Allow linting directories

.github/dependabot.yml

@@ -4,3 +4,7 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "daily"

README.md

@@ -21,10 +21,10 @@ with linting.
 
 ## Try it out!
 
-Run `regal` pointed at a Rego policy to have it linted:
+Run `regal` pointed at one or more files or directories to have them linted:
 
 ```shell
-./regal policy.rego
+./regal policy/
 ```
 
 ## Development

internal/io/io.go

@@ -0,0 +1,46 @@
+package io
+
+import (
+	"encoding/json"
+	files "io/fs"
+	"log"
+	"strings"
+
+	"github.com/open-policy-agent/opa/bundle"
+)
+
+// LoadRegalBundle loads bundle embedded from policy and data directory
+func LoadRegalBundle(fs files.FS) (bundle.Bundle, error) {
+	embedLoader, err := bundle.NewFSLoader(fs)
+	if err != nil {
+		return bundle.Bundle{}, err
+	}
+	bundleLoader := embedLoader.WithFilter(func(abspath string, info files.FileInfo, depth int) bool {
+		return strings.HasSuffix(info.Name(), "_test.rego")
+	})
+
+	return bundle.NewCustomReader(bundleLoader).
+		WithSkipBundleVerification(true).
+		WithProcessAnnotations(true).
+		WithBundleName("regal").
+		Read()
+}
+
+// MustLoadRegalBundle loads bundle embedded from policy and data directory, exit on failure
+func MustLoadRegalBundle(fs files.FS) bundle.Bundle {
+	regalBundle, err := LoadRegalBundle(fs)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	return regalBundle
+}
+
+// MustJSON marshal to JSON or exit
+func MustJSON(x any) []byte {
+	bytes, err := json.Marshal(x)
+	if err != nil {
+		log.Fatal(err)
+	}
+	return bytes
+}

internal/util/util.go

@@ -0,0 +1,12 @@
+package util
+
+// Keys returns slice of keys from map
+func Keys[K comparable, V any](m map[K]V) []K {
+	ks := make([]K, len(m))
+	i := 0
+	for k := range m {
+		ks[i] = k
+		i++
+	}
+	return ks
+}

main.go

@@ -3,19 +3,13 @@ package main
 import (
 	"context"
 	"embed"
-	"encoding/json"
-	"fmt"
-	"io/fs"
 	"log"
 	"os"
-	"strings"
 	"time"
 
-	"github.com/open-policy-agent/opa/ast"
-	"github.com/open-policy-agent/opa/bundle"
 	"github.com/open-policy-agent/opa/loader"
-	"github.com/open-policy-agent/opa/rego"
-	"github.com/open-policy-agent/opa/topdown"
+	rio "github.com/styrainc/regal/internal/io"
+	"github.com/styrainc/regal/pkg/linter"
 )
 
 // Note: this will bundle the tests as well, but since that has negligible impact on the size of the binary,
@@ -31,71 +25,20 @@ func main() {
 	// TODO: Obviously, we'll want to deal with directories and not single files, but we'll need to decide on what
 	//       format to use for merging the ASTs, or if we should just present them as they are in a collection.
 	if len(os.Args) < 2 {
-		log.Fatal("Rego file to lint must be provided as input")
+		log.Fatal("At least one file or directory must be provided for linting")
 	}
 
-	regalBundle := mustLoadRegalBundle()
-
-	regoFile, err := loader.RegoWithOpts(os.Args[1], ast.ParserOptions{ProcessAnnotation: true})
+	regalRules := rio.MustLoadRegalBundle(content)
+	policies, err := loader.AllRegos(os.Args[1:])
 	if err != nil {
 		log.Fatal(err)
 	}
-	astJSON := mustJSON(regoFile.Parsed)
-	var input map[string]any
-	if err = json.Unmarshal(astJSON, &input); err != nil {
-		log.Fatal(err)
-	}
 
 	// TODO: Make timeout configurable via command line flag
 	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(5)*time.Second)
 	defer cancel()
 
