refactor(checks): migrate Oracle to Rego

avd_docs/oracle/compute/AVD-OCI-0001/docs.md

@@ -3,8 +3,9 @@ Compute instance requests an IP reservation from a public pool
 
 The compute instance has the ability to be reached from outside, you might want to sonder the use of a non public IP.
 
+
 ### Impact
-The compute instance has the ability to be reached from outside
+<!-- Add Impact here -->
 
 <!-- DO NOT CHANGE -->
 {{ remediationActions }}

checks/cloud/oracle/compute/no_public_ip.go

@@ -27,7 +27,8 @@ The compute instance has the ability to be reached from outside, you might want
 			Links:               terraformNoPublicIpLinks,
 			RemediationMarkdown: terraformNoPublicIpRemediationMarkdown,
 		},
-		Severity: severity.Critical,
+		Severity:   severity.Critical,
+		Deprecated: true,
 	},
 	func(s *state.State) (results scan.Results) {
 		for _, reservation := range s.Oracle.Compute.AddressReservations {

checks/cloud/oracle/compute/no_public_ip.rego

@@ -0,0 +1,41 @@
+# METADATA
+# title: Compute instance requests an IP reservation from a public pool
+# description: |
+#   Compute instance requests an IP reservation from a public pool
+#
+#   The compute instance has the ability to be reached from outside, you might want to sonder the use of a non public IP.
+# scope: package
+# schemas:
+#   - input: schema["cloud"]
+# custom:
+#   id: AVD-OCI-0001
+#   avd_id: AVD-OCI-0001
+#   provider: oracle
+#   service: compute
+#   severity: CRITICAL
+#   short_code: no-public-ip
+#   recommended_action: Reconsider the use of an public IP
+#   input:
+#     selector:
+#       - type: cloud
+#         subtypes:
+#           - service: compute
+#             provider: oracle
+#   terraform:
+#     links:
+#       - https://registry.terraform.io/providers/hashicorp/opc/latest/docs/resources/opc_compute_ip_address_reservation
+#       - https://registry.terraform.io/providers/hashicorp/opc/latest/docs/resources/opc_compute_instance
+#     good_examples: checks/cloud/oracle/compute/no_public_ip.tf.go
+#     bad_examples: checks/cloud/oracle/compute/no_public_ip.tf.go
+package builtin.oracle.compute.oracle0001
+
+import rego.v1
+
+deny contains res if {
+	some reservation in input.oracle.compute.addressreservations
+
+	# TODO: future improvement: we need to see what this IP is used for before flagging
+	reservation.pool.value == "public-ippool"
+
+	res := result.new("Reservation made for public IP address.", reservation.pool)
+}

checks/cloud/oracle/compute/no_public_ip_test.rego

@@ -0,0 +1,20 @@
+package builtin.oracle.compute.oracle0001_test
+
+import rego.v1
+
+import data.builtin.oracle.compute.oracle0001 as check
+import data.lib.test
+
+test_deny_pool_is_public if {
+	inp := {"oracle": {"compute": {"addressreservations": [{"pool": {"value": "public-ippool"}}]}}}
+
+	res := check.deny with input as inp
+	count(res) == 1
+}
+
+test_allow_pool_is_cloud if {
+	inp := {"oracle": {"compute": {"addressreservations": [{"pool": {"value": "cloud-ippool"}}]}}}
+
+	res := check.deny with input as inp
+	res == set()
+}

test/rego/oracle_test.go

@@ -0,0 +1,36 @@
+package test
+
+import (
+	"github.com/aquasecurity/trivy/pkg/iac/providers/oracle"
+	"github.com/aquasecurity/trivy/pkg/iac/state"
+	trivyTypes "github.com/aquasecurity/trivy/pkg/iac/types"
+)
+
+var oracleTestCases = testCases{
+	"AVD-OCI-0001": {
+		{
+			name: "Compute instance public reservation pool",
+			input: state.State{Oracle: oracle.Oracle{Compute: oracle.Compute{
+				AddressReservations: []oracle.AddressReservation{
+					{
+						Metadata: trivyTypes.NewTestMetadata(),
+						Pool:     trivyTypes.String("public-ippool", trivyTypes.NewTestMetadata()),
+					},
+				},
+			}}},
+			expected: true,
+		},
+		{
+			name: "Compute instance cloud reservation pool",
+			input: state.State{Oracle: oracle.Oracle{Compute: oracle.Compute{
+				AddressReservations: []oracle.AddressReservation{
+					{
+						Metadata: trivyTypes.NewTestMetadata(),
+						Pool:     trivyTypes.String("cloud-ippool", trivyTypes.NewTestMetadata()),
+					},
+				},
+			}}},
+			expected: false,
+		},
+	},
+}

test/rego/rego_checks_test.go

@@ -61,15 +61,17 @@ func TestRegoChecks(t *testing.T) {
 		azureAuthorizationTestCases,
 		azureContainerTestCases,
 
-    googleDnsTestCases,
+		googleDnsTestCases,
 		googleKmsTestCases,
 		googleBigQueryTestCases,
 
-    githubTestCases,
+		githubTestCases,
 
-    nifcloudDnsTestCases,
+		nifcloudDnsTestCases,
 		nifcloudNetworkTestCases,
 		nifcloudSslCertificateTestCases,
+
+		oracleTestCases,
 	)
 
 	regoScanner := rego.NewScanner(trivyTypes.SourceCloud)