kata-containers/regorus
1
0
Fork 0
mirror of https://github.com/microsoft/regorus.git synced 2026-08-05 02:16:11 +00:00
Code Issues Packages Projects Releases Wiki Activity
427 Commits 25 Branches 26 Tags
ee3dff9a3dadf10cd82ceea477521d85aa0780a3
Commit Graph

427 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Anand Krishnamoorthi
ee3dff9a3d fix(ci): skip mimalloc FFI and disable isolation for Miri (#621) 
- Add cfg(not(miri)) guards to mimalloc module, global allocator, and
  allocator-memory-limits code paths so Miri falls back to the default
  system allocator instead of calling unsupported FFI functions.
- Set MIRIFLAGS="-Zmiri-disable-isolation" in the workflow so tests
  that perform file I/O can run under Miri.
- Skip units/parse tests under Miri due to Float-vs-BigInt Number
  representation mismatch with Miri's soft-float emulation.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2026-03-11 15:13:51 -05:00
dependabot[bot]
b8e15f46f3 build(deps): bump rubocop in /bindings/ruby in the per-dependency group (#618) 
Bumps the per-dependency group in /bindings/ruby with 1 update: [rubocop](https://github.com/rubocop/rubocop).


Updates `rubocop` from 1.84.2 to 1.85.0
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.84.2...v1.85.0)

---
updated-dependencies:
- dependency-name: rubocop
  dependency-version: 1.85.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: per-dependency
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-05 15:10:45 -06:00
Anand Krishnamoorthi
37144968c8 chore(ci): add miri workflow (#581) 
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2026-03-05 13:18:25 -06:00
Anand Krishnamoorthi
7ee503ccdc chore(ci): add cargo audit and deny (#580) 
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2026-03-05 13:18:00 -06:00
Anand Krishnamoorthi
006e819d52 rvm: switch binary serialization to postcard (#582) 
Move RVM binary encoding from bincode to postcard and bump the format version. Update test helpers, docs, changelog, and refresh lockfiles after the swap.

Closes #575

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2026-03-03 15:09:45 -06:00
dependabot[bot]
b6f11c5602 build(deps-dev): bump org.apache.maven.plugins:maven-surefire-plugin (#605) 
Bumps the per-dependency group in /bindings/java with 1 update: [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire).


Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.5.4 to 3.5.5
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.5.4...surefire-3.5.5)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-version: 3.5.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: per-dependency
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-27 16:52:44 -06:00
dependabot[bot]
72033e77da build(deps): bump bytes (#569) 
Bumps the cargo group with 1 update in the /bindings/java directory: [bytes](https://github.com/tokio-rs/bytes).


Updates `bytes` from 1.11.0 to 1.11.1
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](https://github.com/tokio-rs/bytes/compare/v1.11.0...v1.11.1)

---
updated-dependencies:
- dependency-name: bytes
  dependency-version: 1.11.1
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-27 16:52:14 -06:00
dependabot[bot]
be34063dba build(deps): bump the per-dependency group with 2 updates (#603) 
Bumps the per-dependency group with 2 updates: [github/codeql-action](https://github.com/github/codeql-action) and [MarcoIeni/release-plz-action](https://github.com/marcoieni/release-plz-action).


Updates `github/codeql-action` from 4.32.2 to 4.32.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](45cbd0c69e...9e907b5e64)

Updates `MarcoIeni/release-plz-action` from 0.5.126 to 0.5.127
- [Release notes](https://github.com/marcoieni/release-plz-action/releases)
- [Commits](52440b50d3...f708778669)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.32.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: per-dependency
- dependency-name: MarcoIeni/release-plz-action
  dependency-version: 0.5.127
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: per-dependency
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-27 16:51:21 -06:00
dependabot[bot]
04bf417c06 build(deps): bump the per-dependency group across 1 directory with 3 updates (#607) 
Bumps the per-dependency group with 3 updates in the /bindings/ruby directory: [minitest](https://github.com/minitest/minitest), [rubocop](https://github.com/rubocop/rubocop) and [rubocop-minitest](https://github.com/rubocop/rubocop-minitest).


