Skip to content

Releases: StyraInc/regal

v0.31.0

11 Feb 16:56
@github-actions github-actions
v0.31.0
b29e759
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.31.0 Latest
Latest

This release of Regal updates to OPA v1.1.0, continuing to solidify support for v1 Rego with some nice new rules, performance improvements and bug fixes too.

New Rule: use-object-keys

There are some cases where using object.keys is preferred over using comprehensions. For example:

Avoid

package policy

keys := {k | some k, _ in input.object}

Prefer

package policy

keys := object.keys(input.object)

This is preferred as it more clearly communicates the intent of the code, that is, to get the keys of the object rather than loop over it and collect the keys as you go. More details can be found on the use-object-keys rule page.

New Rule: non-loop-expression

Expressions in loops are evaluated in each iteration of the loop and so it's advisable to avoid using expressions which do not depend on the loop variable within the looping part of a rule in order to improve performance.

Avoid

package policy
allow if {
    some email in input.emails
    admin in input.roles # <- this is not required in the loop
    endswith(email, "@example.com")
}

Prefer

package policy
allow if {
    admin in input.roles # <- moved out of the loop
    some email in input.emails
    endswith(email, "@example.com")
}

This rule can't catch all cases, so still be on the look out. More details can be found on the non-loop-expression rule page.

Fixing non-raw-regex-pattern

The non-raw-regex-pattern rule can now be automatically fixed with regal fix or with a CodeAction for language server clients. #1382

Configuration File Loading

Regal will now use a ~/.config/regal if no parent configuration is found. This is useful when working on Rego in temporary directories. #1378

Regal's language server will now use configuration files in the workspace tree if they exist rather than only looking at parent directories. This more closely matches the behavior of the lint command. #1372

Notable Improvements

  • Avoid 'error' paths in our linting Rego to reduce allocations. #1351, #1360, #1374
  • Implement the opa-fmt rule using in Rego, removing the need for a Go rule
    linting path entirely. #1393
  • More consistently use shared functions and remove dead code to make Regal easier to maintain. #1349,
    #1392, #1383, #1379, #1358, #1356, #1355
  • @anaypurohit0907 made their first PR in #1369 adding a new summary to the end of the compact report showing the number of files and violations. Also, #1387 adds a similar improvement to the end of the default 'Pretty' reporter output breaking down errors and warnings.
  • Documentation for the deprecated-builtin rule now explains the upgrade process. #1366, thanks @tsandall for the suggestion!

Notable Fixes & Updates

  • The use-if rule will now use only the rule name as the violation location, rather than the whole rule. #1362
  • Parse errors are now shown in file diagnostics to language server clients
    after a regression. #1408
  • @jglasovic made their first PR in #1345
    fixing a bug where the Debug CodeLens was left enabled.
  • Better handling of .regal.yaml file use. #1357, thanks @grosser for the input here.
  • Some great new open source adopters! #1384, thanks @chendrix for the Regal amigurumi!

Changelog

Contributors

grosser, tsandall, and 6 other contributors
Assets 8
Loading

v0.30.2

16 Jan 17:41
@github-actions github-actions
v0.30.2
2c6ee8e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.30.2

This release includes a fix for an issue where a missing Regal dir would cause a fatal error when running regal fix (#1341), thanks @grosser for the report again.

Also included is an a fix for an issue where Regal would template files without a Regal extension after renaming them from a Rego file.

Changelog

Contributors

grosser and charlieegan3
Assets 8
Loading

v0.30.1

16 Jan 14:58
@charlieegan3 charlieegan3
v0.30.1
5986638
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.30.1

Regal v0.30.1 is a patch release following the significant v0.30.0 release with first class OPA v1.0.0 support. This patch release addresses some issues discovered in the language server relating to the OPA update as well as a minor new feature.

New options for Regal config location

In addition to the .regal/config.yaml path we've used thus far, it's now possible to use a .regal.yaml instead. This is intended to be used by those preferring a single file rather than a dedicated directory. The config directory will still be required for users with custom rules. It is not possible to use $root/.regal/config.yaml and $root/.regal.yaml in the same directory at the same time. Regal will still use the config file nearest the root in the directory hierarchy, even if they are of different types. Thanks to @grosser for the suggestion!

