Customize status bundle_loading_duration_ns and add tests

Signed-off-by: Jessie Wu <jwu730@bloomberg.net>

.github/workflows/codeql-analysis.yml

@@ -48,7 +48,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
+      uses: github/codeql-action/init@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f # v3.27.4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -64,4 +64,4 @@ jobs:
         make build
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
+      uses: github/codeql-action/analyze@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f # v3.27.4

.github/workflows/scorecards.yml

@@ -64,6 +64,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0
+        uses: github/codeql-action/upload-sarif@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f # v3.27.4
         with:
           sarif_file: results.sarif

.golangci.yaml

@@ -1,6 +1,9 @@
 run:
   timeout: 5m
 
+issues:
+  max-same-issues: 0 # don't hide issues in CI runs because they are the same type
+
 linter-settings:
   lll:
     line-length: 200

CHANGELOG.md

@@ -5,6 +5,11 @@ project adheres to [Semantic Versioning](http://semver.org/).
 
 ## Unreleased
 
+### Minimal Go version to build OPA: 1.22
+
+OPA now requires at least Go 1.22 to build.
+
+
 ## 0.70.0
 
 This release contains a mix of features, performance improvements, and bugfixes.

MAINTAINERS.md

@@ -9,6 +9,7 @@ The following table lists OPA project maintainers and areas of expertise in alph
 | Nilekh Chaudhari | @nilekhc | nilekhc@gmail.com | Microsoft | gatekeeper-library | 2024-03-31       |
 | Rita Zhang | @ritazh | rita.z.zhang@gmail.com | Microsoft | frameworks/constraints, gatekeeper, gatekeeper-library, cert-controller | 2024-03-31       |
 | Sertaç Özercan | @sozercan | sozercan@gmail.com | Microsoft | gatekeeper, gatekeeper-library, cert-controller, gatekeeper-external-data-provider | 2024-03-31       |
+| Jaydip Gabani | @JaydipGabani | gabanijaydip@gmail.com | Microsoft | frameworks/constraints, gatekeeper, gatekeeper-library, cert-controller | 2024-11-06       |
 | Stephan Renatus | @srenatus | stephan@styra.com | Styra | opa | 2024-03-31       |
 | Tim Hinrichs | @timothyhinrichs | timothy.l.hinrichs@gmail.com | Styra | all repositories | 2024-03-31       |
 | Torin Sandall | @tsandall | torinsandall@gmail.com | Styra | all repositories | 2024-03-31       |

Makefile

@@ -28,7 +28,7 @@ ifeq ($(WASM_ENABLED),1)
 GO_TAGS = -tags=opa_wasm
 endif
 
-GOLANGCI_LINT_VERSION := v1.59.1
+GOLANGCI_LINT_VERSION := v1.60.1
 YAML_LINT_VERSION := 0.29.0
 YAML_LINT_FORMAT ?= auto
 

ast/builtins.go

@@ -1403,12 +1403,16 @@ var NumbersRangeStep = &Builtin{
 
 var UnitsParse = &Builtin{
 	Name: "units.parse",
-	Description: `Converts strings like "10G", "5K", "4M", "1500m" and the like into a number.
-This number can be a non-integer, such as 1.5, 0.22, etc. Supports standard metric decimal and
-binary SI units (e.g., K, Ki, M, Mi, G, Gi etc.) m, K, M, G, T, P, and E are treated as decimal
-units and Ki, Mi, Gi, Ti, Pi, and Ei are treated as binary units.
+	Description: `Converts strings like "10G", "5K", "4M", "1500m", and the like into a number.
+This number can be a non-integer, such as 1.5, 0.22, etc. Scientific notation is supported, 
+allowing values such as "1e-3K" (1) or "2.5e6M" (2.5 million M).
 
-Note that 'm' and 'M' are case-sensitive, to allow distinguishing between "milli" and "mega" units respectively. Other units are case-insensitive.`,
+Supports standard metric decimal and binary SI units (e.g., K, Ki, M, Mi, G, Gi, etc.) where
+m, K, M, G, T, P, and E are treated as decimal units and Ki, Mi, Gi, Ti, Pi, and Ei are treated as
+binary units.
+
+Note that 'm' and 'M' are case-sensitive to allow distinguishing between "milli" and "mega" units
+respectively. Other units are case-insensitive.`,
 	Decl: types.NewFunction(
 		types.Args(
 			types.Named("x", types.S).Description("the unit to parse"),
@@ -1419,10 +1423,14 @@ Note that 'm' and 'M' are case-sensitive, to allow distinguishing between "milli
 
