Skip to content

Releases: StyraInc/regal

v0.21.0

23 Apr 12:01
@github-actions github-actions
v0.21.0
24c0b85
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.21.0

This is a big release, bringing new regal fix command, several features to the Regal language server, a new linter rule, and many improvements and fixes.

New command: regal fix

The regal fix command allows you to automatically fix some of the (style) issues reported by the Regal linter. This command is available in the CLI and can be run on a single file or a directory. The following linter rules are supported by the regal fix command:

More rules will be added in future releases.

The regal fix command respects the .regal/config.yaml file, and will only fix issues that aren't ignored by configuration.

New rule: unresolved-import

Category: imports

OPA does not resolve imports until runtime, and when it does, unresolved imports are simply undefined. The unresolved-import rule helps catch these issues early by flagging imports that can't be statically resolved by Regal. Since imports could refer to data documents or rules imported at runtime, this linter rule allows providing a list of of references that should be ignored by the linter.

For more information, see the docs on unresolved-import.

Language Server: Code Actions

Similarly to the regal fix command, code actions allows fixing some issues reported by Regal but directly from the editor. This release adds code actions to remediate the following linter rules:

Screenshot 2024-04-23 at 10 25 14

Language Server: Go to Definition

Ctrl/cmd + clicking a reference in the editor now navigates to the definition of the reference, as Regal now implements the "go to definition" feature of the language server protocol.

Screenshot 2024-04-23 at 10 37 02

Language Server: Formatting

The Regal language server now supports formatting Rego files using the opa fmt command. This can be triggered either by running the "Format document" command in your editor, or from where a opa-fmt linter violation is reported in the package.

Language Server: Document Symbols

Symbols — like packages, rules and functions, are now provided by Regal upon requests from an editor. This allows for a quick overview of the structure of a Rego file, and provides "breadcrumbs" to navigate the symbols of an open Rego document.

Screenshot 2024-04-23 at 14 00 14

Language Server: Workspace Symbols

Similarly to document symbols, Regal now reports symbols from the entire workspace, allowing users to search and navigate to any top-level symbol (i.e. package, rule or function) in the workspace.

Screenshot 2024-04-23 at 07 26 20

Language Server: Folding Ranges

Regal now provides folding ranges for Rego files in the workspace, allowing users to fold (i.e. expand or collapse) blocks of code, comments and imports in the editor.

Screenshot 2024-04-23 at 10 45 44

Other improvements

  • The language server now searches for the .regal/config.yaml file in directories above the workspace if not found before. This allows using a shared configuration file for multiple projects. Thanks @bdjgs for requesting this feature!
  • Report not just the line but the exact position of use-assignment-operator violations
  • The result of a hovering over a built-in function is now cached for faster rendering

Bugs fixed

  • Fix bug where whitespace in directory names caused the language server to stop working. Thanks @frittsy for reporting this issue!

Documentation

Changelog

Contributors

anderseknert, charlieegan3, and 2 other contributors
Loading

v0.20.1

09 Apr 15:47
@github-actions github-actions
v0.20.1
e16ffba
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.20.1

This release fixes a panic encountered in the language server when Regal traverses a directory it cannot read while walking the workspace.

Thanks @frittsy for reporting the issue!

Changelog

Contributors

anderseknert and frittsy
Loading

v0.20.0

08 Apr 12:36
@github-actions github-actions
v0.20.0
6df97b3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.20.0

This release adds various improvements to the functionality of the language server as well as also including a number of housekeeping updates and fixes.

Language Server: Hover support for built-in function definitions

The language server protocol supports requesting information about the tokens under the cursor. This release implements support for such requests when users are hovering over Rego's built-in functions. Clicking the link in the tooltip heading will take you to the OPA docs for that built-in.

