Skip to content

Releases: StyraInc/regal

v0.32.0

25 Mar 17:34
@github-actions github-actions
v0.32.0
fe6de2e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.32.0 Latest
Latest

This release adds 3 new linter rules to Regal, as well as many improvements and fixes.

New Rule: redundant-loop-count

A loop iterating over empty collections evaluates to nothing, and counting the collection before the loop to ensure it's not empty is therefore redundant. This rule catches cases where this check is not needed. (Read more)

package policy

allow if {
    # redundant count and > comparison
    count(input.user.roles) > 0

    some role in input.user.roles
    # .. do more with role ..
}

PR #1452.

New Rule: import-shadows-rule

This new rule catches cases where users have named rules the same as an import. Imported identifier have higher precedence than rules and this can lead to confusing behaviours. (Read more)

package policy

import data.resources

# 'resources' shadowed by import 
resources contains resource if {
    # ...
}

PR #1450.

Thanks @kroekle for suggesting this rule!

New Rule: time-now-ns-twice

This new rule will catch cases where time.now_ns() is called multiple times within a single rule. This does not work in Rego since both calls will return the same value. This rule catches this case early and directs users to read about more appropriate tools. (Read more)

package policy

timed if {
    now := time.now_ns()
    # do some work here
    # this doesn't work! result is always 0
    print("work done in:", time.now_ns() - now, "ns)
}

PR #1457.

Other Rule Updates

OPA v1.2.0

While this may not seem too exciting, OPA v1.2.0 contains some performance improvements that has quite a substantial impact on Regal. We know, because we made those improvements in OPA largely to speed up Regal's linting! v0.32.0 should be considerably faster than previous versions, which should be noticeable in large policy projects in particular.

Language Server

In the language server, we addressed two bugs relating to the fixing of the idiomatic/directory-package-mismatch rule. See #1427 & #1432.

Dependencies

Go Mod:

GitHub Actions:

See #1453, #1442, #1435, #1426, #1422 and #1423 for PRs making the above updates. golangci-lint v2 update in #1455. OPA 1.2 update in #1429.

New Users

Add yourself to docs/adopters.md to get here next time!

New Contributors

Changelog

Contributors

anderseknert, kroekle, and 4 other contributors
Assets 8
Loading

v0.31.1

25 Feb 21:36
@github-actions github-actions
v0.31.1
4fd08cb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.31.1

This patch release fixes some issues reported by users, as well as some encountered while working on Regal. Most notably:

  • Fix issue where an absolute path to the config file wouldn't work on Windows (thanks @geirs73 for reporting this!)
  • Fix issue where configured ignore values had no effect if Regal ran from the root directory (thanks @nevumx for the issue!)
  • Fix issue in language server when files with : in their name are present in the workspace
  • Fix issue in language server where Code Lens annotations (like Evaluate and Debug) would appear and reappear quickly when parse errors where encountered and fixed, leading to a "flickering" editor window

Changelog

Contributors

anderseknert, geirs73, and 3 other contributors
Loading

v0.31.0

11 Feb 16:56
@github-actions github-actions
v0.31.0
b29e759
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.31.0

This release of Regal updates to OPA v1.1.0, continuing to solidify support for v1 Rego with some nice new rules, performance improvements and bug fixes too.

New Rule: use-object-keys

There are some cases where using object.keys is preferred over using comprehensions. For example:

Avoid

package policy

keys := {k | some k, _ in input.object}

Prefer

package policy

keys := object.keys(input.object)

This is preferred as it more clearly communicates the intent of the code, that is, to get the keys of the object rather than loop over it and collect the keys as you go. More details can be found on the use-object-keys rule page.

New Rule: non-loop-expression

Expressions in loops are evaluated in each iteration of the loop and so it's advisable to avoid using expressions which do not depend on the loop variable within the looping part of a rule in order to improve performance.