Changelog

Full Changelog: v0.30.0...v0.30.1

Contributors

grosser, anderseknert, and charlieegan3
Assets 8
Loading

v0.30.0

13 Jan 15:27
@github-actions github-actions
v0.30.0
351b5bb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.30.0

Regal v0.30.0 is the first release to fully support OPA 1.0 while at the same time being fully compatible with older versions of OPA and Rego. This process helped improve both Regal and OPA, as a few things to fix in both projects got identified along the way!

Full support for OPA 1.0, while maintaining compatibility with earlier versions

Regal now seamlessly supports working with both pre-1.0 and 1.0+ policies, or even a mix of both! See Regal's new documentation on OPA 1.0 to learn more about how to get the most out of Regal when working with Rego of any version.

As part of this upgrade, all the Regal docs have now been updated to use OPA/Rego 1.0 syntax, in examples and anywhere else Rego is used.

Finally, and perhaps needless to say — Regal itself and all of its linter policies are now upgraded to OPA 1.0!

Much Faster Linting

A mission that started out with the goal of improving the performance of Regal's linter, ended up with multiple PR's
to improve evaluation performance in OPA. This of course benefits not just Regal, but all users of OPA! However, since
the regal lint command was used for benchmarking, most optimizations have been along the hot path of that command.

Linting with Regal is now almost 2x as fast as before, while consuming 2/3 of the memory previously needed. And we have
more improvements lined up in OPA for the next release, so stay tuned!

Notable Improvements

  • The evaluation code lens now supports using an input.yaml file as input, in addition to input.json. Thanks @mrgadgil for suggesting this feature!
  • The redundant-existence-check rule now also reports redudant checks of function arguments
  • New InputFromTextWithOptions functions for users of the Go API
  • Faster evaluation by avoiding custom function calls in hot path
  • Reduced time to evaluation by performance improvements in Roast input conversion
  • The language server now logs the version of Regal and the path to the binary at startup, helping users know which Regal binary is being used

Notable Fixes

Changelog

Contributors

grosser, tsandall, and 6 other contributors
Assets 8
Loading

v0.29.2

15 Nov 09:16
@github-actions github-actions
v0.29.2
20a5cfa
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.29.2

This patch release fixes an issue where the new defer-assignment rule would sometimes report a false positive when the variable was used inside of a with clause on the next line.

Thanks @nevumx for reporting the issue!

Changelog

Contributors

anderseknert and nevumx
Assets 8
Loading

v0.29.1

14 Nov 13:35
@github-actions github-actions
v0.29.1
743a65b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.29.1

This patch release fixes an issue where custom (i.e. user-created) aggregate rules1. wouldn't work as expected when the condition for a violation was the absence of aggregated data. This could for example be a rule that says "at least one rule must be named allow, and it must have a default assignment to false".

Upgrading from v0.29.0 is not required unless you're writing custom Regal rules.

Many thanks to @shibataka000 for reporting the issue, and in such an exemplary way ⭐

Changelog

  1. scroll below the table of rules for an explanation of what aggregate rules are ↩

Contributors

anderseknert, shibataka000, and dependabot
Assets 8
Loading

v0.29.0

12 Nov 15:16
@github-actions github-actions
v0.29.0
5cb67ea
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.29.0

This is a big release, spanning more than a month of development! Regal v0.29.0 brings new linter rules, performance improvements and new features to both the linter and the language server.

New rules

defer-assignment

Category: performance

The new defer-assignment rule helps detect when assignment can be moved to later in the rule body, possibly avoiding it at all if the conditions below don’t evaluate.

allow if {
    # this assignment can be deferred to after the roles check
    resp := http.send({"method": "get", "url": "http:localhost"})
    
    "rego hacker" in input.user.roles
    
    resp.status_code == 200
}

This can improve performance by having less to evaluate, and it makes policies easier to read. Double win!

