` | `0.10.0` | | [clap](https://github.com/clap-rs/clap) | `4.5.56` | `4.6.0` | Bumps the rust-dependencies group with 9 updates in the /bindings/java directory: | Package | From | To | | --- | --- | --- | | [anyhow](https://github.com/dtolnay/anyhow) | `1.0.100` | `1.0.102` | | [spin](https://github.com/mvdnes/spin-rs) | `0.9.8` | `0.10.0` | | [regex](https://github.com/rust-lang/regex) | `1.12.2` | `1.12.3` | | [uuid](https://github.com/uuid-rs/uuid) | `1.20.0` | `1.22.0` | | [jsonschema](https://github.com/Stranger6667/jsonschema) | `0.30.0` | `0.45.0` | | [chrono](https://github.com/chronotope/chrono) | `0.4.43` | `0.4.44` | | [ipnet](https://github.com/krisprice/ipnet) | `2.11.0` | `2.12.0` | | [rand](https://github.com/rust-random/rand) | `0.9.2` | `0.10.0` | | [jni](https://github.com/jni-rs/jni-rs) | `0.21.1` | `0.22.4` | Bumps the rust-dependencies group with 10 updates in the /bindings/python directory: | Package | From | To | | --- | --- | --- | | [anyhow](https://github.com/dtolnay/anyhow) | `1.0.100` | `1.0.102` | | [spin](https://github.com/mvdnes/spin-rs) | `0.9.8` | `0.10.0` | | [regex](https://github.com/rust-lang/regex) | `1.12.2` | `1.12.3` | | [uuid](https://github.com/uuid-rs/uuid) | `1.20.0` | `1.22.0` | | [jsonschema](https://github.com/Stranger6667/jsonschema) | `0.30.0` | `0.45.0` | | [chrono](https://github.com/chronotope/chrono) | `0.4.43` | `0.4.44` | | [ipnet](https://github.com/krisprice/ipnet) | `2.11.0` | `2.12.0` | | [rand](https://github.com/rust-random/rand) | `0.9.2` | `0.10.0` | | [ordered-float](https://github.com/reem/rust-ordered-float) | `5.1.0` | `5.2.0` | | [pyo3](https://github.com/pyo3/pyo3) | `0.24.2` | `0.28.2` | Bumps the rust-dependencies group with 9 updates in the /bindings/wasm directory: | Package | From | To | | --- | --- | --- | | [anyhow](https://github.com/dtolnay/anyhow) | `1.0.100` | `1.0.102` | | [spin](https://github.com/mvdnes/spin-rs) | `0.9.8` | `0.10.0` | | [regex](https://github.com/rust-lang/regex) | `1.12.2` | `1.12.3` | | [uuid](https://github.com/uuid-rs/uuid) | `1.20.0` | `1.22.0` | | [jsonschema](https://github.com/Stranger6667/jsonschema) | `0.30.0` | `0.45.0` | | [chrono](https://github.com/chronotope/chrono) | `0.4.43` | `0.4.44` | | [ipnet](https://github.com/krisprice/ipnet) | `2.11.0` | `2.12.0` | | [rand](https://github.com/rust-random/rand) | `0.9.2` | `0.10.0` | | [wasm-bindgen-test](https://github.com/wasm-bindgen/wasm-bindgen) | `0.3.58` | `0.3.64` | Updates `anyhow` from 1.0.100 to 1.0.102 - [Release notes](https://github.com/dtolnay/anyhow/releases) - [Commits](https://github.com/dtolnay/anyhow/compare/1.0.100...1.0.102) Updates `spin` from 0.9.8 to 0.10.0 - [Changelog](https://github.com/zesterer/spin-rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/mvdnes/spin-rs/commits) Updates `regex` from 1.12.2 to 1.12.3 - [Release notes](https://github.com/rust-lang/regex/releases) - [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-lang/regex/compare/1.12.2...1.12.3) Updates `uuid` from 1.20.0 to 1.22.0 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](https://github.com/uuid-rs/uuid/compare/v1.20.0...v1.22.0) Updates `jsonschema` from 0.30.0 to 0.45.0 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/rust-v0.30.0...ruby-v0.45.0) Updates `chrono` from 0.4.43 to 0.4.44 - [Release notes](https://github.com/chronotope/chrono/releases) - [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md) - [Commits](https://github.com/chronotope/chrono/compare/v0.4.43...v0.4.44) Updates `ipnet` from 2.11.0 to 2.12.0 - [Release notes](https://github.com/krisprice/ipnet/releases) - [Changelog](https://github.com/krisprice/ipnet/blob/master/RELEASES.md) - [Commits](https://github.com/krisprice/ipnet/compare/2.11.0...2.12.0) Updates `rand` from 0.9.2 to 0.10.0 - [Release notes](https://github.com/rust-random/rand/releases) - [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-random/rand/compare/rand_core-0.9.2...0.10.0) Updates `clap` from 4.5.56 to 4.5.60 - [Release notes](https://github.com/clap-rs/clap/releases) - [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md) - [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.5.56...clap_complete-v4.5.60) Updates `criterion` from 0.8.1 to 0.8.2 - [Release notes](https://github.com/criterion-rs/criterion.rs/releases) - [Changelog](https://github.com/criterion-rs/criterion.rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/criterion-rs/criterion.rs/compare/criterion-v0.8.1...criterion-v0.8.2) Updates `toml_edit` from 0.22.27 to 0.25.8+spec-1.1.0 - [Commits](https://github.com/toml-rs/toml/compare/v0.22.27...v0.25.8) Updates `zip` from 0.6.6 to 8.4.0 - [Release notes](https://github.com/zip-rs/zip2/releases) - [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md) - [Commits](https://github.com/zip-rs/zip2/commits/v8.4.0) Updates `anyhow` from 1.0.100 to 1.0.102 - [Release notes](https://github.com/dtolnay/anyhow/releases) - [Commits](https://github.com/dtolnay/anyhow/compare/1.0.100...1.0.102) Updates `spin` from 0.9.8 to 0.10.0 - [Changelog](https://github.com/zesterer/spin-rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/mvdnes/spin-rs/commits) Updates `regex` from 1.12.2 to 1.12.3 - [Release notes](https://github.com/rust-lang/regex/releases) - [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-lang/regex/compare/1.12.2...1.12.3) Updates `uuid` from 1.20.0 to 1.22.0 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](https://github.com/uuid-rs/uuid/compare/v1.20.0...v1.22.0) Updates `jsonschema` from 0.30.0 to 0.45.0 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/rust-v0.30.0...ruby-v0.45.0) Updates `chrono` from 0.4.43 to 0.4.44 - [Release notes](https://github.com/chronotope/chrono/releases) - [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md) - [Commits](https://github.com/chronotope/chrono/compare/v0.4.43...v0.4.44) Updates `ipnet` from 2.11.0 to 2.12.0 - [Release notes](https://github.com/krisprice/ipnet/releases) - [Changelog](https://github.com/krisprice/ipnet/blob/master/RELEASES.md) - [Commits](https://github.com/krisprice/ipnet/compare/2.11.0...2.12.0) Updates `rand` from 0.9.2 to 0.10.0 - [Release notes](https://github.com/rust-random/rand/releases) - [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-random/rand/compare/rand_core-0.9.2...0.10.0) Updates `clap` from 4.5.56 to 4.6.0 - [Release notes](https://github.com/clap-rs/clap/releases) - [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md) - [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.5.56...clap_complete-v4.5.60) Updates `anyhow` from 1.0.100 to 1.0.102 - [Release notes](https://github.com/dtolnay/anyhow/releases) - [Commits](https://github.com/dtolnay/anyhow/compare/1.0.100...1.0.102) Updates `spin` from 0.9.8 to 0.10.0 - [Changelog](https://github.com/zesterer/spin-rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/mvdnes/spin-rs/commits) Updates `regex` from 1.12.2 to 1.12.3 - [Release notes](https://github.com/rust-lang/regex/releases) - [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-lang/regex/compare/1.12.2...1.12.3) Updates `uuid` from 1.20.0 to 1.22.0 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](https://github.com/uuid-rs/uuid/compare/v1.20.0...v1.22.0) Updates `jsonschema` from 0.30.0 to 0.45.0 