Avoid

package policy
allow if {
    some email in input.emails
    admin in input.roles # <- this is not required in the loop
    endswith(email, "@example.com")
}

Prefer

package policy
allow if {
    admin in input.roles # <- moved out of the loop
    some email in input.emails
    endswith(email, "@example.com")
}

This rule can't catch all cases, so still be on the look out. More details can be found on the non-loop-expression rule page.

Fixing non-raw-regex-pattern

The non-raw-regex-pattern rule can now be automatically fixed with regal fix or with a CodeAction for language server clients. #1382

Configuration File Loading

Regal will now use a ~/.config/regal if no parent configuration is found. This is useful when working on Rego in temporary directories. #1378

Regal's language server will now use configuration files in the workspace tree if they exist rather than only looking at parent directories. This more closely matches the behavior of the lint command. #1372

Notable Improvements

  • Avoid 'error' paths in our linting Rego to reduce allocations. #1351, #1360, #1374
  • Implement the opa-fmt rule using in Rego, removing the need for a Go rule
    linting path entirely. #1393
  • More consistently use shared functions and remove dead code to make Regal easier to maintain. #1349,
    #1392, #1383, #1379, #1358, #1356, #1355
  • @anaypurohit0907 made their first PR in #1369 adding a new summary to the end of the compact report showing the number of files and violations. Also, #1387 adds a similar improvement to the end of the default 'Pretty' reporter output breaking down errors and warnings.
  • Documentation for the deprecated-builtin rule now explains the upgrade process. #1366, thanks @tsandall for the suggestion!

Notable Fixes & Updates

  • The use-if rule will now use only the rule name as the violation location, rather than the whole rule. #1362
  • Parse errors are now shown in file diagnostics to language server clients
    after a regression. #1408
  • @jglasovic made their first PR in #1345
    fixing a bug where the Debug CodeLens was left enabled.
  • Better handling of .regal.yaml file use. #1357, thanks @grosser for the input here.
  • Some great new open source adopters! #1384, thanks @chendrix for the Regal amigurumi!

Changelog

Contributors

grosser, tsandall, and 6 other contributors
Loading

v0.30.2

16 Jan 17:41
@github-actions github-actions
v0.30.2
2c6ee8e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.30.2

This release includes a fix for an issue where a missing Regal dir would cause a fatal error when running regal fix (#1341), thanks @grosser for the report again.

Also included is an a fix for an issue where Regal would template files without a Regal extension after renaming them from a Rego file.

Changelog

Contributors

grosser and charlieegan3
Loading

v0.30.1

16 Jan 14:58
@charlieegan3 charlieegan3
v0.30.1
5986638
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.30.1

Regal v0.30.1 is a patch release following the significant v0.30.0 release with first class OPA v1.0.0 support. This patch release addresses some issues discovered in the language server relating to the OPA update as well as a minor new feature.

New options for Regal config location

In addition to the .regal/config.yaml path we've used thus far, it's now possible to use a .regal.yaml instead. This is intended to be used by those preferring a single file rather than a dedicated directory. The config directory will still be required for users with custom rules. It is not possible to use $root/.regal/config.yaml and $root/.regal.yaml in the same directory at the same time. Regal will still use the config file nearest the root in the directory hierarchy, even if they are of different types. Thanks to @grosser for the suggestion!

Changelog

Full Changelog: v0.30.0...v0.30.1

Contributors

grosser, anderseknert, and charlieegan3
Loading

v0.30.0

13 Jan 15:27
@github-actions github-actions
v0.30.0
351b5bb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.30.0

Regal v0.30.0 is the first release to fully support OPA 1.0 while at the same time being fully compatible with older versions of OPA and Rego. This process helped improve both Regal and OPA, as a few things to fix in both projects got identified along the way!

Full support for OPA 1.0, while maintaining compatibility with earlier versions

Regal now seamlessly supports working with both pre-1.0 and 1.0+ policies, or even a mix of both! See Regal's new documentation on OPA 1.0 to learn more about how to get the most out of Regal when working with Rego of any version.

