Skip to content

Releases: StyraInc/regal

v0.20.1

09 Apr 15:47
@github-actions github-actions
v0.20.1
e16ffba
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.20.1

This release fixes a panic encountered in the language server when Regal traverses a directory it cannot read while walking the workspace.

Thanks @frittsy for reporting the issue!

Changelog

Contributors

anderseknert and frittsy
Assets 8
Loading

v0.20.0

08 Apr 12:36
@github-actions github-actions
v0.20.0
6df97b3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.20.0

This release adds various improvements to the functionality of the language server as well as also including a number of housekeeping updates and fixes.

Language Server: Hover support for built-in function definitions

The language server protocol supports requesting information about the tokens under the cursor. This release implements support for such requests when users are hovering over Rego's built-in functions. Clicking the link in the tooltip heading will take you to the OPA docs for that built-in.

318763769-c21a5954-abd2-4ea6-a758-bec233687491

Language Server: Inlay Hints

Inlay Hint requests are also supported from this release. Inlay hints are allow named function arguments to be shown as users edit function calls.

screenshot_2024-04-03_at_14 17 30

Improvements

  • Running the language server with --verbose will now show the full request response logs.
  • File ignore config is now also supported by the language server.
  • Unresolved imports are not flagged as part of prefer-package-imports

Updates

  • This release updates OPA to v0.63.0, see the OPA changelog for more detail.
  • Go SARIF has also been updated to 2.3.1

Changelog

Contributors

anderseknert, charlieegan3, and dependabot
Assets 8
Loading

v0.19.0

18 Mar 17:00
@github-actions github-actions
v0.19.0
4f559f2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.19.0

This release adds several new options for setting configuration options for rules in groups, allowing users to keep a static configuration across updates, or to ignore certainly classes of rules. v0.19.0 also includes a number of fixes to both linter rules and the language server integration, making for an even better experience when using Regal from VS Code or other LSP clients.

New default rule configuration option

The rules section in the Regal configuration file may now include a default attribute either at the top level, or in any specific category. This allows enabling/disabling entire categories of rules, or to avoid Regal to "break" CI/CD builds on updates if new rules are introduced. While it's arguably good to have new problems surfaced, we recognize that some organizations value stability first, and may opt for more controlled upgrades.

Example, using a default configuration to ignore all rules except for those explicitly listed:

rules:
  default:
    level: ignore
  bugs:
    constant-condition:
      level: error
    deprecated-builtin:
      level: error
    duplicate-rule:
      level: error

Example, using a default configuration to enable all rules except for those in the style category:

rules:
  default:
    level: error
  style:
    level: ignore

To learn more about the new default option, and the precedence rules for the various ways to ignore rules, see the Regal docs.

Fixes

  • Fix false positive in prefer-some-in-iteration in function args
  • Fix false positive in several rules not counting imports in scope
  • Many fixes and improvements related to the LSP integration — see the changelog below for details

Changelog

Contributors

gusega, anderseknert, and 2 other contributors
Assets 8
Loading

v0.18.0

01 Mar 20:28
@github-actions github-actions
v0.18.0
b1a6fbe
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.18.0

Only a week after v0.17.0, this release comes a little earlier than planned as we found a few issues in the VS Code OPA extension integration that we wanted to address as soon as possible. Nothing serious, but having that extension provide a great Regal experience feels important enough for us to warrant an earlier v0.18.0 release. That's not all there is to this release though, as we have both a new linter rule as well as a bunch of fixes included here. Enjoy!

New rule: ignored-import

Category: imports

Use of explicit references (like data.user.roles) that could instead point to an existing import will now be flagged in order to ensure that the imports a user has declared aren't ignored later in the policy.

For more information, see the docs on ignored-import.

Improvements

Bugs Fixed

Changelog

Contributors

anderseknert and charlieegan3
Assets 8
Loading

v0.17.0

22 Feb 08:08
@github-actions github-actions
v0.17.0
ece9977
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.17.0

This is a fairly big release, adding 4 new linter rules and a whole bunch of improvements and fixes.

New rule: with-outside-test-context

Category: performance

This is the first rule in the new performance category, with more to follow in future releases. The with keyword is known to most as a way to mock values and functions in unit tests. While it's occasionally useful in other contexts, it comes with some major performance implications when used outside of tests. This new rule warns when with is encoutered outside the context of tests.