Updates `minitest` from 6.0.1 to 6.0.2
- [Changelog](https://github.com/minitest/minitest/blob/master/History.rdoc)
- [Commits](https://github.com/minitest/minitest/compare/v6.0.1...v6.0.2)

Updates `rubocop` from 1.84.1 to 1.84.2
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.84.1...v1.84.2)

Updates `rubocop-minitest` from 0.38.2 to 0.39.1
- [Release notes](https://github.com/rubocop/rubocop-minitest/releases)
- [Changelog](https://github.com/rubocop/rubocop-minitest/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop-minitest/compare/v0.38.2...v0.39.1)

---
updated-dependencies:
- dependency-name: minitest
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: per-dependency
- dependency-name: rubocop
  dependency-version: 1.84.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: per-dependency
- dependency-name: rubocop-minitest
  dependency-version: 0.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: per-dependency
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-27 16:50:52 -06:00
Paulo Lieuthier
bc23cd08ac Python: boolean mapping (#612) 
* fix(python): boolean and integer mapping
 2026-02-27 15:55:28 -06:00
Paulo Lieuthier
1c607dc1d3 feat: implement add_extension in Python binding (#596) 
Add support for registering custom Python functions as Rego extensions,
allowing users to call Python callables directly from Rego policies.

The implementation:
- Converts Rego values to Python types on call, and back on return
- Validates that the extension is callable at registration time
- Wraps errors with the extension name for easier debugging
- Documents clone semantics (shared callable reference across clones)

Tests cover: basic execution, type conversions (int, float, bool, None,
list, dict, set), zero-arg extensions, wrong arity, exception
propagation, non-callable rejection, and duplicate registration.

Contributed by @paulolieuthier
 2026-02-25 15:55:52 -06:00
Anand Krishnamoorthi
47cc27ff49 feat(rbac)!: add Azure RBAC engine, FFI API, and cross-language tests (#577) 
- add Azure RBAC condition interpreter and builtin evaluation in core (expressions, parser updates, evaluator, and test harness)
- introduce comprehensive RBAC YAML test suites and coverage for i
  - action/suboperation
  - strings
  - numbers
  - bools
  - IP
  - GUID
  - dates
  - times
  - lists
  - quantifiers (ForAnyOfAnyValues, ForAllOfAllValues)
- expose RBAC evaluation through FFI with an `rbac` feature flag enabled by default
- add C# `RbacEngine` wrapper + P/Invoke entrypoint and document usage in C# README
- expand C# tests to execute all RBAC YAML cases with per-case logging
- wire test assets into C# test output and centralize YAML dependency versions

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2026-02-19 15:30:03 -06:00
dependabot[bot]
8814eda0ae Bump the per-dependency group with 1 update (#587) 
Bumps Microsoft.Build.NoTargets from 3.7.56 to 3.7.134

---
updated-dependencies:
- dependency-name: Microsoft.Build.NoTargets
  dependency-version: 3.7.134
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: per-dependency
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-12 16:47:12 -06:00
dependabot[bot]
b4a69a13ba build(deps): bump the per-dependency group (#585) 
---
updated-dependencies:
- dependency-name: magnus
  dependency-version: 0.8.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: per-dependency
- dependency-name: regorus
  dependency-version: 0.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: per-dependency
- dependency-name: serde_magnus
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: per-dependency
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-12 09:53:36 -06:00
dependabot[bot]
e83a47497a build(deps): bump the per-dependency group (#586) 
Bumps the per-dependency group in /bindings/ruby with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [minitest](https://github.com/minitest/minitest) | `5.25.4` | `6.0.1` |
| [rake](https://github.com/ruby/rake) | `13.2.1` | `13.3.1` |
| [rake-compiler](https://github.com/rake-compiler/rake-compiler) | `1.2.9` | `1.3.1` |
| [rake-compiler-dock](https://github.com/rake-compiler/rake-compiler-dock) | `1.9.1` | `1.11.0` |
| [rubocop](https://github.com/rubocop/rubocop) | `1.73.2` | `1.84.1` |
| [rubocop-minitest](https://github.com/rubocop/rubocop-minitest) | `0.37.1` | `0.38.2` |
| [rb_sys](https://github.com/oxidize-rb/rb-sys) | `0.9.111` | `0.9.124` |