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/rust-v0.30.0...ruby-v0.45.0) Updates `chrono` from 0.4.43 to 0.4.44 - [Release notes](https://github.com/chronotope/chrono/releases) - [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md) - [Commits](https://github.com/chronotope/chrono/compare/v0.4.43...v0.4.44) Updates `ipnet` from 2.11.0 to 2.12.0 - [Release notes](https://github.com/krisprice/ipnet/releases) - [Changelog](https://github.com/krisprice/ipnet/blob/master/RELEASES.md) - [Commits](https://github.com/krisprice/ipnet/compare/2.11.0...2.12.0) Updates `rand` from 0.9.2 to 0.10.0 - [Release notes](https://github.com/rust-random/rand/releases) - [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-random/rand/compare/rand_core-0.9.2...0.10.0) Updates `jni` from 0.21.1 to 0.22.4 - [Release notes](https://github.com/jni-rs/jni-rs/releases) - [Changelog](https://github.com/jni-rs/jni-rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/jni-rs/jni-rs/compare/v0.21.1...v0.22.4) Updates `anyhow` from 1.0.100 to 1.0.102 - [Release notes](https://github.com/dtolnay/anyhow/releases) - [Commits](https://github.com/dtolnay/anyhow/compare/1.0.100...1.0.102) Updates `spin` from 0.9.8 to 0.10.0 - [Changelog](https://github.com/zesterer/spin-rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/mvdnes/spin-rs/commits) Updates `regex` from 1.12.2 to 1.12.3 - [Release notes](https://github.com/rust-lang/regex/releases) - [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-lang/regex/compare/1.12.2...1.12.3) Updates `uuid` from 1.20.0 to 1.22.0 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](https://github.com/uuid-rs/uuid/compare/v1.20.0...v1.22.0) Updates `jsonschema` from 0.30.0 to 0.45.0 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/rust-v0.30.0...ruby-v0.45.0) Updates `chrono` from 0.4.43 to 0.4.44 - [Release notes](https://github.com/chronotope/chrono/releases) - [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md) - [Commits](https://github.com/chronotope/chrono/compare/v0.4.43...v0.4.44) Updates `ipnet` from 2.11.0 to 2.12.0 - [Release notes](https://github.com/krisprice/ipnet/releases) - [Changelog](https://github.com/krisprice/ipnet/blob/master/RELEASES.md) - [Commits](https://github.com/krisprice/ipnet/compare/2.11.0...2.12.0) Updates `rand` from 0.9.2 to 0.10.0 - [Release notes](https://github.com/rust-random/rand/releases) - [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-random/rand/compare/rand_core-0.9.2...0.10.0) Updates `ordered-float` from 5.1.0 to 5.2.0 - [Release notes](https://github.com/reem/rust-ordered-float/releases) - [Commits](https://github.com/reem/rust-ordered-float/compare/v5.1.0...v5.2.0) Updates `pyo3` from 0.24.2 to 0.28.2 - [Release notes](https://github.com/pyo3/pyo3/releases) - [Changelog](https://github.com/PyO3/pyo3/blob/main/CHANGELOG.md) - [Commits](https://github.com/pyo3/pyo3/compare/v0.24.2...v0.28.2) Updates `anyhow` from 1.0.100 to 1.0.102 - [Release notes](https://github.com/dtolnay/anyhow/releases) - [Commits](https://github.com/dtolnay/anyhow/compare/1.0.100...1.0.102) Updates `spin` from 0.9.8 to 0.10.0 - [Changelog](https://github.com/zesterer/spin-rs/blob/master/CHANGELOG.md) - [Commits](https://github.com/mvdnes/spin-rs/commits) Updates `regex` from 1.12.2 to 1.12.3 - [Release notes](https://github.com/rust-lang/regex/releases) - [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-lang/regex/compare/1.12.2...1.12.3) Updates `uuid` from 1.20.0 to 1.22.0 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](https://github.com/uuid-rs/uuid/compare/v1.20.0...v1.22.0) Updates `jsonschema` from 0.30.0 to 0.45.0 - [Release notes](https://github.com/Stranger6667/jsonschema/releases) - [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md) - [Commits](https://github.com/Stranger6667/jsonschema/compare/rust-v0.30.0...ruby-v0.45.0) Updates `chrono` from 0.4.43 to 0.4.44 - [Release notes](https://github.com/chronotope/chrono/releases) - [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md) - [Commits](https://github.com/chronotope/chrono/compare/v0.4.43...v0.4.44) Updates `ipnet` from 2.11.0 to 2.12.0 - [Release notes](https://github.com/krisprice/ipnet/releases) - [Changelog](https://github.com/krisprice/ipnet/blob/master/RELEASES.md) - [Commits](https://github.com/krisprice/ipnet/compare/2.11.0...2.12.0) Updates `rand` from 0.9.2 to 0.10.0 - [Release notes](https://github.com/rust-random/rand/releases) - [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md) - [Commits](https://github.com/rust-random/rand/compare/rand_core-0.9.2...0.10.0) Updates `wasm-bindgen-test` from 0.3.58 to 0.3.64 - [Release notes](https://github.com/wasm-bindgen/wasm-bindgen/releases) - [Changelog](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/CHANGELOG.md) - [Commits](https://github.com/wasm-bindgen/wasm-bindgen/commits) --- updated-dependencies: - dependency-name: anyhow dependency-version: 1.0.102 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: regex dependency-version: 1.12.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: uuid dependency-version: 1.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: chrono dependency-version: 0.4.44 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: ipnet dependency-version: 2.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: rand dependency-version: 0.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: clap dependency-version: 4.5.60 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: criterion dependency-version: 0.8.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: toml_edit dependency-version: 0.25.8+spec-1.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: zip dependency-version: 8.4.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: rust-dependencies - dependency-name: anyhow dependency-version: 1.0.102 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: regex dependency-version: 1.12.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: uuid dependency-version: 1.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: chrono dependency-version: 0.4.44 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: ipnet dependency-version: 2.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: rand dependency-version: 0.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: clap dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: anyhow dependency-version: 1.0.102 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: regex dependency-version: 1.12.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: uuid dependency-version: 1.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: chrono dependency-version: 0.4.44 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: ipnet dependency-version: 2.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: rand dependency-version: 0.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: jni dependency-version: 0.22.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: anyhow dependency-version: 1.0.102 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: regex dependency-version: 1.12.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: uuid dependency-version: 1.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: chrono dependency-version: 0.4.44 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: ipnet dependency-version: 2.