For more information, see the docs on with-outside-test-context.

New rule: circular-import

Category: imports

A circular import is when a package imports itself, either by directly importing itself, or indirectly by importing a which in turn imports a series of packages that eventually import the original package. As long as recursive rules definitions are avoided, circular imports are permitted in Rego. However, such import graphs are not advisable and a signal of poorly structured policy code.

For more information, see the docs on circular-import.

New rule: rule-name-repeats-package

Category: style

When rules are referenced outside the package in which they are defined, they will be referenced using the package path. For example, the allow rule in the example package, is available at data.example.allow. When rule names include all or part of their package paths, this creates repetition in such references. For example, authz_allow in a package authz is referenced with: data.authz.authz_allow. This repetition is undesirable as the reference is longer than needed, and harder to read.

For more information, see the docs on rule-name-repeats-package.

New rule: double negative

Category: style

While rules using double negatives — like not no_funds — occasionally make sense, it is often worth considering whether the rule could be rewritten without the negative. For example, not no_funds could be rewritten as funds or has_funds, or funds_available.

For more information, see the docs on double-negative.

Improvements

  • The Regal language server now supports client shutdown messages
  • The docs on how to ignore rules and files have been greatly improved. Thanks @bdumpp and @orenzohar for the suggestion!

Bugs Fixed

  • Fix false positive in prefer-some-in-iteration rule when old-style iteration was used inside of arrays, sets and objects
  • Fix false positive in prefer-some-in-iteration rule when old-style iteration was used inside of rule head key (i.e. contains)
  • Fix false positive in external-reference rule when using = for assignment (although you shouldn't!)
  • The Regal language server now correctly handles URIs and paths on Windows

Ecosystem

The setup-regal GitHub Action has been promoted to v1. This fixes the warning in pipelines about depending on an old Node version. Make sure to update your workflows!

Changelog

Contributors

anderseknert, charlieegan3, and 3 other contributors
Assets 8
Loading

v0.16.0

05 Feb 12:55
@github-actions github-actions
v0.16.0
bc27c76
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.16.0

This release adds 2 new linter rules and a language server protocol (LSP) implementation to Regal.

New rule: duplicate-rule

Category: bugs

The new duplicate-rule linter rule flags any rules with duplicated code found in a policy. Duplicate rules are almost certainly a mistake, perhaps from copy-pasting code, and should simply be fixed (or likely, removed).

For more information, see the docs on duplicate-rule.

New rule: use-rego-v1

Category: imports

OPA v0.59.0 introduced a new import named rego.v1. When import rego.v1 is used in a policy, OPA will ensure the policy is compliant with the upcoming OPA 1.0 release. This include enforcing the use of the if and contains keywords, that no deprecated built-ins are used, and more. To learn more about OPA 1.0 and the rego.v1 import, see the OPA docs.

As rego.v1 replaces the future.keywords imports, the Regal rules around those imports are automatically disabled when use-rego-v1 is in use. If you wish to target a version of OPA before rego.v1, use the capabilities feature of the Regal configuration file.

Avoid

package policy

# before OPA v0.59.0, this was best practice
import future.keywords.contains
import future.keywords.if

report contains item if {
    # ...
}

Prefer

package policy

# with OPA v0.59.0 and later, use this instead
import rego.v1

report contains item if {
    # ...
}

For more information, see the docs on use-rego-v1.

New feature: Regal language server

The Language Server Protocol (LSP) provides a way for editors to integrate support for various programming languages using a common protocol. Using an LSP server implementation rather than one built specifically for a single editor allows the same code to be used across all editors with LSP support. v0.16.0 brings a language server mode to Regal, allowing diagnostics (i.e. linting) of Rego to be performed continuously in a workspace rather than as a one-off CLI operation. This is the first step towards bringing Regal into editors like VS Code, and having linting of Rego natively supported as you work with your policies. Expect to see more in this space soon!

Huge thanks to @charlieegan3 for this outstanding contribution!

Changelog

Contributors

anderseknert, srenatus, and 2 other contributors
Assets 8
Loading

v0.15.0

05 Jan 14:17
@github-actions github-actions
v0.15.0
f80597e
Compare
Choose a tag to compare
v0.15.0

This release brings 2 new linter rules, and a few improvements and fixes.