For more information, see the docs on defer-assignment.

walk-no-path

Category: performance

When using the walk built-in function on large data structures, traversing only the values without building a path to each node can save a considerable amout of time. The new walk-no-path rule will detect when the assigned path is unused and can be replaced by a wildcard variable, which tells OPA to skip the construction of the path. This dramatically improves the performance of the function.

found if {
    # path assigned but never referenced in the rule
    walk(haystack, [path, value])

    value == "needle"
}

# should be replaced by

found if {
    walk(haystack, [_, value])

    value == "needle"
}

For more information, see the docs on walk-no-path.

rule-assigns-default

Category: bugs

Assigning a rule the same value as the default value set for the rule is always a bug, and while hopefully not too common, now reported by Regal.

default threshold := 1

threshold := 0 if {
    # some conditions
}

# this is already the default condition!
# and having this removed will have no impact on how
# the rule evaluates.. don't do this!
threshold := 1 if {
    # some conditions
}

For more information, see the docs on rule-assigns-default.

Language Server

Evaluation Code Lens for Neovim

We were exicted to learn the Code Lens for Evaluation (“click to evaluate”) feature we built now works not only in VS Code but also in Neovim. This thanks to work by regular contributor @rinx. Thank you! The language server docs have now been updated to reflect this.

Improved Enterprise OPA integration

Setting the capabilities engine to eopa will now have the language sever recognize Enterprise OPA-specific built-in functions, and provide both auto-completions for those as well as informative tooltips on hover. Clicking links in the tooltip now correctly brings you to the Styra docs for the Enterprise OPA built-in functions.

Notable Improvements

  • The leaked-internal-reference rule is now ignored in tests by default. See the docs for this rule if you wish to enable this.
  • The prefer-snake-case rule now also reports violations in package names.
  • The same prepared query is now used both for linting and to collect data for aggregate rules, saving about 150 milliseconds for any given regal lint run.
  • Regal’s own capabilities and provided configuration is now available when running the evaluation code lens, simplifying development of custom rules.
  • The pretty reporting format will now print the severity level of a violation when no color support is detected in the terminal (reported by @geirs73)
  • The --instrument flag from opa eval is now supported also by regal lint, providing detailed information about where most time is spent while linting.

Notable Fixes

  • Using input.json for the evaluation code lens now works reliably on Windows. As does ourcing a capabilities.json file from the filesystem. Thanks to @geirs73 for reporting these issues!
  • Global ignore directives from .regal/config.yaml would sometimes be parsed differently depending on read by regal lint or the language server. This has now been fixed.
  • Fix false positive in inconsistent-args rule when an arity mismatch should rather be handled by the compiler. Thanks @tsandall for reporting that!
  • Fix a false positive in use-contains rule when not importing rego.v1. This turned out to be an issue originating in OPA, so we fixed it there, and later included in Regal by upgrading the dependency to the latest OPA version v0.70.0. Thanks @drewcorlin1 for reporting the issue!

Changelog

Read more

Contributors

tsandall, anderseknert, and 8 other contributors
Assets 8
Loading

v0.28.0

07 Oct 15:31
@github-actions github-actions
v0.28.0
9503967
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.28.0

New Rule: missing-metadata #1131

The new missing-metadata rule helps ensure policies are documented by requiring METADATA comments on public packages and rules. Metadata comments are used to explain functionality and annotate Rego constructs with other data.

Note: missing-metadata is a custom rule and so is not enabled by default for all users.

fixer: Automated fixing of directory-package-mismatch

This release brings improvements to regal fix, the command to automatically fix supported violations (#1120, #1127).

Fixes for the directory-package-mismatch violations involve moving files based on their packages. For example a file with package foo.bar in policies/policy.rego would need to be moved to foo/policy.rego. In previous versions of Regal, when multiple files in a large code base with the same filename needed to be moved to the same package directory, Regal would output a confusing error message.

Regal v0.28.0 outputs a clear error message by default and adds a new --on-conflict=rename modifying flag to allow conflicting files to automatically be renamed when this scenario is encountered.

