continuous-integration.yaml

name: Continuous Integration

on:
  push:
    branches:
      - main
  pull_request:

jobs:
  regal-check:
    name: Regal Check
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v3
      - name: Setup Regal
        uses: StyraInc/setup-regal@v0.2.0
        with:
          version: v0.11.0
      - run: regal lint --format=github .

  syntax-check:
    name: Syntax Check
    runs-on: ubuntu-latest

    steps:
      - name: Check out
        uses: actions/checkout@v3

      - name: Install OPA
        uses: open-policy-agent/setup-opa@v2
        with:
          version: 0.64.0

      - name: Check syntax
        run: |
          # KLUDGE: plan/check-sanitized-value.rego needs to be ignored because it uses the custom sanitized() function
          policies=$(find . -type f -regex '.*\.rego$' | grep -v _test.rego | grep -v plan/check-sanitized-value.rego)
          for policy in $policies; do
              opa check --strict $policy
          done

  unit-tests:
    name: Unit Tests
    runs-on: ubuntu-latest

    steps:
      - name: Check out
        uses: actions/checkout@v3

      - name: Install OPA
        uses: open-policy-agent/setup-opa@v2
        with:
          version: 0.64.0

      - name: Run unit tests
        run: |
          tests=$(find . -type f -regex '.*_test\.rego$')
          for test in $tests; do
              opa test -v $test ${test/_test.rego/.rego}
          done