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: rand dependency-version: 0.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: ordered-float dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: pyo3 dependency-version: 0.28.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: anyhow dependency-version: 1.0.102 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: spin dependency-version: 0.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: regex dependency-version: 1.12.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: uuid dependency-version: 1.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: jsonschema dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: chrono dependency-version: 0.4.44 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies - dependency-name: ipnet dependency-version: 2.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: rand dependency-version: 0.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-dependencies - dependency-name: wasm-bindgen-test dependency-version: 0.3.64 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): refresh Cargo lockfiles --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
Anand Krishnamoorthi
|
f9d54cd436 | ci(dependabot): fix cargo config quoting (#632) | ||
|
Anand Krishnamoorthi
|
5b60daabd9 |
feat: add Azure Policy builtins with YAML test suite (#630)
* feat: add Azure Policy builtins with YAML test suite Implement ARM template functions for Azure Policy evaluation: Builtins: - String: indexOf, lastIndexOf, trim, format, split, startsWith, endsWith, padLeft, concat, replace, toLower, toUpper, substring, guid, uniqueString - DateTime: dateTimeAdd, dateTimeFromEpoch, dateTimeToEpoch, addDays - Collection: intersection, union, take, skip, first, last, min, max, range, items, tryGet, tryIndexFromEnd, empty, array, createObject - Encoding: base64, base64ToString, base64ToJson, uri, uriComponent, uriComponentToString, dataUri, dataUriToString - Numeric: int, float, intDiv, intMod - Misc: json, join, bool, string, coalesce, if, getParameter, resolveField - Logic: logicAll, logicAny Key implementation details: - Unicode case-insensitive search via ICU4X case folding with single-pass fold_with_char_map() for indexOf/lastIndexOf - .NET composite formatting (System.String.Format) with alignment, standard and custom datetime format specifiers, numeric format specifiers - DateTime round-trip preserves input shape (Z vs +00:00, T vs space, fractional seconds) when no explicit output format is supplied - Zero-cost as_str() helper borrows directly from Value::String(Rc<str>) - BTreeSet<&Value> in array union avoids redundant cloning Test suite: - 53 YAML test files exercising all builtins via direct BUILTINS registry - Coverage for edge cases: empty inputs, Unicode, fractional seconds, invalid alignment, unknown format specifiers, RFC3339 offset shapes Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * fix: address PR review comments - Fix percent_encode to only uppercase hex digits, not entire string - Remove guid/uniqueString (unsupported); delete custom SHA-1 impl - Replace unwrap_or(0) with proper error in format placeholder parsing - Hoist CaseMapper into static CaseMapperBorrowed for zero per-call overhead - Pre-allocate Vec in range() with_capacity - Update bindings/ffi and bindings/ruby Cargo.lock - Fix uri_component test expectations for correct case preservation Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * fix: address second round of PR review comments - float(): return Undefined when as_f64() fails instead of leaking the original non-f64 representation - createObject(): reject odd number of arguments with an error (ARM-template parity) - format(): error on unknown numeric format specifiers instead of silently passing through (matches .NET FormatException behavior) - format(): cap alignment width at 10,000 to prevent DoS from user-controlled format strings like {0,1000000000} - Add YAML test cases for all new error behaviors Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * fix: address third round of PR review comments - percent_decode: reject incomplete % escapes (e.g. "%", "%2") instead of treating them as literal characters - parse_iso8601_duration: reject leftover digits without a unit designator at T boundary and end-of-input (e.g. "P1", "P1T2H") - yaml_to_value: panic on unsupported YAML numeric representations instead of silently mapping to Null - Revert unused src/languages/mod.rs changes (module is defined inline in lib.rs) Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * fix: add missing edge-case tests and fix empty-delimiter panic - fn_split: return input as single-element array for empty string delimiter instead of panicking (Rust's str::split("") panics) - format: add test for F3 higher precision ({0:F3} + 1.23456 → 1.235) - format: add test for N2 float with thousands separator - format: add test for negative index error ({-1}) - split: add test for empty-string delimiter - uri: add tests for query string and fragment in relative URI - createObject: add test for non-string (numeric) keys Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * fix: address fourth round of PR review comments - Add MAX_VARIADIC_ARGS (64) constant for variadic builtin arity instead of registering with 0 (logic_all, logic_any, min, max, format, intersection, union, coalesce, createObject); set dateTimeAdd to exact arity 3 - Switch indexOf/lastIndexOf to UTF-16 code-unit indices to match .NET String.IndexOf semantics (track ch.len_utf16() in fold_with_char_map, use encode_utf16().count() for empty-needle lastIndexOf) - Use DateTime::<Utc>::from_timestamp for explicit timezone type - Remove stale docs/azure-policy/casing.md link from module doc - Fix misleading comment in want_error test branch (code bails on Undefined, not accepts it) Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> --------- Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> |
||
|
Anand Krishnamoorthi
|
f69974dc1b |
ci(dependabot): fix cargo workspace updates and refresh lockfiles (#629)
* ci(dependabot): fix cargo workspace updates and refresh lockfiles Remove nested Cargo workspace members from Dependabot's cargo directories to avoid manifest resolution failures during grouped updates. Add a Dependabot-only workflow that refreshes affected Cargo lockfiles, including the no_std target-specific resolution path, so CI can continue enforcing --locked and --frozen builds. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * ci(dependabot): address workflow review comments Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * ci(dependabot): address workflow permission and toolchain comments Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * ci(dependabot): stage no-std lockfile refresh Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * ci(dependabot): harden refresh workflow * ci(dependabot): refine workflow gating and staging * ci(dependabot): harden workflow git operations --------- Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> |
||
|
dependabot[bot]
|
942dd47163 |
build(deps): bump rubocop in /bindings/ruby in the per-dependency group (#622)
