-
Notifications
You must be signed in to change notification settings - Fork 19
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for post-resolution policies #214
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #214 +/- ##
=======================================
- Coverage 74.5% 73.5% -1.0%
=======================================
Files 44 45 +1
Lines 2938 2983 +45
=======================================
+ Hits 2189 2194 +5
- Misses 749 789 +40 ☔ View full report in Codecov by Sentry. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just minor nits and wording concerns.
pub trait ResultExt<T, E> { | ||
/// Captures the diagnostic messages into the provided `DiagnosticMessages` | ||
/// or returns the value if there are no diagnostic messages. | ||
fn capture_diag_msgs_into(self, diags: &mut DiagnosticMessages) -> Option<T>; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I like these additions. Will need to figure out if we have the right set of combinators here.
One other comment, code coverage is pretty poor here. We need to figure out negative tests where we expect failures and diagnostic messages to print. |
I improved the comments, but regarding the tests, it's not easy to add more from my iPad. The overall coverage is still greater than 70%, so I'm going to merge this PR. I will create a GitHub issue to address this in a future PR once I'm back. |
With this PR, it is now possible to define policies to validate a resolved semconv registry (the previous version of Weaver was only supporting pre-resolution policies).
As before, all the
*.rego
files are imported into the policy engine. The package names are used to identify groups of rules to apply either before or after the resolution process (package before_resolution
vspackage after_resolution
). It is valid to define multiple policy files with the same package name. In this case, the rules defined in these files will be combined and evaluated together. This option can be used to logically split the rules per topic or domain of control.Note: The definition of policies comparing two versions of the resolved semconv will be added in a future PR.