New rule: deprecated-builtin

Category: bugs

Calling deprecated built-in functions should always be avoided, and replacing them is usually trivial. Refer to the OPA docs on strict mode for more details on which built-in functions counts as deprecated.

For more information, see the docs on deprecated-builtin.

New rule: default-over-not

Category: style

Avoid

package policy

import future.keywords.if

username := input.user.name

username := "anonymous" if not input.user.name

Prefer

package policy

default username := "anonymous"

username := input.user.name

While both forms are valid, using the default keyword to assign a constant value in the fallback case better
communicates intent, avoids negation where it isn't needed, and requires less instructions to evaluate. Note that this
rule only covers simple cases where one rule assigns the "happy" path, and another rule assigns on the same condition
negated. This is by design, as using not and negation may very well be the right choice for more complex cases!

For more information, see the docs on default-over-not.

Other improvements

  • Ignore directives can now be placed anywhere in a comment, and not just at the start of one. Thanks @nevumx for requesting this!

Bugs fixed

  • SARIF output format: omit region for violations with whole file as location. Thanks @travbale for reporting this!
  • SARIF output format: fix incorrect level of notice and use none instead. Thanks @travbale for reporting this!

Community

  • The Minder project was added as an adopter. Thanks @JAORMX for this!

Changelog

Contributors

JAORMX, anderseknert, and 4 other contributors
Assets 8
Loading

v0.14.0

05 Dec 08:01
@github-actions github-actions
v0.14.0
b9342d4
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.14.0

This release brings 2 new linter rules, a new output format, and many improvements and fixes.

New rule: boolean-assignment

Category: idiomatic

Assigning the result of a boolean expression is often redundant, and the expression is better placed in the rule body, following an if. This also makes for a more readable rule.

# Instead of this
more_than_one_member := count(input.members) > 1

# Prefer this
more_than_one_member if count(input.members) > 1

For more information, see the docs on boolean-assignment.

New rule: redundant-existence-check

Category: bugs

Checking whether a reference is defined immediately before it's used isn't needed, as an undefined value will have evaluation fail either way:

# Instead of this
employee if {
    input.user.email
    endswith(input.user.email, "@acmecorp.com")
}

# Prefer this
employee if {
    endswith(input.user.email, "@acmecorp.com")
}

For more information, see the docs on redundant-existence-check.

New SARIF output format

SARIF is a standardized output format used and supported by many tools working with static analysis and code quality. Use --format sarif to have regal lint generate standard SARIF output, which can then be consumed by a number of tools.

Bugs fixed

Other improvements

  • The prefer-some-in-iteration rule will by default no longer flag iteration where a sub-attribute is used, like input[_].item
  • The use-in-operator rule has been extended to include more types of items, leading to better discovery of locations where in should be used
  • Remove replace directive in go.mod that made hard to integrate Regal as a library. Thanks, @jamietanna!
  • The project now uses markdownlint to ensure consistent formatting of its documentation
  • The Go API now allows reading custom rules from an fs.FS filesystem
  • OPA dependency bumped to latest v0.59.0
  • Use matrix to build and test Regal in CI for all supported operating systems

Documentation

  • The README now includes a section covering the opa check --strict command, and how it relates to Regal
  • A new page featuring editor integrations has been added to the docs. Thanks, @eshepelyuk!
  • A new page featuring Regal adopters has been added

Changelog

Contributors

anderseknert, srenatus, and 3 other contributors
Assets 8
Loading

v0.13.0

17 Nov 09:40
@github-actions github-actions
v0.13.0
227e454
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.13.0

This release brings 3 new linter rules, several performance improvements, and many fixes and tweaks to existing rules.

New rules: use-if and use-contains

Category: idiomatic

The if and contains keywords are considered idiomatic in modern Rego, as they help both with readability as well as to remove some ambiguities from earlier versions of the language. In fact, both of the keywords will be made mandatory in the upcoming OPA 1.0 release. There's no need to wait for that though! The use-if and use-contains rules helps you get ahead of the curve and enforce the use of these keywords today.

For more information, see the docs on use-if and use-contains.

Thanks @tsandall for suggesting these rules!

New rule: if-empty-object

Category: bugs

With the introduction of the if keyword, an empty pair of curly braces ({}) is no longer considered a rule body, but an empty object. While previous versions of Rego would treat an empty body as an error, allow if {} would be result in allow assigned to true, as an empty object is a "truthy" value. This is likely a mistake, and the if-empty-object rule will help you find and fix it.

