Bump github.com/styrainc/regal from 0.16.0 to 0.17.0

[dependabot]

Bumps github.com/styrainc/regal from 0.16.0 to 0.17.0.

Release notes

Sourced from github.com/styrainc/regal's releases.

v0.17.0

This is a fairly big release, adding 4 new linter rules and a whole bunch of improvements and fixes.

New rule: with-outside-test-context

Category: performance

This is the first rule in the new performance category, with more to follow in future releases. The with keyword is known to most as a way to mock values and functions in unit tests. While it's occasionally useful in other contexts, it comes with some major performance implications when used outside of tests. This new rule warns when with is encoutered outside the context of tests.

For more information, see the docs on with-outside-test-context.

New rule: circular-import

Category: imports

A circular import is when a package imports itself, either by directly importing itself, or indirectly by importing a which in turn imports a series of packages that eventually import the original package. As long as recursive rules definitions are avoided, circular imports are permitted in Rego. However, such import graphs are not advisable and a signal of poorly structured policy code.

For more information, see the docs on circular-import.

New rule: rule-name-repeats-package

Category: style

When rules are referenced outside the package in which they are defined, they will be referenced using the package path. For example, the allow rule in the example package, is available at data.example.allow. When rule names include all or part of their package paths, this creates repetition in such references. For example, authz_allow in a package authz is referenced with: data.authz.authz_allow. This repetition is undesirable as the reference is longer than needed, and harder to read.

For more information, see the docs on rule-name-repeats-package.

New rule: double negative

Category: style

While rules using double negatives — like not no_funds — occasionally make sense, it is often worth considering whether the rule could be rewritten without the negative. For example, not no_funds could be rewritten as funds or has_funds, or funds_available.

For more information, see the docs on double-negative.

Improvements

• The Regal language server now supports client shutdown messages
• The docs on how to ignore rules and files have been greatly improved. Thanks @​bdumpp and @​orenzohar for the suggestion!

Bugs Fixed

• Fix false positive in prefer-some-in-iteration rule when old-style iteration was used inside of arrays, sets and objects
• Fix false positive in prefer-some-in-iteration rule when old-style iteration was used inside of rule head key (i.e. contains)
• Fix false positive in external-reference rule when using = for assignment (although you shouldn't!)
• The Regal language server now correctly handles URIs and paths on Windows

Ecosystem

The setup-regal GitHub Action has been promoted to v1. This fixes the warning in pipelines about depending on an old Node version. Make sure to update your workflows!

... (truncated)

Commits

• ece9977 lsp: Correctly handle URIs and paths on Windows (#569)
• f11eef4 prefer-some-iteration: fix false positive in rule head key (#565)
• 4625e7a Fix false positive in prefer-some-in-iteration (#564)
• 6ecc6af Fix false positive in external-reference (#563)
• 2bb5dd6 Docs: Make it obvious how to ignore rules and files (#562)
• 22f6a10 Rule: with-outside-test-context (#555)
• ee2cd46 rules: Add double negative rule (#557)
• 7f9ddad Rule: circular-import and rule-name-repeats-package (#558)
• ee878c0 Use filepath.WalkDir (#556)
• 5dbc6d8 Fix golangci-lint violations (#554)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)