Linter Improvements

Language Server Performance Improvements

Dependency Updates

  • anderseknert/roast v0.2.0 -> v0.4.2 #1140, #1170
  • open-policy-agent/opa v0.68.0 -> v0.69.0 #1152

Github Actions Updates

  • golangci/golangci-lint-action 6.1.0 -> 6.1.1 #1163
  • peter-evans/create-pull-request 7.0.3 -> 7.0.5 #1114
  • github/codeql-action 3.26.7 -> 3.26.11 #1117, #1137, #1157, #1174
  • actions/checkout 4.1.7 -> 4.2.0 #1142
  • codecov/codecov-action 4.5.0 -> 4.6.0 #1162, #1164
  • actions/cache 4.0.2 -> 4.1.0 #1179

Changelog

Contributors

anderseknert, srenatus, and 4 other contributors
Assets 8
Loading

v0.27.0

17 Sep 15:25
@github-actions github-actions
v0.27.0
f1606de
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.27.0

Debug Adapter Protocol Support

Back in #926 (v0.26.0), support was added for the Debug Adapter Protocol (DAP), based on the new OPA SDK added in #6876 (documentation). This release improves on this making it ready for consumption in clients. Namely, the addition of a new Debug Code Lens in #1103 and a bug fix for ast.ref_to_string which brings the Regal implementation inline with OPA’s (#1106).

Please see our documentation here to get started.

Screenshot 2024-09-17 at 15 01 08

Neovim DAP Support

Thanks to community member @rinx, DAP support is also available in the Neovim editor. This is based on nvim-dap, and @rinx’s own project nvim-dap-rego. This is an awesome contribution which represents an important improvement for Neovim users of Regal. Thank you Rintaro Okamura for all your work here, it is appreciated.

Screenshot 2024-09-17 at 16 04 45

New Rule: comprehension-term-assignment

This rule flags cases where an intermediate assignment is used within a comprehension body when the value can be directly used as the comprehension term. It enforces the removal of redundant assignments, encouraging more concise and readable code.

# avoid
names := [name |
    some user in input.users
    name := user.name
]

# prefer
names := [user.name | some user in input.users]

Compiler Stage Source Explorer

A new Source Action has been added to allow users of compatible clients to explore the compiler stages of the Rego code they’re working on.

By integrating opa-explorer with Regal, it’s now possible to launch a web server to view the explorer output. Users will see a "Source Action" in the context menu of Rego files, which opens the explorer for that file. This feature is currently limited to VS Code due to available commands. Currently, only a single file is loaded into the explorer for compilation.

Screenshot 2024-09-17 at 15 21 02

Source Action shown in VS Code

Screenshot 2024-09-17 at 15 22 14

Browser showing the given file's compiler explorer

Test Flake Fixes

This release contains a number of fixes for flakey tests that have been disrupting the contributor experience. If you experience flakes and re-run checks on a PR, please leave a comment to let us know so we can look into it. #1112, #1102, #1101

Changelog

Contributors

anderseknert, rinx, and 2 other contributors
Assets 8
Loading

v0.26.2

10 Sep 14:58
@github-actions github-actions
v0.26.2
6f9b32f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.26.2

This releases contains a bug fixes for an issue introduced in v0.26.0 as well as a number of other minor improvements.

Notable Bug fixes:

  • #1087 fixes an issue in the marshalling of ASTs using RoAST
  • #1056 Makes a change to no longer suggest built in functions for default rules
  • #1065 fixes an issue where git was required even when fixing in dry run mode
  • #1069 fixes an edge case in use-some-for-output-vars
  • #1078, #1080, #1083, #1085 fix issues relating to file rename updates from the client
  • #1093 addresses an issue where the fix command produced the incorrect result due to relative paths
  • #1081 ensures that .manifest files are correctly detected as 'roots' when fixing

New features:

  • #1059 updates the language server to suggest boolean values at relevant times
  • #1088 adds a new feature for rule authors to use the files from their project as input for evaluation

Changelog

Contributors

anderseknert, srenatus, and 2 other contributors
Assets 8
Loading