318763769-c21a5954-abd2-4ea6-a758-bec233687491

Language Server: Inlay Hints

Inlay Hint requests are also supported from this release. Inlay hints are allow named function arguments to be shown as users edit function calls.

screenshot_2024-04-03_at_14 17 30

Improvements

  • Running the language server with --verbose will now show the full request response logs.
  • File ignore config is now also supported by the language server.
  • Unresolved imports are not flagged as part of prefer-package-imports

Updates

  • This release updates OPA to v0.63.0, see the OPA changelog for more detail.
  • Go SARIF has also been updated to 2.3.1

Changelog

Contributors

anderseknert, charlieegan3, and dependabot
Loading

v0.19.0

18 Mar 17:00
@github-actions github-actions
v0.19.0
4f559f2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.19.0

This release adds several new options for setting configuration options for rules in groups, allowing users to keep a static configuration across updates, or to ignore certainly classes of rules. v0.19.0 also includes a number of fixes to both linter rules and the language server integration, making for an even better experience when using Regal from VS Code or other LSP clients.

New default rule configuration option

The rules section in the Regal configuration file may now include a default attribute either at the top level, or in any specific category. This allows enabling/disabling entire categories of rules, or to avoid Regal to "break" CI/CD builds on updates if new rules are introduced. While it's arguably good to have new problems surfaced, we recognize that some organizations value stability first, and may opt for more controlled upgrades.

Example, using a default configuration to ignore all rules except for those explicitly listed:

rules:
  default:
    level: ignore
  bugs:
    constant-condition:
      level: error
    deprecated-builtin:
      level: error
    duplicate-rule:
      level: error

Example, using a default configuration to enable all rules except for those in the style category:

rules:
  default:
    level: error
  style:
    level: ignore

To learn more about the new default option, and the precedence rules for the various ways to ignore rules, see the Regal docs.

Fixes

  • Fix false positive in prefer-some-in-iteration in function args
  • Fix false positive in several rules not counting imports in scope
  • Many fixes and improvements related to the LSP integration — see the changelog below for details

Changelog

Contributors

gusega, anderseknert, and 2 other contributors
Loading

v0.18.0

01 Mar 20:28
@github-actions github-actions
v0.18.0
b1a6fbe
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.18.0

Only a week after v0.17.0, this release comes a little earlier than planned as we found a few issues in the VS Code OPA extension integration that we wanted to address as soon as possible. Nothing serious, but having that extension provide a great Regal experience feels important enough for us to warrant an earlier v0.18.0 release. That's not all there is to this release though, as we have both a new linter rule as well as a bunch of fixes included here. Enjoy!

New rule: ignored-import

Category: imports

Use of explicit references (like data.user.roles) that could instead point to an existing import will now be flagged in order to ensure that the imports a user has declared aren't ignored later in the policy.

For more information, see the docs on ignored-import.

Improvements

Bugs Fixed

Changelog

Contributors

anderseknert and charlieegan3
Loading

v0.17.0

22 Feb 08:08
@github-actions github-actions
v0.17.0
ece9977
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.17.0

This is a fairly big release, adding 4 new linter rules and a whole bunch of improvements and fixes.

New rule: with-outside-test-context

Category: performance

This is the first rule in the new performance category, with more to follow in future releases. The with keyword is known to most as a way to mock values and functions in unit tests. While it's occasionally useful in other contexts, it comes with some major performance implications when used outside of tests. This new rule warns when with is encoutered outside the context of tests.

For more information, see the docs on with-outside-test-context.

New rule: circular-import

Category: imports

A circular import is when a package imports itself, either by directly importing itself, or indirectly by importing a which in turn imports a series of packages that eventually import the original package. As long as recursive rules definitions are avoided, circular imports are permitted in Rego. However, such import graphs are not advisable and a signal of poorly structured policy code.

For more information, see the docs on circular-import.

New rule: rule-name-repeats-package

Category: style

When rules are referenced outside the package in which they are defined, they will be referenced using the package path. For example, the allow rule in the example package, is available at data.example.allow. When rule names include all or part of their package paths, this creates repetition in such references. For example, authz_allow in a package authz is referenced with: data.authz.authz_allow. This repetition is undesirable as the reference is longer than needed, and harder to read.

For more information, see the docs on rule-name-repeats-package.

New rule: double negative

Category: style

While rules using double negatives — like not no_funds — occasionally make sense, it is often worth considering whether the rule could be rewritten without the negative. For example, not no_funds could be rewritten as funds or has_funds, or funds_available.