Updates `minitest` from 5.25.4 to 6.0.1
- [Changelog](https://github.com/minitest/minitest/blob/master/History.rdoc)
- [Commits](https://github.com/minitest/minitest/compare/v5.25.4...v6.0.1)

Updates `rake` from 13.2.1 to 13.3.1
- [Release notes](https://github.com/ruby/rake/releases)
- [Changelog](https://github.com/ruby/rake/blob/master/History.rdoc)
- [Commits](https://github.com/ruby/rake/compare/v13.2.1...v13.3.1)

Updates `rake-compiler` from 1.2.9 to 1.3.1
- [Release notes](https://github.com/rake-compiler/rake-compiler/releases)
- [Changelog](https://github.com/rake-compiler/rake-compiler/blob/master/History.md)
- [Commits](https://github.com/rake-compiler/rake-compiler/compare/v1.2.9...v1.3.1)

Updates `rake-compiler-dock` from 1.9.1 to 1.11.0
- [Release notes](https://github.com/rake-compiler/rake-compiler-dock/releases)
- [Changelog](https://github.com/rake-compiler/rake-compiler-dock/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rake-compiler/rake-compiler-dock/compare/v1.9.1...v1.11.0)

Updates `rubocop` from 1.73.2 to 1.84.1
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop/compare/v1.73.2...v1.84.1)

Updates `rubocop-minitest` from 0.37.1 to 0.38.2
- [Release notes](https://github.com/rubocop/rubocop-minitest/releases)
- [Changelog](https://github.com/rubocop/rubocop-minitest/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop/rubocop-minitest/compare/v0.37.1...v0.38.2)

Updates `rb_sys` from 0.9.111 to 0.9.124
- [Release notes](https://github.com/oxidize-rb/rb-sys/releases)
- [Commits](https://github.com/oxidize-rb/rb-sys/compare/v0.9.111...v0.9.124)

---
updated-dependencies:
- dependency-name: minitest
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: per-dependency
- dependency-name: rake
  dependency-version: 13.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: per-dependency
- dependency-name: rake-compiler
  dependency-version: 1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: per-dependency
- dependency-name: rake-compiler-dock
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: per-dependency
- dependency-name: rubocop
  dependency-version: 1.84.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: per-dependency
- dependency-name: rubocop-minitest
  dependency-version: 0.38.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: per-dependency
- dependency-name: rb_sys
  dependency-version: 0.9.124
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: per-dependency
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-12 09:53:00 -06:00
dependabot[bot]
241c1d445b build(deps-dev): bump the per-dependency group (#583) 
Bumps the per-dependency group in /bindings/java with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [junit:junit](https://github.com/junit-team/junit4) | `3.8.1` | `4.13.2` |
| [com.google.code.gson:gson](https://github.com/google/gson) | `2.10.1` | `2.13.2` |
| [org.codehaus.mojo:exec-maven-plugin](https://github.com/mojohaus/exec-maven-plugin) | `3.1.0` | `3.6.3` |
| [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) | `3.2.5` | `3.5.4` |
| [org.apache.maven.plugins:maven-javadoc-plugin](https://github.com/apache/maven-javadoc-plugin) | `3.6.3` | `3.12.0` |
| [org.apache.maven.plugins:maven-source-plugin](https://github.com/apache/maven-source-plugin) | `3.3.0` | `3.4.0` |