For more information, see the docs on if-empty-object

Performance improvements

While Regal will scan most policy repositories in under a second, repos with thousands of policies are necessarily more demanding. This release brings many performance improvements, which should improve the experience working with Regal even for largest Rego repos. These improvements include:

  • More efficient use of the walk built-in in linter rules
  • Remove the file attribute from AST nodes, resulting in less nodes to traverse
  • Parsing of input files now done concurrently
  • Various smaller optimizations in many linter rules

Other improvements

  • The compact output format now prints a prettier compact table

Bugs fixed

Changelog

Contributors

hans-d, tsandall, and 4 other contributors
Assets 8
Loading

v0.12.0

09 Nov 08:44
@github-actions github-actions
v0.12.0
b772b0a
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.12.0

This release adds a long-awaited capabilities feature to Regal. v0.12.0 also brings four new linter rules, and the usual improvements and fixes.

Capabilities

It is now possible to tell Regal which version of OPA (or other project built on top of OPA!) you are targeting. This will have Regal take into account things like which built-in functions are available for the given version, but also more advanced features that may have been introduced in later versions. Relevant linter rules have been updated to support this feature. To provide an example, the custom-has-key-construct rule, which recommends replacing custom "has key" implementation with in and object.keys will now only run if the targeted OPA version is v0.47.0 or later, as that is when object.keys function was introduced.

For more information, see the docs on configuration.

New rule: inconsistent-args

Category: bugs

Inconsistent naming and placement of function arguments is bound to lead to bugs, and should be avoided. The new inconsistent-args will help you spot these inconsistencies and fix them.

Avoid

find_vars(rule, node) if node in rule

# Order of arguments changed, or at least it looks like it
find_vars(node, rule) if {
    walk(rule, [path, value])
    # ...
}

Prefer

find_vars(rule, node) if node in rule

find_vars(rule, node) if {
    walk(rule, [path, value])
    # ...
}

For more information, see the docs on inconsistent-args.

New rule: unnecessary-some

Category: style

Sometimes (some-times?) the some keyword is used in conjunction with in where only in would suffice:

Avoid

is_developer if some "developer" in input.user.roles

Prefer

is_developer if "developer" in input.user.roles

While the two expressions produce the same result, the some keyword is redundant here.

For more information, see the docs on unnecessary-some.

Thanks @kristiansvalland for suggesting this rule!

New rule: yoda-condition

Category: style

Yoda conditions — expressions where the constant portion of a comparison is placed on the left-hand side of the comparison — provide no benefits in Rego. They do however add a certain amount of cognitive overhead for most policy authors in the galaxy.

Avoid

allow if {
    "GET" == input.request.method
    "users" == input.request.path[0]
}

Prefer

allow if {
    input.request.method == "GET"
    input.request.path[0] == "users"
}

For more information, see the docs on yoda-condition.

New rule: one-liner-rule

Category: custom

The new one-liner-rule linter rule will help inform you of any rules that may be turned into one-liners using the new if construct for rules.

Avoid

is_admin if {
    "admin" in input.user.roles
}

Prefer

is_admin if "admin" in input.user.roles

Note that this isn't a general recommendation, but an optional custom rule, which must be enabled manually in the Regal configuration.

For more information, see the docs on one-liner-rule.

Ignore directives improvement

Ignore directives, i.e. comments that tell Regal to ignore one or more rules on a specific line of code, can now be placed on the same line as the violation(s) and not just above:

# regal ignore:prefer-some-in-iteration
name := ast.ref_to_string(ast.functions[i].head.ref)

# Can now also be expressed as

name := ast.ref_to_string(ast.functions[i].head.ref) # regal ignore:prefer-some-in-iteration

Other improvements

  • The identically-named-tests rule now gives a precise location for violations and not just the name of the file where it happened.
  • The prefer-set-or-object-rule now takes more simple array -> set conversion comprehension variants into account, and won't recommend converting those to rules.
  • Added count-comments config option to the rule-length rule, which allows you to configure whether comments should be counted towards the rule length limit (default: false).

Bugs fixed

Community

Changelog

Contributors

anderseknert, charlieegan3, and kristiansvalland
Assets 8
Loading