Bumps the per-dependency group in /bindings/ruby with 1 update: [rubocop](https://github.com/rubocop/rubocop). Updates `rubocop` from 1.85.0 to 1.85.1 - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](https://github.com/rubocop/rubocop/compare/v1.85.0...v1.85.1) --- updated-dependencies: - dependency-name: rubocop dependency-version: 1.85.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: per-dependency ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
ac701b4933 |
ci(deps): bump the github-actions group with 11 updates (#628)
Bumps the github-actions group with 11 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4` | `6` | | [Swatinem/rust-cache](https://github.com/swatinem/rust-cache) | `2.8.2` | `2.9.1` | | [actions/setup-go](https://github.com/actions/setup-go) | `6.2.0` | `6.3.0` | | [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `5.1.0` | `5.2.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.2.0` | `6.3.0` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.32.4` | `4.34.1` | | [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.288.0` | `1.295.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6.0.0` | `7.0.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `7.0.0` | `8.0.1` | | [PyO3/maturin-action](https://github.com/pyo3/maturin-action) | `1.50.0` | `1.50.1` | | [MarcoIeni/release-plz-action](https://github.com/marcoieni/release-plz-action) | `0.5.127` | `0.5.128` | Updates `actions/checkout` from 4 to 6 - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v4...v6) Updates `Swatinem/rust-cache` from 2.8.2 to 2.9.1 - [Release notes](https://github.com/swatinem/rust-cache/releases) - [Changelog](https://github.com/Swatinem/rust-cache/blob/master/CHANGELOG.md) - [Commits]( |
||
|
Anand Krishnamoorthi
|
86088d2049 |
Consolidate Dependabot, fix #595 (mimalloc + indexmap), add feature-matrix CI (#627)
* build: consolidate dependabot cargo entries and add commit prefixes Consolidate all 9 separate cargo ecosystem entries into a single entry using the 'directories' key. This ensures Dependabot creates one PR per dependency update across the root workspace and all bindings, preventing version skew that caused build failures. Also add semantic commit-message prefixes to all ecosystem entries: - build(deps) for cargo, gomod, maven, nuget, pip, bundler - ci(deps) for github-actions Rename the cargo group to 'rust-dependencies' and the github-actions group to 'github-actions' for clarity. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * fix: remove mimalloc from default features, fix indexmap/std propagation Address #595: the vendored mimalloc allocator should not be imposed on library consumers. Remove allocator-memory-limits and mimalloc from the full-opa feature so that users of regorus as a library can choose their own global allocator. Bindings (ffi, java, python, ruby) that ship as standalone artifacts continue to opt in to regorus/allocator-memory-limits explicitly so they retain the performant allocator. Also propagate indexmap/std via the std feature (using the indexmap?/std weak-dependency syntax) so that users enabling std + rvm without default features no longer hit 'IndexMap takes 3 generic arguments' errors. Closes #595 Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * ci: add feature-combination checks to PR CI and weekly matrix PR CI (xtask): add cargo check for 5 non-default feature combos in run_ci_suite(). These run on every PR and catch compile failures from feature-gating issues (e.g. #595) with near-zero overhead. Weekly workflow: new feature-matrix.yml runs cargo build + cargo test across 9 feature combinations every Monday. Uses a GitHub Actions matrix with fail-fast: false so all combos are tested even if one fails. Combinations tested weekly: - std,arc (minimal library) - std,arc,rvm (common library usage) - std,arc,full-opa (full-opa without mimalloc) - std,arc,full-opa,allocator-memory-limits (binding-style) - std,arc,rvm,regex,time,semver,cache (cherry-picked builtins) - std,arc,rvm,coverage,cache (observability) - std,arc,full-opa,azure_policy (Azure Policy) - std,arc,full-opa,azure-rbac (Azure RBAC) - arc,opa-no-std (no_std codepath) Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * fix: gate benchmark memory-limit calls behind allocator-memory-limits feature The set_global_memory_limit function is only available when the allocator-memory-limits feature is enabled. After removing mimalloc from the default feature set, the rvm_benchmark failed to compile. Add #[cfg(feature = "allocator-memory-limits")] guards around the call sites and the MEMORY_LIMIT_BYTES constant. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> --------- Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> |
||
|
Anand Krishnamoorthi
|
83891d7782 |
RVM compiler & runtime optimizations: caching, instruction fusion, constant hoisting, and correctness fixes (#626)
* perf!: add LRU caches for compiled regex and glob patterns
Add bounded LRU caches for compiled regex and glob patterns used by
Rego builtins, avoiding repeated recompilation of the same patterns
during policy evaluation.
New `cache` feature (included in `full-opa` and `opa-no-std`) backed by
the `lru` crate (no_std compatible) with `spin::Mutex` for thread safety.
- `src/cache.rs`: generic `LruCache<V>` wrapper, global `REGEX_CACHE`
(default capacity 256) and `GLOB_CACHE` (default capacity 128)
- `src/builtins/regex.rs`: all regex builtins route through the cache
- `src/builtins/glob.rs`: glob.match routes through the cache
- Public API: `regorus::cache::{Config, configure, clear}`
Compilation costs avoided per cache hit:
regex 10-55 µs (simple to complex patterns)
glob 10-12 µs
LRU hit ~10 ns
BREAKING CHANGE: new `cache` Cargo feature added to `full-opa` and
`opa-no-std` feature sets; adds `lru` as a dependency.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
* perf(vm): amortize per-instruction memory and time limit checks
Deduplicate per-instruction memory_check calls by hoisting them to the
main dispatch loop, and amortize monotonic_now() syscalls in the
execution timer by checking elapsed time every N instructions instead
of on every tick.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
* fix(vm): correct object membership to check values only, not keys
The Contains instruction for objects was checking both keys and values:
object_fields.contains_key(v) || object_fields.values().any(|v| ...)
Per the Rego specification, `x in obj` tests whether x is a VALUE of
the object, not a key. The two-argument form `k, v in obj` is needed
to access keys. The interpreter already implemented this correctly
(values-only scan), but the RVM had the extra contains_key() check
which would incorrectly return true when the search value happened to
match a key name.
Remove the contains_key() branch so the behavior matches the interpreter
and the Rego spec. Add two regression tests:
- object_membership_checks_values_not_keys: "foo" in {"foo": "bar"}
must be false (key, not a value)
- object_membership_finds_value: "bar" in {"foo": "bar"} must be true
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
* perf(compiler): hoist all-constant collection literals to the literal table
When an array, set, or object literal consists entirely of compile-time
constant expressions (numbers, strings, bools, null, and nested constant
collections), the compiler now evaluates them at compile time and emits a
single Load instruction from the literal table instead of generating
per-element instructions at runtime.