Updates `junit:junit` from 3.8.1 to 4.13.2
- [Release notes](https://github.com/junit-team/junit4/releases)
- [Changelog](https://github.com/junit-team/junit4/blob/main/doc/ReleaseNotes4.13.2.md)
- [Commits](https://github.com/junit-team/junit4/commits/r4.13.2)

Updates `com.google.code.gson:gson` from 2.10.1 to 2.13.2
- [Release notes](https://github.com/google/gson/releases)
- [Changelog](https://github.com/google/gson/blob/main/CHANGELOG.md)
- [Commits](https://github.com/google/gson/compare/gson-parent-2.10.1...gson-parent-2.13.2)

Updates `org.codehaus.mojo:exec-maven-plugin` from 3.1.0 to 3.6.3
- [Release notes](https://github.com/mojohaus/exec-maven-plugin/releases)
- [Commits](https://github.com/mojohaus/exec-maven-plugin/compare/exec-maven-plugin-3.1.0...3.6.3)

Updates `org.apache.maven.plugins:maven-surefire-plugin` from 3.2.5 to 3.5.4
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.2.5...surefire-3.5.4)

Updates `org.apache.maven.plugins:maven-javadoc-plugin` from 3.6.3 to 3.12.0
- [Release notes](https://github.com/apache/maven-javadoc-plugin/releases)
- [Commits](https://github.com/apache/maven-javadoc-plugin/compare/maven-javadoc-plugin-3.6.3...maven-javadoc-plugin-3.12.0)

Updates `org.apache.maven.plugins:maven-source-plugin` from 3.3.0 to 3.4.0
- [Release notes](https://github.com/apache/maven-source-plugin/releases)
- [Commits](https://github.com/apache/maven-source-plugin/compare/maven-source-plugin-3.3.0...maven-source-plugin-3.4.0)

---
updated-dependencies:
- dependency-name: junit:junit
  dependency-version: 4.13.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: per-dependency
- dependency-name: com.google.code.gson:gson
  dependency-version: 2.13.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: per-dependency
- dependency-name: org.codehaus.mojo:exec-maven-plugin
  dependency-version: 3.6.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: per-dependency
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-version: 3.5.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: per-dependency
- dependency-name: org.apache.maven.plugins:maven-javadoc-plugin
  dependency-version: 3.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: per-dependency
- dependency-name: org.apache.maven.plugins:maven-source-plugin
  dependency-version: 3.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: per-dependency
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-12 09:46:33 -06:00
dependabot[bot]
4054d1b6b6 build(deps): bump the per-dependency group with 12 updates (#593) 
Bumps the per-dependency group with 12 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.3.1` | `6.0.2` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5.6.0` | `6.2.0` |
| [actions/setup-java](https://github.com/actions/setup-java) | `4.8.0` | `5.2.0` |
| [actions/setup-go](https://github.com/actions/setup-go) | `5.1.0` | `6.2.0` |
| [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `4.1.0` | `5.1.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | `4.4.0` | `6.2.0` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3.32.2` | `4.32.2` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `6.0.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `5.0.0` | `7.0.0` |
| [PyO3/maturin-action](https://github.com/pyo3/maturin-action) | `63b75c597b83e247fbf4fb7719801cc4220ae9f3` | `b1bd829e37fef14c63f19162034228a2f3dc1021` |
| [MarcoIeni/release-plz-action](https://github.com/marcoieni/release-plz-action) | `0.5.108` | `0.5.126` |
| [oxidize-rb/actions](https://github.com/oxidize-rb/actions) | `1.2.6` | `1.4.4` |


Updates `actions/checkout` from 4.3.1 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](34e114876b...de0fac2e45)

Updates `actions/setup-python` from 5.6.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](a26af69be9...a309ff8b42)