For more information, see the docs on double-negative.

Improvements

  • The Regal language server now supports client shutdown messages
  • The docs on how to ignore rules and files have been greatly improved. Thanks @bdumpp and @orenzohar for the suggestion!

Bugs Fixed

  • Fix false positive in prefer-some-in-iteration rule when old-style iteration was used inside of arrays, sets and objects
  • Fix false positive in prefer-some-in-iteration rule when old-style iteration was used inside of rule head key (i.e. contains)
  • Fix false positive in external-reference rule when using = for assignment (although you shouldn't!)
  • The Regal language server now correctly handles URIs and paths on Windows

Ecosystem

The setup-regal GitHub Action has been promoted to v1. This fixes the warning in pipelines about depending on an old Node version. Make sure to update your workflows!

Changelog

Contributors

anderseknert, charlieegan3, and 3 other contributors
Loading

v0.16.0

05 Feb 12:55
@github-actions github-actions
v0.16.0
bc27c76
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.16.0

This release adds 2 new linter rules and a language server protocol (LSP) implementation to Regal.

New rule: duplicate-rule

Category: bugs

The new duplicate-rule linter rule flags any rules with duplicated code found in a policy. Duplicate rules are almost certainly a mistake, perhaps from copy-pasting code, and should simply be fixed (or likely, removed).

For more information, see the docs on duplicate-rule.

New rule: use-rego-v1

Category: imports

OPA v0.59.0 introduced a new import named rego.v1. When import rego.v1 is used in a policy, OPA will ensure the policy is compliant with the upcoming OPA 1.0 release. This include enforcing the use of the if and contains keywords, that no deprecated built-ins are used, and more. To learn more about OPA 1.0 and the rego.v1 import, see the OPA docs.

As rego.v1 replaces the future.keywords imports, the Regal rules around those imports are automatically disabled when use-rego-v1 is in use. If you wish to target a version of OPA before rego.v1, use the capabilities feature of the Regal configuration file.

Avoid

package policy

# before OPA v0.59.0, this was best practice
import future.keywords.contains
import future.keywords.if

report contains item if {
    # ...
}

Prefer

package policy

# with OPA v0.59.0 and later, use this instead
import rego.v1

report contains item if {
    # ...
}

For more information, see the docs on use-rego-v1.

New feature: Regal language server

The Language Server Protocol (LSP) provides a way for editors to integrate support for various programming languages using a common protocol. Using an LSP server implementation rather than one built specifically for a single editor allows the same code to be used across all editors with LSP support. v0.16.0 brings a language server mode to Regal, allowing diagnostics (i.e. linting) of Rego to be performed continuously in a workspace rather than as a one-off CLI operation. This is the first step towards bringing Regal into editors like VS Code, and having linting of Rego natively supported as you work with your policies. Expect to see more in this space soon!

Huge thanks to @charlieegan3 for this outstanding contribution!

Changelog

Contributors

anderseknert, srenatus, and 2 other contributors
Loading

v0.15.0

05 Jan 14:17
@github-actions github-actions
v0.15.0
f80597e
Compare
Choose a tag to compare
v0.15.0

This release brings 2 new linter rules, and a few improvements and fixes.

New rule: deprecated-builtin

Category: bugs

Calling deprecated built-in functions should always be avoided, and replacing them is usually trivial. Refer to the OPA docs on strict mode for more details on which built-in functions counts as deprecated.

For more information, see the docs on deprecated-builtin.

New rule: default-over-not

Category: style

Avoid

package policy

import future.keywords.if

username := input.user.name

username := "anonymous" if not input.user.name

Prefer

package policy

default username := "anonymous"

username := input.user.name

While both forms are valid, using the default keyword to assign a constant value in the fallback case better
communicates intent, avoids negation where it isn't needed, and requires less instructions to evaluate. Note that this
rule only covers simple cases where one rule assigns the "happy" path, and another rule assigns on the same condition
negated. This is by design, as using not and negation may very well be the right choice for more complex cases!

For more information, see the docs on default-over-not.

Other improvements

  • Ignore directives can now be placed anywhere in a comment, and not just at the start of one. Thanks @nevumx for requesting this!