Previously, a Rego expression like `x in [1, 2, 3]` would emit
ArrayCreate + three Load + three ArrayAppend instructions, allocating a
new Vec and Rc on every evaluation. With this change, the entire array
is built once during compilation and loaded as a single constant.
This optimization applies to all three collection types:
- Array literals: avoids ArrayCreate + N x (Load + ArrayAppend)
- Set literals: avoids SetCreate + N x (Load + SetAdd)
- Object literals: avoids ObjectCreate + N x (Load + Load + ObjectInsert)
The implementation adds a try_eval_const() helper that recursively
evaluates an AST expression as a constant Value, returning None if any
sub-expression is non-constant. Each compile method for collection
literals attempts the all-constant fast path first and falls through to
the existing instruction-by-instruction codegen otherwise.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
* perf(compiler): fuse Eq + AssertCondition into AssertEq instruction
Add a new `AssertEq { left, right }` instruction that combines equality
comparison and condition assertion into a single operation. This replaces
the previous two-instruction pattern of `Eq { dest, left, right }` followed
by `AssertCondition { condition: dest }`, saving one instruction and one
register per equality assertion.
The fused instruction checks two registers for equality and directly calls
handle_condition with the result, avoiding the intermediate boolean
register entirely. If either operand is undefined or the values differ,
the condition fails and the rule/loop backtracks.
The optimization applies to four destructuring sites:
- EqualityCheck (assignment re-binding with `x = expr; x = expr`)
- EqualityExpr (destructuring against an expression)
- EqualityValue (destructuring against a literal value)
- assert_array_length (array length validation in destructuring)
In soft_assert_mode the compiler still emits the original Eq instruction
since the boolean result register is needed by callers.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
* perf(compiler): fuse Not + AssertCondition into AssertNot instruction
Add a new `AssertNot { operand }` instruction that combines logical
negation and condition assertion into a single operation. This replaces
the previous two-instruction pattern of `Not { dest, operand }` followed
by `AssertCondition { condition: dest }`, saving one instruction and one
register allocation.
The fused instruction checks the operand register and passes the
condition if the value is false or undefined (per Rego semantics where
`not expr` succeeds when the expression has no results or is false),
and fails the condition if the value is true or any non-boolean truthy
value.
This was the only emission site for the Not+AssertCondition pair,
occurring in the compilation of `Literal::NotExpr` statements.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
* perf(vm): early exit for same-value multi-definition rules
When a rule has multiple definitions that all produce the same value
(e.g. implicit true, or identical literal), set early_exit_on_first_success
on RuleInfo so the VM can stop after the first successful definition.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
* feat!: expose cache configuration API to all language bindings
Add `set_cache_config` and `clear_cache` functions to every binding
so callers can tune or reset the global regex/glob pattern caches
introduced in the cache feature.
Bindings updated:
- FFI (C): `regorus_set_cache_config`, `regorus_clear_cache`
- C++ header: free functions `regorus::set_cache_config`, `regorus::clear_cache`
- Python: module-level `set_cache_config(*, regex, glob)`, `clear_cache()`
- Java: static methods on new `CacheConfig` class
- Go: package-level `SetCacheConfig`, `ClearCache`
- Ruby: module functions `Regorus.set_cache_config`, `Regorus.clear_cache`
- WASM: free functions `setCacheConfig`, `clearCache`
- C#: static methods `Engine.SetCacheConfig`, `Engine.ClearCache`
BREAKING CHANGE: Bump SERIALIZATION_VERSION from 4 to 5 due to new
AssertEq and AssertNot instruction variants added in the instruction
fusion commits. Programs serialized with version 5 cannot be loaded
by older versions of regorus.
* fix: address PR review feedback
Cache subsystem:
- Gate REGEX_CACHE and related imports behind #[cfg(feature = "regex")]
so that building with --features cache without regex compiles correctly.
- Gate LruCache struct behind #[cfg(any(feature = "regex", feature = "glob"))].
- Add Config::MAX_CAPACITY (2^16) hard upper bound; clamp values in
configure() to prevent unbounded cache growth.
- Use parking_lot::Mutex for std builds and spin::Mutex for no_std to
avoid CPU spinning under contention in tight regex/glob eval loops.
- Narrow lock scopes in regex/glob builtins: release the mutex before
compiling a pattern, then re-acquire to insert.
Java JNI binding:
- Fix cache config overflow: negative jlong values now saturate to 0
and positive overflow saturates to usize::MAX (then clamped by
MAX_CAPACITY) instead of silently disabling the cache.
- Gate JNI cache config/clear functions behind #[cfg(feature = "cache")].
Compiler:
- Refactor static_value_of_expr to delegate to try_eval_const,
gaining support for negated numbers and constant collections.
- Make try_eval_const pub(in crate::languages::rego::compiler) and
re-export through expressions.rs.
- Handle Expr::UnaryExpr with numeric literals in try_eval_const so
collections containing negated numbers (e.g. [-1, 2]) are hoisted.
VM correctness:
- Fix Not instruction to follow Rego semantics: not expr yields
true when expr is undefined or false, false for any other defined
value (including non-booleans) -- no longer errors on non-boolean
operands.
- Add enforce_memory_check() call at execute_suspendable_entry to
ensure memory limits are checked before the first instruction.
- Update AssertNot listing comment to "exit if any defined truthy
value" to match actual VM behaviour.
- Add doc comment on Not instruction clarifying Rego negation
semantics.
Bindings:
- Fix C++ header indentation for set_cache_config / clear_cache.
- Propagate Cargo.lock parking_lot addition across ffi, java, python,
and wasm binding lockfiles.