Updates `actions/setup-java` from 4.8.0 to 5.2.0
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](https://github.com/actions/setup-java/compare/v4.8.0...be666c2fcd27ec809703dec50e508c2fdc7f6654)

Updates `actions/setup-go` from 5.1.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/v5.1.0...7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5)

Updates `actions/setup-dotnet` from 4.1.0 to 5.1.0
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](https://github.com/actions/setup-dotnet/compare/v4.1.0...baa11fbfe1d6520db94683bd5c7a3818018e4309)

Updates `actions/setup-node` from 4.4.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](49933ea528...6044e13b5d)

Updates `github/codeql-action` from 3.32.2 to 4.32.2
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v3.32.2...45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2)

Updates `actions/upload-artifact` from 4.6.2 to 6.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](ea165f8d65...b7c566a772)

Updates `actions/download-artifact` from 5.0.0 to 7.0.0
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](634f93cb29...37930b1c2a)

Updates `PyO3/maturin-action` from 63b75c597b83e247fbf4fb7719801cc4220ae9f3 to b1bd829e37fef14c63f19162034228a2f3dc1021
- [Release notes](https://github.com/pyo3/maturin-action/releases)
- [Commits](63b75c597b...b1bd829e37)

Updates `MarcoIeni/release-plz-action` from 0.5.108 to 0.5.126
- [Release notes](https://github.com/marcoieni/release-plz-action/releases)
- [Commits](8724d33cd9...52440b50d3)

Updates `oxidize-rb/actions` from 1.2.6 to 1.4.4
- [Release notes](https://github.com/oxidize-rb/actions/releases)
- [Commits](7ca44a16e2...e5f9a49a78)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: per-dependency
- dependency-name: actions/setup-python
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: per-dependency
- dependency-name: actions/setup-java
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: per-dependency
- dependency-name: actions/setup-go
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: per-dependency
- dependency-name: actions/setup-dotnet
  dependency-version: 5.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: per-dependency
- dependency-name: actions/setup-node
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: per-dependency
- dependency-name: github/codeql-action
  dependency-version: 4.32.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: per-dependency
- dependency-name: actions/upload-artifact
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: per-dependency
- dependency-name: actions/download-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: per-dependency
- dependency-name: PyO3/maturin-action
  dependency-version: b1bd829e37fef14c63f19162034228a2f3dc1021
  dependency-type: direct:production
  dependency-group: per-dependency
- dependency-name: MarcoIeni/release-plz-action
  dependency-version: 0.5.126
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: per-dependency
- dependency-name: oxidize-rb/actions
  dependency-version: 1.4.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: per-dependency
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-12 06:30:19 -06:00
Anand Krishnamoorthi
8f7ca44bdf chore(dependabot): expand coverage and pin workflows (#579) 
- Expand dependabot coverage across Rust subcrates and other ecosystems.

- Group updates per dependency and ignore vendored mimalloc crates.

- Pin GitHub Actions to exact SHAs in existing workflows.
 2026-02-11 17:43:48 -06:00
Anand Krishnamoorthi
96360fa9d8 fix(bindings): add SafeHandleWrapper + memory growth checks; bump 0.9.1 (#571) 
- Introduce SafeHandleWrapper with gating, short drain wait, and deferred release on last in-flight exit.
- Wire Engine/Program/Rvm/CompiledPolicy to wrapper (centralized handle use, interop helper).
- Add C# memory growth tests (using/finalizer paths) and extend xtask C# runner options.
- Add pooled marshalling utilities, ResultHelpers, and API cleanups; update versions/changelog.

