opa eval returns expected results, but opa exec does not. What am I doing wrong?

[Cerebus]

Version: 0.62.1
Build Commit:
Build Timestamp:
Build Hostname:
Go Version: go1.22.1
Platform: darwin/amd64
WebAssembly: unavailable

I have a simple policy:

package policy

violation[{"msg": msg}] {
	some vuln
	input.vulnerabilities[vuln].ratings[_].severity == "critical"
	name := input.vulnerabilities[vuln].id

	msg := sprintf("Violation: %s critical", [name])
}

My input is CycloneDX (in JSON) generated from a couple different sources, but they all check out against the schema. I can verify by slicing with jq:

> cat test-grype | jq '.vulnerabilities[] | select(.ratings[].severity == "critical") | .id'
"CVE-2023-45853"

When I run opa eval I get the expected results:

> opa eval -b ../bundles/team1/container -i test-grype 'data.policy.violation'
{
  "result": [
    {
      "expressions": [
        {
          "value": [
            {
              "msg": "Violation: CVE-2023-45853 critical"
            }
          ],
          "text": "data.policy.violation",
          "location": {
            "row": 1,
            "col": 1
          }
        }
      ]
    }
  ]
}

But with opa exec with the same bundle and same evaluation, I get nothing:

> opa exec test-grype --bundle ../bundles/team1/container --decision policy/violation
{
  "result": []
}

I'm clearly doing something wrong here, but IDK what it is, and it's driving me batty.

[ashutosh-narkar]

If you rename test-grype to test-grype.json this should work.

[Cerebus]

While this works I should say this seems like broken behavior. Should I make an issue?

[ashutosh-narkar]

Sure. If you would like to submit a fix that would be great!