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
---------
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
|
||
|
antmhs
|
898643129e |
feat: make policy length limits configurable per engine (#624)
- Add PolicyLengthConfig struct with max_col, max_file_bytes, and max_lines fields, replacing hardcoded constants in the lexer. - Add Engine::set_policy_length_config and clear_policy_length_config to allow callers to override the default limits. - Add Source::from_contents_with_limits and from_file_with_limits for direct Source construction with custom limits; existing from_contents and from_file signatures are preserved using defaults. - Add tests for default rejection, custom limits, and engine plumbing. - Add bindings for C, C++, Python, WASM/JS, Java, Ruby, C#, Go |
||
|
Anand Krishnamoorthi
|
50c0215fdb |
Rvm optimizations (#620)
* perf(rvm): fix O(n²) comprehension yield by mutating in-place Instead of cloning the entire accumulator collection on every yield iteration, use take_register + Rc::make_mut to get exclusive ownership and mutate in-place. This reduces comprehension yield from O(n²) to O(n) for both run-to-completion and suspendable execution modes. - Add RegoVM::take_register() helper that swaps register with Undefined - Comprehension yield now takes the accumulator, mutates via Rc::make_mut, and writes back — avoiding deep clones when refcount == 1 Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * perf(rvm): use take_register for ObjectSet, ArrayPush, SetAdd These instructions were cloning the container register (bumping Rc to 2), then calling as_object_mut/as_array_mut/as_set_mut which invokes Rc::make_mut — deep-cloning the entire collection since refcount > 1. Use take_register instead so the Rc refcount stays at 1, making Rc::make_mut a no-op and allowing in-place mutation. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * perf(rvm): remove unnecessary clones in rule caching - execute_call_rule_common: move final_value into cache instead of cloning, since it is not used afterwards - finalize_rule_frame_data: add comment clarifying the clone is needed because the value is both cached and returned - Remove unnecessary .clone() on result_from_rule when setting register Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * rvm: avoid RuleInfo clone per rule call Replace RuleInfo.clone() (which heap-allocates name, destructuring_blocks, and potentially function_info) with a cheap Arc<Program> clone (atomic refcount bump) followed by borrowing &RuleInfo from the local Arc. This eliminates per-rule-call heap allocations. Sites changed: - execute_call_rule_common: Arc clone + borrow - execute_call_rule_suspendable: Arc clone + borrow - finalize_rule_frame_data: Arc clone + borrow - handle_rule_break_event: inline Arc clone + borrow (was get_rule_info) - handle_rule_error_event: inline Arc clone + borrow (was get_rule_info) - Removed now-unused get_rule_info method Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * rvm: replace bincode with postcard for serialization Remove unlinked bincode dependency. Use postcard (already a dep for rvm feature) for all binary serialization/deserialization in program serialization and tests. Also adds rvm_benchmark benchmark. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * perf(rvm): cache dummy Span/Expr for builtin calls Every builtin call was allocating a Source (via from_contents), a Span, and N Ref<Expr> wrappers just to satisfy the builtin function signature. These dummy values are only used for error reporting context. Cache the dummy Span and Vec<Ref<Expr>> on the RegoVM struct. The Source and Span are created once on first builtin call; dummy Expr entries grow as needed and are reused across calls via mem::take/put-back pattern. This eliminates per-builtin-call heap allocations for Source (Rc + String + Vec<lines>), Span clones, and Rc<Expr> wrappers. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * perf(rvm): round 2 allocation reduction in builtins, entry points, virtual data - Cache builtin args Vec on RegoVM (mem::take/clear/put-back pattern) - Restructure builtins_cache as two-level map for clone-free lookup - Use IndexMap::get_index() in execute_entry_point_by_index - Use mutable Vec path stack in traverse_rule_tree_subobject (push/pop) - Walk data tree and rule-result paths by reference, clone only leaf - Use mem::replace in resume() instead of cloning ExecutionState Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * fix(rvm): address PR review feedback - Restore cached_builtin_args on all error/early-return paths in execute_builtin_call to preserve allocation reuse - Use 1-based line/col and \"<builtin>\" filename in dummy span for clearer diagnostics - Restore result register before returning errors in comprehension mode-mismatch branches (both run-to-completion and suspendable) - Avoid clone in resume() invalid-state error path by formatting debug string before moving state back --------- Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> |
||
|
Anand Krishnamoorthi
|
ee3dff9a3d |
fix(ci): skip mimalloc FFI and disable isolation for Miri (#621)
- Add cfg(not(miri)) guards to mimalloc module, global allocator, and allocator-memory-limits code paths so Miri falls back to the default system allocator instead of calling unsupported FFI functions. - Set MIRIFLAGS="-Zmiri-disable-isolation" in the workflow so tests that perform file I/O can run under Miri. - Skip units/parse tests under Miri due to Float-vs-BigInt Number representation mismatch with Miri's soft-float emulation. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> |
||
|
dependabot[bot]
|
b8e15f46f3 |
build(deps): bump rubocop in /bindings/ruby in the per-dependency group (#618)
Bumps the per-dependency group in /bindings/ruby with 1 update: [rubocop](https://github.com/rubocop/rubocop). Updates `rubocop` from 1.84.2 to 1.85.0 - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](https://github.com/rubocop/rubocop/compare/v1.84.2...v1.85.0) --- updated-dependencies: - dependency-name: rubocop dependency-version: 1.85.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: per-dependency ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Anand Krishnamoorthi
|
37144968c8 |
chore(ci): add miri workflow (#581)
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> |
||
|
Anand Krishnamoorthi
|
7ee503ccdc |
chore(ci): add cargo audit and deny (#580)
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> |
||
|
Anand Krishnamoorthi
|
006e819d52 |
rvm: switch binary serialization to postcard (#582)
Move RVM binary encoding from bincode to postcard and bump the format version. Update test helpers, docs, changelog, and refresh lockfiles after the swap. Closes #575 Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> |
||
|
dependabot[bot]
|
b6f11c5602 |
build(deps-dev): bump org.apache.maven.plugins:maven-surefire-plugin (#605)
Bumps the per-dependency group in /bindings/java with 1 update: [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire). Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.5.4 to 3.5.5 - [Release notes](https://github.com/apache/maven-surefire/releases) - [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.5.4...surefire-3.5.5) --- updated-dependencies: - dependency-name: org.apache.maven.plugins:maven-surefire-plugin dependency-version: 3.5.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: per-dependency ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
72033e77da |
build(deps): bump bytes (#569)
