ci: enforce Rego v1 policies with Regal by dakshhhhh16 · Pull Request #408 · mindersec/minder-rules-and-profiles

dakshhhhh16 · 2026-06-28T15:31:41Z

Part of mindersec/minder#5262
Resolves #409

Summary

Adds a CI guardrail that keeps official rule policies on Rego v1 and prevents formatting regressions.

What changed

Added a repository-level Regal configuration for use-rego-v1 and opa-fmt.
Added a small extraction utility for Rego policies embedded in rule-type YAML.
Check that embedded policies remain idempotent with opa fmt --v0-v1.
Run pinned OPA and Regal versions in CI.
Lint all 65 official policies across the main, security-baseline, and autofill rule directories.

The Regal job is intentionally limited to the two migration rules, so this PR does not introduce unrelated style cleanup.

Testing

python3 scripts/migrate-rego-v1.py --check .
python3 scripts/extract-rego.py \
  --output /tmp/minder-rego \
  rule-types security-baseline/rule-types autofill-insights/rule-types
find /tmp/minder-rego -name '*.rego' -exec opa fmt --write {} +
go run github.com/open-policy-agent/regal@v0.41.1 lint \
  --disable-all \
  --enable use-rego-v1 \
  --enable opa-fmt \
  --config-file .regal/config.yaml \
  /tmp/minder-rego
go test ./...

Copilot

Pull request overview

Adds CI enforcement to keep all embedded Rego policies compliant with Rego v1 and prevent formatting drift by extracting YAML-embedded policies, normalizing them with OPA, and linting them with Regal.

Changes:

Added scripts/extract-rego.py to extract embedded Rego def: | blocks into standalone .rego files.
Added .regal/config.yaml to enforce Regal rules (use-rego-v1, opa-fmt) with pinned OPA capabilities.
Extended .github/workflows/lint.yaml to install OPA, check embedded formatting, extract/normalize policies, and lint with Regal.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
scripts/extract-rego.py	New utility to extract embedded Rego blocks from YAML into standalone `.rego` files for linting/format checks.
.regal/config.yaml	Regal configuration enabling `use-rego-v1` and `opa-fmt`, plus OPA capabilities pinning.
.github/workflows/lint.yaml	CI job additions to install OPA, validate embedded formatting, extract/normalize policies, and run Regal lint.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+def output_name(path: pathlib.Path, policy_index: int) -> str:
+    normalized = "__".join(path.parts)
+    return f"{normalized}.{policy_index}.rego"


evankanderson

You may want to take a look at mindersec/minder#6558; that PR would allow us to move all the rego files to be .rego with comments for the rest of the RuleType definition, rather than embedded rego inside YAML.

dakshhhhh16 · 2026-07-01T19:44:37Z

You may want to take a look at mindersec/minder#6558; that PR would allow us to move all the rego files to be .rego with comments for the rest of the RuleType definition, rather than embedded rego inside YAML.

Thanks for pointing me to mindersec/minder#6558. It looks like that approach could remove the need to extract Rego from YAML before linting. Would you prefer that I wait for mindersec/minder#6558 and update this PR to lint the .rego files directly, or keep the current approach as a temporary check for the existing YAML format?

evankanderson · 2026-07-01T19:11:36Z

It feels like you're extracting a single (well-known) YAML field from a document here -- this should almost certainly use pyyaml rather than string processing. (Or you could use yq and some shell, but I'm okay with using Python)

I personally like python more, can change it if it's necessary.

I'm happy to keep using python, but I'd like to use the yaml library for parsing, rather than ad-hoc parsing with regular expressions and python code.

