c312e30372
* build(deps): update all Rust dependencies to latest versions Bulk-update all Cargo.lock files across the workspace and bindings to their latest compatible versions. This supersedes the individual per-directory dependabot PRs (#678-#682) that fail CI due to version skew when only one lockfile is updated. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: refresh ALL Cargo lockfiles on dependabot PRs Dependabot security updates bypass the grouped-updates config and create per-directory PRs (one per Cargo.lock). This causes version skew — e.g. rand gets bumped in bindings/ruby but stays old elsewhere, breaking the build. Fix by unconditionally refreshing all lockfiles whenever any Cargo manifest or lockfile changes, rather than only the affected directory. Also harden the workflow against expression injection: - Move head.ref and base_ref to env vars (not inline ${{ }}) - Validate refs via git check-ref-format --branch - Validate SHA format (hex, 40 chars) before use - Fetch base branch by ref (not bare SHA) for reliable diffing - Add security boundary comment on untrusted code checkout - Add version comment on pinned checkout action SHA Ref: https://github.com/dependabot/dependabot-core/issues/7547 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Regorus Java
Regorus is
- Rego-Rus(t) - A fast, light-weight Rego interpreter written in Rust.
- Rigorous - A rigorous enforcer of well-defined Rego semantics.
See main Regorus page for more details about the project.
Building
Due to operational overhead we don't publish Java bindings to Maven Central currently (see https://github.com/microsoft/regorus/issues/237) and you need to build from source to use it.
In order to build Regorus Java for a target platform, you need to install Rust target for that platform first:
$ rustup target add aarch64-apple-darwin
Afterwards, you can build native library for that target using:
$ cargo build --release --target aarch64-apple-darwin
You will then have a native library at target/aarch64-apple-darwin/release/libregorus_java.dylib depending on your target.
You then need to build Java bindings using:
$ mvn package
And you will have a JAR at ./target/regorus-java-0.1.5.jar.
Automation
The repository exposes helper commands for local workflows:
cargo xtask build-javarunsmvn packagewith quiet output helpers.cargo xtask test-javarebuilds the native library via the Maven exec plugin and executes the binding tests.
Usage
You can use Regorus Java bindings as:
import com.microsoft.regorus.Engine;
public class Test {
public static void main(String[] args) {
try (Engine engine = new Engine()) {
engine.addPolicy(
"hello.rego",
"package test\nmessage = concat(\", \", [input.message, data.message])"
);
engine.addDataJson("{\"message\":\"World!\"}");
engine.setInputJson("{\"message\":\"Hello\"}");
String resJson = engine.evalQuery("data.test.message");
System.out.println(resJson);
}
}
}
You need to ensure artifacts built in previous section are in Java's classpath.
For example with java CLI:
$ java -Djava.library.path=../../target/aarch64-apple-darwin/release/ -cp target/regorus-java-0.1.5.jar Test.java
should gave you the output:
{"result":[{"expressions":[{"value":"Hello, World!","text":"data.test.message","location":{"row":1,"col":1}}]}]}