6dc505c88b
* build: Add xtask automation for binding version management Introduces a dedicated xtask crate that keeps language binding versions in sync with the core regorus crate, following the workflow pattern used by rust-analyzer, gitoxide, and ripgrep. Key features: - Git-based change detection: compares binding source files against a base ref (merge-base with origin/main by default) plus unstaged/ untracked files to identify which bindings have been modified - SemVer-aware bumping: binding edits trigger a minor version increment (e.g. 0.5.1 → 0.6.0) under pre-1.0 semantics, signaling potential breaking changes; clean bindings simply align to the root version - Multi-language support: updates Cargo manifests (Rust FFI, Java, Python, WASM, Ruby), Maven pom.xml (Java), Ruby version constants, and C# project files in a single pass - CI integration: --check mode fails fast when manifests are out of sync, ensuring pre-commit and release-plz workflows catch stale versions before merge Integration points: - release-plz.toml: runs cargo xtask bindings --base-ref origin/main after bumping the root crate, so binding versions are updated atomically during the release process - scripts/pre-commit: invokes cargo xtask bindings --check to block commits that would leave bindings out of sync - .cargo/config.toml: defines cargo xtask alias for convenience Documentation includes inline examples showing how version bumps behave when bindings are ahead/behind the root, and notes that the minor field acts as the major version under SemVer 0.y.z initial development phase. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> * build: refresh xtask tooling, workflows, and locks - cargo xtask bindings: keep the binding version-sync pipeline intact - cargo xtask update-deps: new helper to regenerate workspace/binding Cargo.lock files - workflows: auto-detect the Java jar version in CI and temporarily disable the Ruby workflow - lock files: refresh root + binding snapshots after the dependency sweep Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com> --------- Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
Regorusrb
Regorus is
- Rego-Rus(t) - A fast, light-weight Rego interpreter written in Rust.
- Rigorous - A rigorous enforcer of well-defined Rego semantics.
Installation
Regorus can be used in Ruby by configuring bundler to build from the remote git source.
If using Bundler to manage gems (recommended), edit your gemfile to include the following
gem "regorusrb", git: "https://github.com/microsoft/regorus/", glob: "bindings/ruby/*.gemspec"
or manually install checkout the source and build the gem
git clone https://github.com/microsoft/regorus/ cd regorus/bindings/ruby rake && rake build # should eventually output 'regorusrb 0.1.0 built to pkg/regorusrb-0.1.0.gem.' gem install --local ./pkg/regorusrb-0.1.0.gem
It is not yet available in rubygems.
See Repository.
To build this gem locally without bundler,
rake build
then to install the gem and build the native extensions
gem install --local ./pkg/regorusrb-0.1.0.gem
Usage
require "regorus"
engine = Regorus::Engine.new
# Policy is old-style.
engine.set_rego_v0(true)
engine.add_policy_from_file('../../tests/aci/framework.rego')
engine.add_policy_from_file('../../tests/aci/api.rego')
engine.add_policy_from_file('../../tests/aci/policy.rego')
# can be strings or symbols
data = {
metadata: {
devices: {
"/run/layers/p0-layer0": "1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766",
"/run/layers/p0-layer1": "e769d7487cc314d3ee748a4440805317c19262c7acd2fdbdb0d47d2e4613a15c",
"/run/layers/p0-layer2": "eb36921e1f82af46dfe248ef8f1b3afb6a5230a64181d960d10237a08cd73c79",
"/run/layers/p0-layer3": "41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156",
"/run/layers/p0-layer4": "4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c",
"/run/layers/p0-layer5": "fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a"
}
}
}
engine.add_data(data)
input = {
"containerID": "container0",
"layerPaths": [
"/run/layers/p0-layer0",
"/run/layers/p0-layer1",
"/run/layers/p0-layer2",
"/run/layers/p0-layer3",
"/run/layers/p0-layer4",
"/run/layers/p0-layer5"
],
"target": "/run/gcs/c/container0/rootfs"
}
engine.set_input(input)
# Evaluate a specife rule
rule_results = engine.eval_rule('data.framework.mount_overlay')
puts rule_results # { "allowed" => true, "metadata" => [...]}
# Or evalute a full policy document
query_results = engine.eval_query('data.framework')
puts query_results[:result][0]
# Query results can can also be returned as JSON strings instead of Ruby Hash structure
results_json = engine.eval_query_as_json('data.framework.mount_overlay=x')
puts results_json
Development
To update the gem version or dependencies within bindings/ruby/Gemfile.lock, run bundle update --gemfile=bindings/ruby/Gemfile from the project directory, or cd bindings/ruby && bundle update
After checking out the repo, cd bindings/ruby and run bin/setup to install dependencies. Then, run rake test to run the tests. You can also run bin/console for an interactive prompt that will allow you to experiment.