OPA in github workflows

[javixeneize]

Hi

What is the best way to validate a JSON against an OPA policy in a github workflow? It would be the equivalent to run

opa run -s mypolicy.rego

Is there any existing github action to use in workflows to run opa? If not, this might be a good addition

Thanks

[srenatus]

You can use the setup-opa action:

name: Run OPA Tests  
on: [push]
jobs:
  Run-OPA-Tests:
    runs-on: ubuntu-latest
    steps:
    - name: Check out repository code
      uses: actions/checkout@v2

    - name: Setup OPA
      uses: open-policy-agent/setup-opa@v1
      with:
        version: latest

    - name: Run OPA Tests 
      run: opa test tests/*.rego -v

Note that this won't work with opa run -s, since that's the server mode. But you can do opa test, or opa parse, whatever you want 😎

[javixeneize]

yep :) so, no action on that yet i guess, right? what should we do to release one

[srenatus]

Yes no action on that yet. I guess the way forward would be to present some MVP-y thing in your org...? If there's significant interest, we might be able to move into into the open-policy-agent org, if that's what you'd desire.

[anderseknert]

Just since I haven't seen it mentioned here, but if you want "opa run" but for one-off operations, opa exec is your friend :)

[javixeneize]

Yep I have tested in the workflow both with opa exec and opa run, they work fine but maybe a wrapper that covers this as a single action (setup+ Run whatever operation) might be good.

my workflow works well but it implies setup+run+curl (or setup+exec) so not a big deal but maybe an easier interface as an action would be welcome

[anderseknert]

Yeah, that's a matter of taste, I suppose. I personally like having the commands run visible in plain text, so that I can re-run them in other contexts (i.e. on my own machine) by simply copy-pasting them over. But I don't mind seeing alternatives in this space! :)