Bumps the cargo group with 1 update in the /bindings/java directory: [bytes](https://github.com/tokio-rs/bytes). Updates `bytes` from 1.11.0 to 1.11.1 - [Release notes](https://github.com/tokio-rs/bytes/releases) - [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md) - [Commits](https://github.com/tokio-rs/bytes/compare/v1.11.0...v1.11.1) --- updated-dependencies: - dependency-name: bytes dependency-version: 1.11.1 dependency-type: indirect dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
be34063dba |
build(deps): bump the per-dependency group with 2 updates (#603)
Bumps the per-dependency group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [MarcoIeni/release-plz-action](https://github.com/marcoieni/release-plz-action). Updates `github/codeql-action` from 4.32.2 to 4.32.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits]( |
||
|
dependabot[bot]
|
04bf417c06 |
build(deps): bump the per-dependency group across 1 directory with 3 updates (#607)
Bumps the per-dependency group with 3 updates in the /bindings/ruby directory: [minitest](https://github.com/minitest/minitest), [rubocop](https://github.com/rubocop/rubocop) and [rubocop-minitest](https://github.com/rubocop/rubocop-minitest). Updates `minitest` from 6.0.1 to 6.0.2 - [Changelog](https://github.com/minitest/minitest/blob/master/History.rdoc) - [Commits](https://github.com/minitest/minitest/compare/v6.0.1...v6.0.2) Updates `rubocop` from 1.84.1 to 1.84.2 - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](https://github.com/rubocop/rubocop/compare/v1.84.1...v1.84.2) Updates `rubocop-minitest` from 0.38.2 to 0.39.1 - [Release notes](https://github.com/rubocop/rubocop-minitest/releases) - [Changelog](https://github.com/rubocop/rubocop-minitest/blob/master/CHANGELOG.md) - [Commits](https://github.com/rubocop/rubocop-minitest/compare/v0.38.2...v0.39.1) --- updated-dependencies: - dependency-name: minitest dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: per-dependency - dependency-name: rubocop dependency-version: 1.84.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: per-dependency - dependency-name: rubocop-minitest dependency-version: 0.39.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: per-dependency ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Paulo Lieuthier
|
bc23cd08ac |
Python: boolean mapping (#612)
* fix(python): boolean and integer mapping |
||
|
Paulo Lieuthier
|
1c607dc1d3 |
feat: implement add_extension in Python binding (#596)
Add support for registering custom Python functions as Rego extensions, allowing users to call Python callables directly from Rego policies. The implementation: - Converts Rego values to Python types on call, and back on return - Validates that the extension is callable at registration time - Wraps errors with the extension name for easier debugging - Documents clone semantics (shared callable reference across clones) Tests cover: basic execution, type conversions (int, float, bool, None, list, dict, set), zero-arg extensions, wrong arity, exception propagation, non-callable rejection, and duplicate registration. Contributed by @paulolieuthier |
||
|
Anand Krishnamoorthi
|
47cc27ff49 |
feat(rbac)!: add Azure RBAC engine, FFI API, and cross-language tests (#577)
- add Azure RBAC condition interpreter and builtin evaluation in core (expressions, parser updates, evaluator, and test harness) - introduce comprehensive RBAC YAML test suites and coverage for i - action/suboperation - strings - numbers - bools - IP - GUID - dates - times - lists - quantifiers (ForAnyOfAnyValues, ForAllOfAllValues) - expose RBAC evaluation through FFI with an `rbac` feature flag enabled by default - add C# `RbacEngine` wrapper + P/Invoke entrypoint and document usage in C# README - expand C# tests to execute all RBAC YAML cases with per-case logging - wire test assets into C# test output and centralize YAML dependency versions Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> |
||
|
dependabot[bot]
|
8814eda0ae |
Bump the per-dependency group with 1 update (#587)
Bumps Microsoft.Build.NoTargets from 3.7.56 to 3.7.134 --- updated-dependencies: - dependency-name: Microsoft.Build.NoTargets dependency-version: 3.7.134 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: per-dependency ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
b4a69a13ba |
build(deps): bump the per-dependency group (#585)
--- updated-dependencies: - dependency-name: magnus dependency-version: 0.8.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: per-dependency - dependency-name: regorus dependency-version: 0.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: per-dependency - dependency-name: serde_magnus dependency-version: 0.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: per-dependency ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
e83a47497a |
build(deps): bump the per-dependency group (#586)
Bumps the per-dependency group in /bindings/ruby with 7 updates: | Package | From | To | | --- | --- | --- | | [minitest](https://github.com/minitest/minitest) | `5.25.4` | `6.0.1` | | [rake](https://github.com/ruby/rake) | `13.2.1` | `13.3.1` | | [rake-compiler](https://github.com/rake-compiler/rake-compiler) | `1.2.9` | `1.3.1` | | [rake-compiler-dock](https://github.com/rake-compiler/rake-compiler-dock) | `1.9.1` | `1.11.0` | | [rubocop](https://github.com/rubocop/rubocop) | `1.73.2` | `1.84.1` | | [rubocop-minitest](https://github.com/rubocop/rubocop-minitest) | `0.37.1` | `0.38.2` | | [rb_sys](https://github.com/oxidize-rb/rb-sys) | `0.9.111` | `0.9.124` | Updates `minitest` from 5.25.4 to 6.0.1 - [Changelog](https://github.com/minitest/minitest/blob/master/History.rdoc) - [Commits](https://github.com/minitest/minitest/compare/v5.25.4...v6.0.1) Updates `rake` from 13.2.1 to 13.3.1 - [Release notes](https://github.com/ruby/rake/releases) - [Changelog](https://github.com/ruby/rake/blob/master/History.rdoc) - [Commits](https://github.com/ruby/rake/compare/v13.2.1...v13.3.1) Updates `rake-compiler` from 1.2.9 to 1.3.1 - [Release notes](https://github.com/rake-compiler/rake-compiler/releases) - [Changelog](https://github.com/rake-compiler/rake-compiler/blob/master/History.md) - [Commits](https://github.com/rake-compiler/rake-compiler/compare/v1.2.9...v1.3.1) Updates `rake-compiler-dock` from 1.9.1 to 1.11.0 - [Release notes](https://github.com/rake-compiler/rake-compiler-dock/releases) - [Changelog](https://github.com/rake-compiler/rake-compiler-dock/blob/main/CHANGELOG.md) - [Commits](https://github.com/rake-compiler/rake-compiler-dock/compare/v1.9.1...v1.11.0) Updates `rubocop` from 1.73.2 to 1.84.1 - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](https://github.com/rubocop/rubocop/compare/v1.73.2...v1.84.1) Updates `rubocop-minitest` from 0.37.1 to 0.38.2 - [Release notes](https://github.com/rubocop/rubocop-minitest/releases) - [Changelog](https://github.com/rubocop/rubocop-minitest/blob/master/CHANGELOG.md) - [Commits](https://github.com/rubocop/rubocop-minitest/compare/v0.37.1...v0.38.2) Updates `rb_sys` from 0.9.111 to 0.9.124 - [Release notes](https://github.com/oxidize-rb/rb-sys/releases) - [Commits](https://github.com/oxidize-rb/rb-sys/compare/v0.9.111...v0.9.124) --- updated-dependencies: - dependency-name: minitest dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: per-dependency - dependency-name: rake dependency-version: 13.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: per-dependency - dependency-name: rake-compiler dependency-version: 1.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: per-dependency - dependency-name: rake-compiler-dock dependency-version: 1.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: per-dependency - dependency-name: rubocop dependency-version: 1.84.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: per-dependency - dependency-name: rubocop-minitest dependency-version: 0.38.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: per-dependency - dependency-name: rb_sys dependency-version: 0.9.124 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: per-dependency ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