As part of this upgrade, all the Regal docs have now been updated to use OPA/Rego 1.0 syntax, in examples and anywhere else Rego is used.

Finally, and perhaps needless to say — Regal itself and all of its linter policies are now upgraded to OPA 1.0!

Much Faster Linting

A mission that started out with the goal of improving the performance of Regal's linter, ended up with multiple PR's
to improve evaluation performance in OPA. This of course benefits not just Regal, but all users of OPA! However, since
the regal lint command was used for benchmarking, most optimizations have been along the hot path of that command.

Linting with Regal is now almost 2x as fast as before, while consuming 2/3 of the memory previously needed. And we have
more improvements lined up in OPA for the next release, so stay tuned!

Notable Improvements

  • The evaluation code lens now supports using an input.yaml file as input, in addition to input.json. Thanks @mrgadgil for suggesting this feature!
  • The redundant-existence-check rule now also reports redudant checks of function arguments
  • New InputFromTextWithOptions functions for users of the Go API
  • Faster evaluation by avoiding custom function calls in hot path
  • Reduced time to evaluation by performance improvements in Roast input conversion
  • The language server now logs the version of Regal and the path to the binary at startup, helping users know which Regal binary is being used

Notable Fixes

Changelog

Contributors

grosser, tsandall, and 6 other contributors
Loading

v0.29.2

15 Nov 09:16
@github-actions github-actions
v0.29.2
20a5cfa
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.29.2

This patch release fixes an issue where the new defer-assignment rule would sometimes report a false positive when the variable was used inside of a with clause on the next line.

Thanks @nevumx for reporting the issue!

Changelog

Contributors

anderseknert and nevumx
Loading

v0.29.1

14 Nov 13:35
@github-actions github-actions
v0.29.1
743a65b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.29.1

This patch release fixes an issue where custom (i.e. user-created) aggregate rules1. wouldn't work as expected when the condition for a violation was the absence of aggregated data. This could for example be a rule that says "at least one rule must be named allow, and it must have a default assignment to false".

Upgrading from v0.29.0 is not required unless you're writing custom Regal rules.

Many thanks to @shibataka000 for reporting the issue, and in such an exemplary way ⭐

Changelog

  1. scroll below the table of rules for an explanation of what aggregate rules are ↩

Contributors

anderseknert, shibataka000, and dependabot
Loading

v0.29.0

12 Nov 15:16
@github-actions github-actions
v0.29.0
5cb67ea
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.29.0

This is a big release, spanning more than a month of development! Regal v0.29.0 brings new linter rules, performance improvements and new features to both the linter and the language server.

New rules

defer-assignment

Category: performance

The new defer-assignment rule helps detect when assignment can be moved to later in the rule body, possibly avoiding it at all if the conditions below don’t evaluate.

allow if {
    # this assignment can be deferred to after the roles check
    resp := http.send({"method": "get", "url": "http:localhost"})
    
    "rego hacker" in input.user.roles
    
    resp.status_code == 200
}

This can improve performance by having less to evaluate, and it makes policies easier to read. Double win!

For more information, see the docs on defer-assignment.

walk-no-path

Category: performance

When using the walk built-in function on large data structures, traversing only the values without building a path to each node can save a considerable amout of time. The new walk-no-path rule will detect when the assigned path is unused and can be replaced by a wildcard variable, which tells OPA to skip the construction of the path. This dramatically improves the performance of the function.

found if {
    # path assigned but never referenced in the rule
    walk(haystack, [path, value])

    value == "needle"
}

# should be replaced by

found if {
    walk(haystack, [_, value])

    value == "needle"
}

For more information, see the docs on walk-no-path.

rule-assigns-default

Category: bugs

Assigning a rule the same value as the default value set for the rule is always a bug, and while hopefully not too common, now reported by Regal.

default threshold := 1

threshold := 0 if {
    # some conditions
}

# this is already the default condition!
# and having this removed will have no impact on how
# the rule evaluates.. don't do this!
threshold := 1 if {
    # some conditions
}

For more information, see the docs on rule-assigns-default.

