StyraInc
Showing 503 changed files with 67,103 additions and 4,697 deletions.
diff --git a/.gitattributes b/.gitattributes
@@ -1,5 +1,6 @@
 * text eol=lf
 
+*.jpg binary
 *.png binary
 *.gif binary
 

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -3,11 +3,19 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
+    groups:
+      dependencies:
+        patterns:
+          - "*"
   - package-ecosystem: "gomod"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "monthly"
     ignore:
       # update OPA manually to bump version in README too
-      - dependency-name: "github.com/open-policy-agent/opa"
+      - dependency-name: "github.com/open-policy-agent/opa/v1"
+    groups:
+      dependencies:
+        patterns:
+          - "*"
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -33,7 +33,7 @@ jobs:
     runs-on: ${{ matrix.os.runner }}
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
         with:
           go-version-file: go.mod
       - id: opa
@@ -47,24 +47,24 @@ jobs:
         working-directory: build
       - name: Restore rq cache
         id: cache-rq
-        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
+        uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
         with:
           path: ~/go/bin/rq
           key: ${{ runner.os }}-${{ runner.arch }}-go-rq-${{ env.RQ_VERSION }}
       - run: go install git.sr.ht/~charles/rq/cmd/rq@${{ env.RQ_VERSION }}
         if: steps.cache-rq.outputs.cache-hit != 'true'
       - name: Cache rq binary
         if: steps.cache-rq.outputs.cache-hit != 'true'
-        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
+        uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
         with:
           path: ~/go/bin/rq
           key: ${{ runner.os }}-${{ runner.arch }}-go-rq-${{ env.RQ_VERSION }}
       - run: build/do.rq pull_request
-      - uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1
+      - uses: golangci/golangci-lint-action@2226d7cb06a077cd73e56eedd38eecad18e5d837 # v6.5.0
         if: matrix.os.name == 'linux'
         with:
-          version: v1.60.3
-      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+          version: v1.64.5
+      - uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:
           name: regal-${{ matrix.os.name }}
           path: regal
@@ -73,7 +73,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
         with:
           go-version-file: go.mod
       - run: go test -race ./...
@@ -86,7 +86,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
         with:
           go-version-file: go.mod
       - id: opa
@@ -99,7 +99,7 @@ jobs:
           go run main.go test --coverage bundle \
           | opa eval -f raw -I -d build/simplecov/simplecov.rego data.build.simplecov.from_opa \
           > coverage.json
-      - uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
+      - uses: codecov/codecov-action@13ce06bfc6bbe3ecf90edbbf1bc32fe5978ca1d3 # v5.3.1
         with:
           fail_ci_if_error: false
           files: ./coverage.json

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -27,14 +27,14 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@396bb3e45325a47dd9ef434068033c6d5bb0d11a # v3.27.3
+        uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@396bb3e45325a47dd9ef434068033c6d5bb0d11a # v3.27.3
+        uses: github/codeql-action/autobuild@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@396bb3e45325a47dd9ef434068033c6d5bb0d11a # v3.27.3
+        uses: github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
         with:
           category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/push-tags.yaml b/.github/workflows/push-tags.yaml
@@ -24,13 +24,13 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
         with:
           go-version-file: go.mod
           check-latest: true
 
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
+        uses: goreleaser/goreleaser-action@90a3faa9d0182683851fbfa97ca1a2cb983bfca3 # v6.2.1
         with:
           install-only: true
 

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -25,20 +25,20 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
         with:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
 
       - name: "Upload artifact"
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@396bb3e45325a47dd9ef434068033c6d5bb0d11a # v3.27.3
+        uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/update-caps.yml b/.github/workflows/update-caps.yml
@@ -18,26 +18,26 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
         with:
           go-version-file: go.mod
       - name: Restore rq cache
         id: cache-rq
-        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
+        uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
         with:
           path: ~/go/bin/rq
           key: ${{ runner.os }}-${{ runner.arch }}-go-rq-${{ env.RQ_VERSION }}
       - run: go install git.sr.ht/~charles/rq/cmd/rq@${{ env.RQ_VERSION }}
         if: steps.cache-rq.outputs.cache-hit != 'true'
       - name: Cache rq binary
         if: steps.cache-rq.outputs.cache-hit != 'true'
-        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
+        uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
         with:
           path: ~/go/bin/rq
           key: ${{ runner.os }}-${{ runner.arch }}-go-rq-${{ env.RQ_VERSION }}
       - run: build/do.rq fetch
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
+        uses: peter-evans/create-pull-request@dd2324fc52d5d43c699a5636bcf19fceaa70c284 # v7.0.7
         with:
           title: "automated: update capabilities"
           branch: create-pull-request/caps