Fixes #570. Closes #554

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
regorus-v0.9.1 		2026-02-09 12:22:05 -06:00
Anand Krishnamoorthi
455d2aa588 chore(nuget): Add support for macosx (#553) 
Additionally
- Include more metadata in nuget package
- Also generate snupkg for native symbols.
  We intentionally don't add the symbols for native rust shared library
  to the nuget package since that could increase the size of the nuget.
  We will revisit that later.
- update licenses of all the bindings.

closes #551

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2026-02-03 00:09:52 +05:30
Elijah Koulaxis
0e5fe9b9ac feat: add tests for number semantics (#555) 2026-01-31 07:27:51 +05:30
Anand Krishnamoorthi
0e9e34a519 chore: Gate exports using allocator-limits feature (#564) 
This is needed to publish regorus-mimalloc

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
regorus-v0.9.0 		2026-01-30 23:56:29 +05:30
Anand Krishnamoorthi
3f7a5496dc feat(bindings)!: add RVM/Program support across FFI and language bindings (#565) 
- FFI: add RVM/Program APIs, execution state accessors, HostAwait handling, and buffer/result helpers in rvm.rs, common.rs, engine.rs.
- Compiler: emit HostAwait for __builtin_host_await in function_calls.rs.
- RVM tests: add HostAwait regression cases and extend harness for suspend/resume responses in host_await.yaml and mod.rs.
- C/C++: add RVM tests/examples and wrapper updates in rvm_tests.c, rvm_tests.cpp, regorus.hpp, plus CMake wiring.
- C#: add Program/Rvm bindings, SafeHandle/PInvoke, tests, and example usage in Regorus, RvmProgramTests.cs, Program.cs, and README updates.
- Go: add Program/Rvm bindings, tests, and examples in rvm.go, rvm_test.go, main.go.
- Java: add Program/Rvm bindings, JNI glue, and examples in lib.rs, regorus, Test.java.
- Python: add Program/Rvm bindings and examples in lib.rs, test.py.
- WASM: add Program/Rvm bindings and examples in lib.rs, test.js.
- Tooling: wire binding tests in xtask and ignore generated Java artifacts in .gitignore.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2026-01-30 23:55:31 +05:30
Anand Krishnamoorthi
0316ccd90c chore(release): publish vendored mimalloc crates (#563) 
- Prefix regorus- to mimalloc crates and add MIT licenses
- alias dependencies to avoid code changes
- add versions and release-plz publish entries
- update Cargo.lock files for new crate names

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2026-01-30 09:03:02 +05:30
Anand Krishnamoorthi
10eebfe54c test(rvm): Move vm execution limit tests to a separate test to avoid flakiness (#558) 
Having a separate integration test allows the execution tests to freely
change the global fallback limits without affecting other tests.

also ask release-plz to ignore xtask package

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2026-01-29 04:15:33 +05:30
Anand Krishnamoorthi
e688806ca0 chore: Keep regorus and binding versions in sync (#552) 
Bump up the versions to 0.9.0 to match the C# binding version.

Also use central version management for C# projects

Also fix clippy lint errors

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2026-01-28 05:58:34 +05:30
Anand Krishnamoorthi
394625d4bc feat!: add cooperative execution-time limits across engine, VM, and binding (#539) 
- Introduce ExecutionTimer/ExecutionTimerConfig to allow limiting evaluating time.
- To amortize time checking costs, checking interval can be configured via the notion of work units
- A global fallback time limit can be set to universally limit all evaluation in addition to engine level limit setting.
- Implement limnits in interpreter and RVM. In RVM, also handle suspend/resume so that time during pause is not counted.
- Add engine-level APIs to set/clear per-engine timer configuration and apply global fallback defaults.
- Surface execution-time limits through FFI and C# bindings
- Add C# tests and example usage to validate engine overrides, global fallback behavior, and compiled policy enforcement.
- Expand docs for execution-time limit
- Add interpreter YAML cases and VM unit tests for time-limit behavior and deterministic time sources.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2026-01-28 05:58:03 +05:30
Anand Krishnamoorthi
e68e852ee3 feat(xtask): consolidate CI workflows onto xtask helpers (#542) 
- split the xtask crate into structured modules for
  - bindings
  - ci
  - dev
  - util
  - no-std
- Adding commands for
  - ci-release/ci-debug
  - MUSL/no-std
  - per- binding language smoke tests
  - developer tasks (fmt, clippy, pre-commit, pre-push)
- refresh Cargo manifests/locks, binding readmes, and shared FFI helpers so every binding reuses the same preparation steps
- refactor GitHub Actions (release/debug, extensions, CodeQL, clippy, bindings) to call the new xtask commands
- Use rust-cache in ci workflows (microsoft qdk also does this)
- extend README with a contributor workflow section describing how xtask mirrors CI expectations
- update pre-commit and pre-push hooks to use the xtask dev commands