Language Server

Evaluation Code Lens for Neovim

We were exicted to learn the Code Lens for Evaluation (“click to evaluate”) feature we built now works not only in VS Code but also in Neovim. This thanks to work by regular contributor @rinx. Thank you! The language server docs have now been updated to reflect this.

Improved Enterprise OPA integration

Setting the capabilities engine to eopa will now have the language sever recognize Enterprise OPA-specific built-in functions, and provide both auto-completions for those as well as informative tooltips on hover. Clicking links in the tooltip now correctly brings you to the Styra docs for the Enterprise OPA built-in functions.

Notable Improvements

  • The leaked-internal-reference rule is now ignored in tests by default. See the docs for this rule if you wish to enable this.
  • The prefer-snake-case rule now also reports violations in package names.
  • The same prepared query is now used both for linting and to collect data for aggregate rules, saving about 150 milliseconds for any given regal lint run.
  • Regal’s own capabilities and provided configuration is now available when running the evaluation code lens, simplifying development of custom rules.
  • The pretty reporting format will now print the severity level of a violation when no color support is detected in the terminal (reported by @geirs73)
  • The --instrument flag from opa eval is now supported also by regal lint, providing detailed information about where most time is spent while linting.

Notable Fixes

  • Using input.json for the evaluation code lens now works reliably on Windows. As does ourcing a capabilities.json file from the filesystem. Thanks to @geirs73 for reporting these issues!
  • Global ignore directives from .regal/config.yaml would sometimes be parsed differently depending on read by regal lint or the language server. This has now been fixed.
  • Fix false positive in inconsistent-args rule when an arity mismatch should rather be handled by the compiler. Thanks @tsandall for reporting that!
  • Fix a false positive in use-contains rule when not importing rego.v1. This turned out to be an issue originating in OPA, so we fixed it there, and later included in Regal by upgrading the dependency to the latest OPA version v0.70.0. Thanks @drewcorlin1 for reporting the issue!

Changelog

Read more

Contributors

tsandall, anderseknert, and 8 other contributors
Loading

v0.28.0

07 Oct 15:31
@github-actions github-actions
v0.28.0
9503967
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.28.0

New Rule: missing-metadata #1131

The new missing-metadata rule helps ensure policies are documented by requiring METADATA comments on public packages and rules. Metadata comments are used to explain functionality and annotate Rego constructs with other data.

Note: missing-metadata is a custom rule and so is not enabled by default for all users.

fixer: Automated fixing of directory-package-mismatch

This release brings improvements to regal fix, the command to automatically fix supported violations (#1120, #1127).

Fixes for the directory-package-mismatch violations involve moving files based on their packages. For example a file with package foo.bar in policies/policy.rego would need to be moved to foo/policy.rego. In previous versions of Regal, when multiple files in a large code base with the same filename needed to be moved to the same package directory, Regal would output a confusing error message.

Regal v0.28.0 outputs a clear error message by default and adds a new --on-conflict=rename modifying flag to allow conflicting files to automatically be renamed when this scenario is encountered.

Linter Improvements

Language Server Performance Improvements

Dependency Updates

  • anderseknert/roast v0.2.0 -> v0.4.2 #1140, #1170
  • open-policy-agent/opa v0.68.0 -> v0.69.0 #1152

Github Actions Updates

  • golangci/golangci-lint-action 6.1.0 -> 6.1.1 #1163
  • peter-evans/create-pull-request 7.0.3 -> 7.0.5 #1114
  • github/codeql-action 3.26.7 -> 3.26.11 #1117, #1137, #1157, #1174
  • actions/checkout 4.1.7 -> 4.2.0 #1142
  • codecov/codecov-action 4.5.0 -> 4.6.0 #1162, #1164
  • actions/cache 4.0.2 -> 4.1.0 #1179

Changelog

Contributors

anderseknert, srenatus, and 4 other contributors
Loading