diff --git a/.github/workflows/update-example-index.yaml b/.github/workflows/update-example-index.yaml
@@ -24,7 +24,7 @@ jobs:
       - name: Check out code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Set up go for rq
-        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
         with:
           go-version-file: go.mod
       - id: opa
@@ -36,15 +36,15 @@ jobs:
           static: true
       - name: Restore rq cache
         id: cache-rq
-        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
+        uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
         with:
           path: ~/go/bin/rq
           key: ${{ runner.os }}-${{ runner.arch }}-go-rq-${{ env.RQ_VERSION }}
       - run: go install git.sr.ht/~charles/rq/cmd/rq@${{ env.RQ_VERSION }}
         if: steps.cache-rq.outputs.cache-hit != 'true'
       - name: Cache rq binary
         if: steps.cache-rq.outputs.cache-hit != 'true'
-        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
+        uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
         with:
           path: ~/go/bin/rq
           key: ${{ runner.os }}-${{ runner.arch }}-go-rq-${{ env.RQ_VERSION }}
@@ -66,7 +66,7 @@ jobs:
             tee internal/lsp/examples/index.json
 
       - name: Open a pull request
-        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
+        uses: peter-evans/create-pull-request@dd2324fc52d5d43c699a5636bcf19fceaa70c284 # v7.0.7
         with:
           title: "lsp: Update rego-by-examples index"
           commit-message: "lsp: Update rego-by-examples index"

diff --git a/.gitignore b/.gitignore
@@ -6,9 +6,12 @@ dist/
 /regal.exe
 
 # These two files are used by the Regal evaluation Code Lens, where input.json
-# defines the input to use for evaluation, and output.json is where the output
-# ends up unless the client supports presenting it in a different way.
+# (or input.yaml) defines the input to use for evaluation, and output.json is
+# where the output ends up unless the client supports presenting it in a
+# different way.
 input.json
+input.yaml
+
 output.json
 
 build/node_modules/
diff --git a/.golangci.yaml b/.golangci.yaml
@@ -1,9 +1,6 @@
 linters:
   enable-all: true
   disable:
-    # does not work with generics (yet)
-    - rowserrcheck
-    - wastedassign
     # annoying
     - gocyclo
     - tagliatelle
@@ -14,7 +11,6 @@ linters:
     - testpackage
     - goconst
     - gochecknoinits
-    - gomnd
     - mnd
     - inamedparam
     - err113
@@ -23,16 +19,13 @@ linters:
     - cyclop
     - ireturn
     - funlen
-    - nolintlint
     - gomoddirectives # need replacements for wasip1
-    - execinquery # deprecated
-    - exportloopref # deprecated
+    - tenv # deprecated
 linters-settings:
   tagliatelle:
     case:
       rules:
         json: snake
-
   revive:
     rules:
       # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#unused-parameter
@@ -47,23 +40,38 @@ linters-settings:
         disabled: false
         arguments:
           - allowRegex: "^_"
-
   gci:
     sections:
       - standard
       - default
       - prefix(github.com/open-policy-agent/opa)
+      - prefix(github.com/styrainc/roast)
       - prefix(github.com/styrainc/regal)
       - blank
       - dot
-
   depguard:
     rules:
       main:
         deny:
           - pkg: "gopkg.in/yaml.v2"
             desc: use yaml.v3 only
+  govet:
+    enable-all: true
+    disable:
+      - shadow
+      # this is nice, but it doesn't seem possible to disable
+      # this for tests? definitely don't want this in tests
+      - fieldalignment
 
 issues:
   exclude-dirs:
     - internal/lsp/opa
+  exclude-files:
+    # For whatever reason, the exclude-dirs setting isn't honored when
+    # golangci-lint is targeting one of these files *specifically* rather
+    # than whole whole workspace / directory. This happens when opening up
+    # one of these files in VS Code, which will have the linter complain
+    # loudly. Hopefully this workaround can be removed in the future.
+    - oracle.go
+    - scanner.go
+    - tokens.go
diff --git a/.vscode/launch.json b/.vscode/launch.json
@@ -0,0 +1,40 @@
+{
+  "version": "0.2.0",
+  "configurations": [
+    {
+      "name": "regal lint bundle",
+      "type": "go",
+      "request": "launch",
+      "mode": "auto",
+      "program": "${workspaceFolder}",
+      "args": [
+        "lint",
+        "--enable-print",
+        "bundle"
+      ]
+    },
+    {
+      "name": "regal fix --dry-run bundle",
+      "type": "go",
+      "request": "launch",
+      "mode": "auto",
+      "program": "${workspaceFolder}",
+      "args": [
+        "fix",
+        "--dry-run",
+        "bundle"
+      ]
+    },
+    {
+      "name": "regal test bundle",
+      "type": "go",
+      "request": "launch",
+      "mode": "auto",
+      "program": "${workspaceFolder}",
+      "args": [
+        "test",
+        "bundle"
+      ]
+    }
+  ]
+}
diff --git a/.vscode/settings.json b/.vscode/settings.json
@@ -6,5 +6,10 @@
   "opa.roots": [
     "${workspaceFolder}/bundle"
   ],
-  "opa.strictMode": true
+  "opa.strictMode": true,
+  "go.lintTool": "golangci-lint",
+  "go.buildFlags": [
+    "-tags",
+    "e2e"
+  ]
 }