-	query, err := rego.New(
-		rego.ParsedBundle("regal", &regalBundle),
-		rego.Input(input),
-		rego.Query("report = data.regal.main.report"),
-		rego.EnablePrintStatements(true),
-		rego.PrintHook(topdown.NewPrintHook(os.Stderr)),
-	).PrepareForEval(ctx)
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	result, err := query.Eval(ctx)
-	if err != nil {
-		log.Fatal(err)
-	}
-
-	// TODO: Create a reporter interface and implementations
-	fmt.Println(string(mustJSON(result)))
-}
-
-func mustJSON(x any) []byte {
-	bytes, err := json.Marshal(x)
-	if err != nil {
-		log.Fatal(err)
-	}
-	return bytes
-}
-
-func mustLoadRegalBundle() bundle.Bundle {
-	embedLoader, err := bundle.NewFSLoader(content)
-	if err != nil {
-		log.Fatal(err)
-	}
-	bundleLoader := embedLoader.WithFilter(func(abspath string, info fs.FileInfo, depth int) bool {
-		return strings.HasSuffix(info.Name(), "_test.rego")
-	})
-
-	regalBundle, err := bundle.NewCustomReader(bundleLoader).
-		WithSkipBundleVerification(true).
-		WithProcessAnnotations(true).
-		WithBundleName("regal").
-		Read()
-
-	if err != nil {
-		log.Fatal(err)
-	}
+	regal := linter.NewLinter().WithAddedBundle(regalRules)
 
-	return regalBundle
+	regal.Lint(ctx, policies)
 }

pkg/linter/linter.go

@@ -0,0 +1,86 @@
+package linter
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"os"
+	"sort"
+
+	"github.com/open-policy-agent/opa/bundle"
+	"github.com/open-policy-agent/opa/loader"
+	"github.com/open-policy-agent/opa/rego"
+	"github.com/open-policy-agent/opa/topdown"
+
+	rio "github.com/styrainc/regal/internal/io"
+	"github.com/styrainc/regal/internal/util"
+)
+
+// Linter stores data to use for linting
+type Linter struct {
+	ruleBundles []*bundle.Bundle
+}
+
+// NewLinter creates a new Regal linter
+func NewLinter() Linter {
+	return Linter{}
+}
+
+// WithAddedBundle adds a bundle of rules and data to include in evaluation
+func (l Linter) WithAddedBundle(b bundle.Bundle) Linter {
+	l.ruleBundles = append(l.ruleBundles, &b)
+
+	return l
+}
+
+// Lint runs the linter on provided policies
+func (l Linter) Lint(ctx context.Context, result *loader.Result) {
+	var regoArgs []func(*rego.Rego)
+	regoArgs = append(regoArgs,
+		rego.Query("report = data.regal.main.report"),
+		rego.EnablePrintStatements(true),
+		rego.PrintHook(topdown.NewPrintHook(os.Stderr)))
+
+	if l.ruleBundles != nil {
+		for _, ruleBundle := range l.ruleBundles {
+			var bundleName string
+			if metadataName, ok := ruleBundle.Manifest.Metadata["name"].(string); ok {
+				bundleName = metadataName
+			}
+			regoArgs = append(regoArgs, rego.ParsedBundle(bundleName, ruleBundle))
+		}
+	}
+
+	query, err := rego.New(regoArgs...).PrepareForEval(ctx)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// Maintain order across runs
+	modules := util.Keys(result.Modules)
+	sort.Strings(modules)
+
+	for _, name := range modules {
+		module := result.Modules[name]
+		astJSON := rio.MustJSON(module.Parsed)
+		var input map[string]any
+		if err = json.Unmarshal(astJSON, &input); err != nil {
+			log.Fatal(err)
+		}
+
+		resultSet, err := query.Eval(ctx, rego.EvalInput(input))
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		// TODO: Create a reporter interface and implementations
+		for _, result := range resultSet {
+			report := result.Bindings["report"].([]interface{})
+			for _, entry := range report {
+				violation := entry.(map[string]interface{})
+				fmt.Printf("%v: %v\n", name, violation["description"])
+			}
+		}
+	}
+}

policy/.manifest

@@ -1,3 +1,6 @@
 {
-  "roots": ["regal"]
+  "roots": ["regal"],
+  "metadata": {
+    "name": "regal"
+  }
 }