WORKAROUND:
When dotnet is run from an xtask, codeql tracer intercepts it an routes to a nonexistent binary.
Therefore in codeql workflow, xtask is not used for c# and instead dotnet is directly invoked.
Tracked by #545

closes #475

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2026-01-27 07:42:21 +05:30
Anand Krishnamoorthi
2b1434b3ac fix(release): Fix release-plz dirty-tree errors from Ruby binstubs (#547) 
Ruby binstubs were checked in, but ignore via .gitignore **bin pattern.
This causes release-plz to think that the source tree is dirty.

The binstubs are deleted from source repo since they are always regenerated by bundler.
Also simplizy release-plz to focus only on the core crate.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2026-01-24 07:09:25 +05:30
Anand Krishnamoorthi
fd59bb5a91 feat(memory): Allocator-backed global memory limits (#544) 
Policy evaluation at scale needs to be able to set memory limits
so that a bad policy does not hog memory or to ensure that
policy evaluation itself does not use too much memory which could
cause other components to suffer.

This PR introduces capability to set and enforce global memory limits.
It also lays the groundwork for enabling per evaluation limits in future.

Once a global memory limit is set, Regorus maintains per thread counters
to track memory activity (allocation, deallocation) of a thread.
These counters are periodically flushed to global memory counters.
Per thread counters avoid the contention that updating global counters
on each alloc/free would cause.

Policy evaluation periodically checks these counters and raises errors
if allocated memory has exceeded the configured limit.

Currently memory limit capability is exposed only to FFI and C#.

Also update mimalloc to v2.2.6

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2026-01-24 07:08:54 +05:30
Anand Krishnamoorthi
80686d6ed1 feat(ffi): unwind safety: shield FFI entrypoints with panic guard (#546) 
This PR implements widely accepted Rust programming practices for
dealing with panics across ABI (programming language) boundaries.

- Add panic_guard.rs to wrap FFI calls and prevent panic across FFI/ABI boundary (undefined behavior).
- Capture per-thread backtraces via a temporary panic hook
- After a panic, subsequent invocations are poisoned.
- Integrate with_unwind_guard across the engine, schema registry, and target registry exportis

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2026-01-21 09:20:10 +05:30
Anand Krishnamoorthi
9426b2ec02 fix: Imports without a name binding (#543) 
Handle imports that don't use the `as` clause to create a binding.
These imports are bound to the last identifier in the imported path.

Fix both interpreter and compiler.
Add tests.

fixes #541

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2026-01-15 03:57:52 +05:30
Anand Krishnamoorthi
740db8a0f5 chore: Harden RVM implementation (#537) 
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2026-01-14 06:07:31 +05:30
Ben Beasley
d626f75421 Include all licenses in SPDX expression and LICENSE file (#540) 
Change the SPDX license expression from `MIT` to
`MIT AND Apache-2.0 AND BSD-3-Clause` to reflect all of the licenses
that apply to the crate’s sources.

