Skip to content

feat: add direct OPA evaluator with shared base infrastructure #3276

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joejstuart wants to merge 9 commits into
base: main
Choose a base branch
from
Open

feat: add direct OPA evaluator with shared base infrastructure #3276

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
25ae4d5
feat: add direct OPA evaluator with shared base infrastructure
joejstuart May 6, 2026
b99d91b
fix: include component_name and policy_spec in BuildInput, fix lint
joejstuart May 7, 2026
8b65ae8
test: add comprehensive OPA evaluator and base evaluator tests, fix gci
joejstuart May 7, 2026
a6c4c14
test: add OPA evaluator integration tests with real policy files
joejstuart May 7, 2026
db351bc
test: add evaluator comparison tests asserting OPA/conftest parity
joejstuart May 7, 2026
4a562f1
test: pass EC_USE_OPA through to acceptance test scenarios
joejstuart May 7, 2026
6f4868b
test: add OPA evaluator acceptance test scenarios
joejstuart May 7, 2026
14ba351
test: add snapshot files for OPA evaluator acceptance tests
joejstuart May 7, 2026
09561ba
fix: use effectiveTime instead of time.Now() in computeSuccesses
joejstuart May 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions acceptance/cli/cli.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -859,6 +859,12 @@ func AddStepsTo(sc *godog.ScenarioContext) {
sc.Step(`^the "([^"]*)" file should match the snapshot$`, matchFileSnapshot)
sc.Step(`^a file named "([^"]*)" containing$`, createGenericFile)
sc.Step(`^a track bundle file named "([^"]*)" containing$`, createTrackBundleFile)
sc.Before(func(ctx context.Context, _ *godog.Scenario) (context.Context, error) {
if v := os.Getenv("EC_USE_OPA"); v != "" {
ctx, _ = theEnvironmentVarilableIsSet(ctx, "EC_USE_OPA="+v)
}
return ctx, nil
})
sc.After(func(ctx context.Context, sc *godog.Scenario, err error) (context.Context, error) {
if err != nil {
logExecution(ctx)
Expand Down
2 changes: 1 addition & 1 deletion acceptance/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ require (
github.com/sigstore/cosign/v3 v3.0.4
github.com/sigstore/rekor v1.5.0
github.com/sigstore/sigstore v1.10.4
github.com/sigstore/sigstore-go v1.1.4
github.com/stretchr/testify v1.11.1
github.com/tektoncd/cli v0.44.1
github.com/tektoncd/pipeline v1.9.2
Expand Down Expand Up @@ -205,7 +206,6 @@ require (
github.com/shoenig/go-m1cpu v0.1.6 // indirect
github.com/sigstore/protobuf-specs v0.5.0 // indirect
github.com/sigstore/rekor-tiles/v2 v2.0.1 // indirect
github.com/sigstore/sigstore-go v1.1.4 // indirect
github.com/sigstore/timestamp-authority/v2 v2.0.4 // indirect
github.com/sirupsen/logrus v1.9.4 // indirect
github.com/skeema/knownhosts v1.3.1 // indirect
Expand Down
3 changes: 2 additions & 1 deletion cmd/validate/image.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -320,7 +320,8 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
var c evaluator.Evaluator
var err error
if utils.IsOpaEnabled() {
c, err = newOPAEvaluator()
c, err = newOPAEvaluator(
cmd.Context(), policySources, data.policy, sourceGroup, nil)
} else {
// Use the unified filtering approach with the specified filter type
c, err = evaluator.NewConftestEvaluatorWithFilterType(
Expand Down
Loading
Loading