Will keep this in mind

evankanderson

I think it's fine to merge this now, when the rego change merges we can hopefully simplify a lot of this. (And seeing this pile higher motivated me to go in and try to fix things at the root.)

evankanderson · 2026-07-01T20:46:07Z

I'm happy to keep using python, but I'd like to use the yaml library for parsing, rather than ad-hoc parsing with regular expressions and python code.

dakshhhhh16 · 2026-07-06T07:49:15Z

@evankanderson
Can you pls merge this one so that i can proceed forward?

evankanderson

This should use the standard YAML module for the extraction. (It's fine to use python rather than e.g. yq .def.eval.rego.def $filename), but let's not roll our own extraction code when the library handles that case just fine.)

evankanderson · 2026-07-06T20:59:00Z

+    lines = path.read_text().splitlines(True)
+    policies: list[str] = []
+    index = 0
+
+    while index < len(lines):
+        match = DEF_BLOCK_RE.match(lines[index])
+        if not match:
+            index += 1
+            continue
+
+        source, index = extract_block(
+            lines,
+            index + 1,
+            len(match.group("indent")),
+        )
+        if source.lstrip().startswith("package "):
+            policies.append(source)
+
+    return policies


If you use PyYAML, this is:

Suggested change

lines = path.read_text().splitlines(True)

policies: list[str] = []

index = 0

while index < len(lines):

match = DEF_BLOCK_RE.match(lines[index])

if not match:

index += 1

continue

source, index = extract_block(

lines,

index + 1,

len(match.group("indent")),

)

if source.lstrip().startswith("package "):

policies.append(source)

return policies

contents = yaml.load(path.read_text())

rego = contents.get('def', {}).get('eval', {}),.get('rego', {}).get('def', "")

if rego != "":

return [rego]

return []

And you don't need extract_block, etc.

Done, it now reads def.eval.rego.def with safe_load, and the old extraction helpers are removed.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

dakshhhhh16 · 2026-07-11T19:11:34Z

Apologies for a late revert, I was a bit busy from the past few days, I have made the changes, you can have a look now!

dakshhhhh16 marked this pull request as ready for review June 28, 2026 15:33

dakshhhhh16 requested a review from a team as a code owner June 28, 2026 15:33

Copilot AI review requested due to automatic review settings June 28, 2026 15:33

Copilot started reviewing on behalf of dakshhhhh16 June 28, 2026 15:33 View session

Copilot AI reviewed Jun 28, 2026

View reviewed changes

Comment thread scripts/extract-rego.py

Comment on lines +73 to +75

def output_name(path: pathlib.Path, policy_index: int) -> str:

normalized = "__".join(path.parts)

return f"{normalized}.{policy_index}.rego"

Comment thread .regal/config.yaml

dakshhhhh16 force-pushed the ci/regal-rego-v1 branch from e8b0710 to 84f4a4c Compare June 29, 2026 18:48

evankanderson reviewed Jul 1, 2026

View reviewed changes

dakshhhhh16 requested a review from evankanderson July 1, 2026 22:11

evankanderson reviewed Jul 6, 2026

View reviewed changes

dakshhhhh16 and others added 4 commits July 12, 2026 00:41

ci: enforce Rego v1 policies with Regal

2edf2db

Potential fix for pull request finding

7d806d3

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

fix: use supported Regal capabilities

0c5b0eb

fix: parse Rego definitions with PyYAML

1cd15d4

dakshhhhh16 force-pushed the ci/regal-rego-v1 branch from 39c5af6 to 1cd15d4 Compare July 11, 2026 19:11

Uh oh!

Conversation

dakshhhhh16 commented Jun 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What changed

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

evankanderson left a comment

Choose a reason for hiding this comment

Uh oh!

dakshhhhh16 commented Jul 1, 2026

Uh oh!

evankanderson Jul 1, 2026

Choose a reason for hiding this comment

Uh oh!

dakshhhhh16 Jul 1, 2026

Choose a reason for hiding this comment

Uh oh!

evankanderson Jul 1, 2026

Choose a reason for hiding this comment

Uh oh!

dakshhhhh16 Jul 1, 2026

Choose a reason for hiding this comment

Uh oh!

evankanderson left a comment

Choose a reason for hiding this comment

Uh oh!

evankanderson Jul 1, 2026

Choose a reason for hiding this comment

Uh oh!

dakshhhhh16 commented Jul 6, 2026

Uh oh!

evankanderson left a comment

Choose a reason for hiding this comment

Uh oh!

evankanderson Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

dakshhhhh16 Jul 11, 2026

Choose a reason for hiding this comment

Uh oh!

dakshhhhh16 commented Jul 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dakshhhhh16 commented Jun 28, 2026 •

edited

Loading