Bugs fixed

  • SARIF output format: omit region for violations with whole file as location. Thanks @travbale for reporting this!
  • SARIF output format: fix incorrect level of notice and use none instead. Thanks @travbale for reporting this!

Community

  • The Minder project was added as an adopter. Thanks @JAORMX for this!

Changelog

Contributors

JAORMX, anderseknert, and 4 other contributors
Loading

v0.14.0

05 Dec 08:01
@github-actions github-actions
v0.14.0
b9342d4
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.14.0

This release brings 2 new linter rules, a new output format, and many improvements and fixes.

New rule: boolean-assignment

Category: idiomatic

Assigning the result of a boolean expression is often redundant, and the expression is better placed in the rule body, following an if. This also makes for a more readable rule.

# Instead of this
more_than_one_member := count(input.members) > 1

# Prefer this
more_than_one_member if count(input.members) > 1

For more information, see the docs on boolean-assignment.

New rule: redundant-existence-check

Category: bugs

Checking whether a reference is defined immediately before it's used isn't needed, as an undefined value will have evaluation fail either way:

# Instead of this
employee if {
    input.user.email
    endswith(input.user.email, "@acmecorp.com")
}

# Prefer this
employee if {
    endswith(input.user.email, "@acmecorp.com")
}

For more information, see the docs on redundant-existence-check.

New SARIF output format

SARIF is a standardized output format used and supported by many tools working with static analysis and code quality. Use --format sarif to have regal lint generate standard SARIF output, which can then be consumed by a number of tools.

Bugs fixed

Other improvements

  • The prefer-some-in-iteration rule will by default no longer flag iteration where a sub-attribute is used, like input[_].item
  • The use-in-operator rule has been extended to include more types of items, leading to better discovery of locations where in should be used
  • Remove replace directive in go.mod that made hard to integrate Regal as a library. Thanks, @jamietanna!
  • The project now uses markdownlint to ensure consistent formatting of its documentation
  • The Go API now allows reading custom rules from an fs.FS filesystem
  • OPA dependency bumped to latest v0.59.0
  • Use matrix to build and test Regal in CI for all supported operating systems

Documentation

  • The README now includes a section covering the opa check --strict command, and how it relates to Regal
  • A new page featuring editor integrations has been added to the docs. Thanks, @eshepelyuk!
  • A new page featuring Regal adopters has been added

Changelog

Contributors

anderseknert, srenatus, and 3 other contributors
Loading

v0.13.0

17 Nov 09:40
@github-actions github-actions
v0.13.0
227e454
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.13.0

This release brings 3 new linter rules, several performance improvements, and many fixes and tweaks to existing rules.

New rules: use-if and use-contains

Category: idiomatic

The if and contains keywords are considered idiomatic in modern Rego, as they help both with readability as well as to remove some ambiguities from earlier versions of the language. In fact, both of the keywords will be made mandatory in the upcoming OPA 1.0 release. There's no need to wait for that though! The use-if and use-contains rules helps you get ahead of the curve and enforce the use of these keywords today.

For more information, see the docs on use-if and use-contains.

Thanks @tsandall for suggesting these rules!

New rule: if-empty-object

Category: bugs

With the introduction of the if keyword, an empty pair of curly braces ({}) is no longer considered a rule body, but an empty object. While previous versions of Rego would treat an empty body as an error, allow if {} would be result in allow assigned to true, as an empty object is a "truthy" value. This is likely a mistake, and the if-empty-object rule will help you find and fix it.

For more information, see the docs on if-empty-object

Performance improvements

While Regal will scan most policy repositories in under a second, repos with thousands of policies are necessarily more demanding. This release brings many performance improvements, which should improve the experience working with Regal even for largest Rego repos. These improvements include:

  • More efficient use of the walk built-in in linter rules
  • Remove the file attribute from AST nodes, resulting in less nodes to traverse
  • Parsing of input files now done concurrently
  • Various smaller optimizations in many linter rules

Other improvements

  • The compact output format now prints a prettier compact table

Bugs fixed

Changelog

Contributors

hans-d, tsandall, and 4 other contributors
Loading