241c1d445b |
build(deps-dev): bump the per-dependency group (#583)
Bumps the per-dependency group in /bindings/java with 6 updates: | Package | From | To | | --- | --- | --- | | [junit:junit](https://github.com/junit-team/junit4) | `3.8.1` | `4.13.2` | | [com.google.code.gson:gson](https://github.com/google/gson) | `2.10.1` | `2.13.2` | | [org.codehaus.mojo:exec-maven-plugin](https://github.com/mojohaus/exec-maven-plugin) | `3.1.0` | `3.6.3` | | [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.2.5` | `3.5.4` | | [org.apache.maven.plugins:maven-javadoc-plugin](https://github.com/apache/maven-javadoc-plugin) | `3.6.3` | `3.12.0` | | [org.apache.maven.plugins:maven-source-plugin](https://github.com/apache/maven-source-plugin) | `3.3.0` | `3.4.0` | Updates `junit:junit` from 3.8.1 to 4.13.2 - [Release notes](https://github.com/junit-team/junit4/releases) - [Changelog](https://github.com/junit-team/junit4/blob/main/doc/ReleaseNotes4.13.2.md) - [Commits](https://github.com/junit-team/junit4/commits/r4.13.2) Updates `com.google.code.gson:gson` from 2.10.1 to 2.13.2 - [Release notes](https://github.com/google/gson/releases) - [Changelog](https://github.com/google/gson/blob/main/CHANGELOG.md) - [Commits](https://github.com/google/gson/compare/gson-parent-2.10.1...gson-parent-2.13.2) Updates `org.codehaus.mojo:exec-maven-plugin` from 3.1.0 to 3.6.3 - [Release notes](https://github.com/mojohaus/exec-maven-plugin/releases) - [Commits](https://github.com/mojohaus/exec-maven-plugin/compare/exec-maven-plugin-3.1.0...3.6.3) Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.2.5 to 3.5.4 - [Release notes](https://github.com/apache/maven-surefire/releases) - [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.2.5...surefire-3.5.4) Updates `org.apache.maven.plugins:maven-javadoc-plugin` from 3.6.3 to 3.12.0 - [Release notes](https://github.com/apache/maven-javadoc-plugin/releases) - [Commits](https://github.com/apache/maven-javadoc-plugin/compare/maven-javadoc-plugin-3.6.3...maven-javadoc-plugin-3.12.0) Updates `org.apache.maven.plugins:maven-source-plugin` from 3.3.0 to 3.4.0 - [Release notes](https://github.com/apache/maven-source-plugin/releases) - [Commits](https://github.com/apache/maven-source-plugin/compare/maven-source-plugin-3.3.0...maven-source-plugin-3.4.0) --- updated-dependencies: - dependency-name: junit:junit dependency-version: 4.13.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: per-dependency - dependency-name: com.google.code.gson:gson dependency-version: 2.13.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: per-dependency - dependency-name: org.codehaus.mojo:exec-maven-plugin dependency-version: 3.6.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: per-dependency - dependency-name: org.apache.maven.plugins:maven-surefire-plugin dependency-version: 3.5.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: per-dependency - dependency-name: org.apache.maven.plugins:maven-javadoc-plugin dependency-version: 3.12.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: per-dependency - dependency-name: org.apache.maven.plugins:maven-source-plugin dependency-version: 3.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: per-dependency ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
4054d1b6b6 |
build(deps): bump the per-dependency group with 12 updates (#593)
Bumps the per-dependency group with 12 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.3.1` | `6.0.2` | | [actions/setup-python](https://github.com/actions/setup-python) | `5.6.0` | `6.2.0` | | [actions/setup-java](https://github.com/actions/setup-java) | `4.8.0` | `5.2.0` | | [actions/setup-go](https://github.com/actions/setup-go) | `5.1.0` | `6.2.0` | | [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `4.1.0` | `5.1.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `6.2.0` | | [github/codeql-action](https://github.com/github/codeql-action) | `3.32.2` | `4.32.2` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `6.0.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `5.0.0` | `7.0.0` | | [PyO3/maturin-action](https://github.com/pyo3/maturin-action) | `63b75c597b83e247fbf4fb7719801cc4220ae9f3` | `b1bd829e37fef14c63f19162034228a2f3dc1021` | | [MarcoIeni/release-plz-action](https://github.com/marcoieni/release-plz-action) | `0.5.108` | `0.5.126` | | [oxidize-rb/actions](https://github.com/oxidize-rb/actions) | `1.2.6` | `1.4.4` | Updates `actions/checkout` from 4.3.1 to 6.0.2 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits]( |
||
|
Anand Krishnamoorthi
|
8f7ca44bdf |
chore(dependabot): expand coverage and pin workflows (#579)
- Expand dependabot coverage across Rust subcrates and other ecosystems. - Group updates per dependency and ignore vendored mimalloc crates. - Pin GitHub Actions to exact SHAs in existing workflows. |
||
|
Anand Krishnamoorthi
|
96360fa9d8 |
fix(bindings): add SafeHandleWrapper + memory growth checks; bump 0.9.1 (#571)
- Introduce SafeHandleWrapper with gating, short drain wait, and deferred release on last in-flight exit. - Wire Engine/Program/Rvm/CompiledPolicy to wrapper (centralized handle use, interop helper). - Add C# memory growth tests (using/finalizer paths) and extend xtask C# runner options. - Add pooled marshalling utilities, ResultHelpers, and API cleanups; update versions/changelog. Fixes #570. Closes #554 Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>regorus-v0.9.1 |
||
|
Anand Krishnamoorthi
|
455d2aa588 |
chore(nuget): Add support for macosx (#553)
Additionally - Include more metadata in nuget package - Also generate snupkg for native symbols. We intentionally don't add the symbols for native rust shared library to the nuget package since that could increase the size of the nuget. We will revisit that later. - update licenses of all the bindings. closes #551 Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> |
||
|
Elijah Koulaxis
|
0e5fe9b9ac | feat: add tests for number semantics (#555) | ||
|
Anand Krishnamoorthi
|
0e9e34a519 |
chore: Gate exports using allocator-limits feature (#564)
This is needed to publish regorus-mimalloc Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>regorus-v0.9.0 |
||
|
Anand Krishnamoorthi
|
3f7a5496dc |
feat(bindings)!: add RVM/Program support across FFI and language bindings (#565)
- FFI: add RVM/Program APIs, execution state accessors, HostAwait handling, and buffer/result helpers in rvm.rs, common.rs, engine.rs. - Compiler: emit HostAwait for __builtin_host_await in function_calls.rs. - RVM tests: add HostAwait regression cases and extend harness for suspend/resume responses in host_await.yaml and mod.rs. - C/C++: add RVM tests/examples and wrapper updates in rvm_tests.c, rvm_tests.cpp, regorus.hpp, plus CMake wiring. - C#: add Program/Rvm bindings, SafeHandle/PInvoke, tests, and example usage in Regorus, RvmProgramTests.cs, Program.cs, and README updates. - Go: add Program/Rvm bindings, tests, and examples in rvm.go, rvm_test.go, main.go. - Java: add Program/Rvm bindings, JNI glue, and examples in lib.rs, regorus, Test.java. - Python: add Program/Rvm bindings and examples in lib.rs, test.py. - WASM: add Program/Rvm bindings and examples in lib.rs, test.js. - Tooling: wire binding tests in xtask and ignore generated Java artifacts in .gitignore. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> |