Add license text for `Apache-2.0` and the `BSD-3-Clause` license from
Go’s `time` module to `LICENSE`. Like `MIT`, both of these licenses
require the license text to be distributed with source and/or binaries.
 2026-01-10 18:31:49 +05:30
Anand Krishnamoorthi
5afbd96159 chore: Interpreter hardening (#536) 
Fix majority of the interpreter lint errors/warnings

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2025-12-30 18:21:09 -06:00
Anand Krishnamoorthi
28891ef883 chore: Harden instructions and program (#535) 
Also enforce sane limits in program

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2025-12-30 18:20:07 -06:00
Anand Krishnamoorthi
49958c2ece chore: Make clippy clean and harden helpers (#532) 
- Promote common accessors (Expr/Rule span/eidx, ScopeContext constructors, Engine::set_rego_v0) to const
- Prefer Option combinators (map_or, then_some) and map_or_else
- Tighten engine logic: add missing semicolons, use checked u32::try_from, make boolean query evaluation avoid unchecked indexing,

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2025-12-29 14:47:09 -06:00
Anand Krishnamoorthi
08a5e00960 chore: Harden lexer bounds and span handling (#531) 
- Document arithmetic safety assumptions and add explicit lexer limits for columns, file size (1 MiB), and line count.
  Realistic policies will be well within these bounds.
- Use checked arithmetic to prevent overflow underflow.
- Avoid var name shadowing.
- Misc clippy lints

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2025-12-29 14:46:05 -06:00
Anand Krishnamoorthi
1d71df30b6 chore: Fix lint errors in lookup.rs (#530) 
- Made the lookup module crate-visible to address clippy’s redundant visibility lint.
- Replaced unchecked as casts with a fallible usize_from_u32 helper and propagate conversion errors in lookup accessors.
- Switched LookupIndexError to implement core::error::Error for no_std correctness.
- Fixed the pattern type mismatch by matching on the value in the Display impl.
- Promoted trivial helpers to const fn (new, module_len) per clippy suggestions.
- Centralized bounds-checked slot access via slot_ref/slot_mut to keep getters/clearers lint-clean and avoid unchecked indexing.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2025-12-29 13:53:46 -06:00
Anand Krishnamoorthi
249dcd0b43 chore: Add clippy lints (#529) 
Lints are added (deny) at crate level.

In each offending file, the failing lints are explicitly allowed.
Each file will be fixed in subsequent PRs.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2025-12-23 15:59:34 -06:00
Anand Krishnamoorthi
604591a0f7 Merge pull request #527 from anakrish/checked-indexing 
Checked indexing
 2025-12-19 13:24:55 -06:00
Anand Krishnamoorthi
dbfb8e38a8 fix: Skip reordering in truncated queries. 
In case all the statements of a query don't execute,
skip reordering the result expressions to match the
source order. Doing so requires maintaining additional
data structures not worth the complexity for now.

Additionally we want to discourage queries and encourage
evaluating rules. Queries are inherently less performant
than rules which can be precompiled.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2025-12-19 12:08:09 -06:00
Anand Krishnamoorthi
273a80571e fix: apply expression ordering to schedule in a safe way 
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2025-12-19 11:33:25 -06:00
Anand Krishnamoorthi
3f29eb2fa6 fix: Create ordered statements in a safe way 
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2025-12-19 11:33:25 -06:00
Anand Krishnamoorthi
889a02ddd6 fix: Avoid unwrap when accesssing current module 
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2025-12-19 11:33:24 -06:00
Anand Krishnamoorthi
70f63a0982 fix: Avoid unrap/expect in context management 
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2025-12-19 11:33:24 -06:00
Anand Krishnamoorthi
6bc1249dc8 feat: Safeguard lookup use 
Detect invalid indexes and raise internal errors.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2025-12-19 11:33:24 -06:00
Anand Krishnamoorthi
5d0cf95332 feat: add recursion limit to parser 
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2025-12-19 11:33:24 -06:00
Anand Krishnamoorthi
fd4bb3081f feat: Safeguard against panics in parser 
Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2025-12-19 11:33:24 -06:00
Anand Krishnamoorthi
93a633750c feat: Guard against runtime panics in lexer 
Add guardrails for operations to ensure that they
won't panic at runtime.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
 2025-12-19 11:33:24 -06:00