 var UnitsParseBytes = &Builtin{
 	Name: "units.parse_bytes",
-	Description: `Converts strings like "10GB", "5K", "4mb" into an integer number of bytes.
-Supports standard byte units (e.g., KB, KiB, etc.) KB, MB, GB, and TB are treated as decimal
-units and KiB, MiB, GiB, and TiB are treated as binary units. The bytes symbol (b/B) in the
-unit is optional and omitting it wil give the same result (e.g. Mi and MiB).`,
+	Description: `Converts strings like "10GB", "5K", "4mb", or "1e6KB" into an integer number of bytes.
+
+Supports standard byte units (e.g., KB, KiB, etc.) where KB, MB, GB, and TB are treated as decimal 
+units, and KiB, MiB, GiB, and TiB are treated as binary units. Scientific notation is supported, 
+enabling values like "1.5e3MB" (1500MB) or "2e6GiB" (2 million GiB).
+
+The bytes symbol (b/B) in the unit is optional; omitting it will yield the same result (e.g., "Mi" 
+and "MiB" are equivalent).`,
 	Decl: types.NewFunction(
 		types.Args(
 			types.Named("x", types.S).Description("the byte unit to parse"),

ast/check.go

@@ -293,7 +293,7 @@ func (tc *typeChecker) checkRule(env *TypeEnv, as *AnnotationSet, rule *Rule) {
 				var err error
 				tpe, err = nestedObject(cpy, objPath, typeV)
 				if err != nil {
-					tc.err([]*Error{NewError(TypeErr, rule.Head.Location, err.Error())})
+					tc.err([]*Error{NewError(TypeErr, rule.Head.Location, err.Error())}) //nolint:govet
 					tpe = nil
 				}
 			} else {
@@ -1310,7 +1310,7 @@ func processAnnotation(ss *SchemaSet, annot *SchemaAnnotation, rule *Rule, allow
 
 	tpe, err := loadSchema(schema, allowNet)
 	if err != nil {
-		return nil, NewError(TypeErr, rule.Location, err.Error())
+		return nil, NewError(TypeErr, rule.Location, err.Error()) //nolint:govet
 	}
 
 	return tpe, nil

ast/compile.go

@@ -840,7 +840,7 @@ func (c *Compiler) PassesTypeCheckRules(rules []*Rule) Errors {
 
 			tpe, err := loadSchema(schema, allowNet)
 			if err != nil {
-				return Errors{NewError(TypeErr, nil, err.Error())}
+				return Errors{NewError(TypeErr, nil, err.Error())} //nolint:govet
 			}
 			c.inputType = tpe
 		}
@@ -1056,12 +1056,12 @@ func (c *Compiler) checkRuleConflicts() {
 		}
 
 		kinds := make(map[RuleKind]struct{}, len(node.Values))
-		defaultRules := 0
 		completeRules := 0
 		partialRules := 0
 		arities := make(map[int]struct{}, len(node.Values))
 		name := ""
 		var conflicts []Ref
+		defaultRules := make([]*Rule, 0)
 
 		for _, rule := range node.Values {
 			r := rule.(*Rule)
@@ -1070,7 +1070,7 @@ func (c *Compiler) checkRuleConflicts() {
 			kinds[r.Head.RuleKind()] = struct{}{}
 			arities[len(r.Head.Args)] = struct{}{}
 			if r.Default {
-				defaultRules++
+				defaultRules = append(defaultRules, r)
 			}
 
 			// Single-value rules may not have any other rules in their extent.
@@ -1126,8 +1126,21 @@ func (c *Compiler) checkRuleConflicts() {
 		case len(kinds) > 1 || len(arities) > 1 || (completeRules >= 1 && partialRules >= 1):
 			c.err(NewError(TypeErr, node.Values[0].(*Rule).Loc(), "conflicting rules %v found", name))
 
-		case defaultRules > 1:
-			c.err(NewError(TypeErr, node.Values[0].(*Rule).Loc(), "multiple default rules %s found", name))
+		case len(defaultRules) > 1:
+
+			defaultRuleLocations := strings.Builder{}
+			defaultRuleLocations.WriteString(defaultRules[0].Loc().String())
+			for i := 1; i < len(defaultRules); i++ {
+				defaultRuleLocations.WriteString(", ")
+				defaultRuleLocations.WriteString(defaultRules[i].Loc().String())
+			}
+
+			c.err(NewError(
+				TypeErr,
+				defaultRules[0].Module.Package.Loc(),
+				"multiple default rules %s found at %s",
+				name, defaultRuleLocations.String()),
+			)
 		}
 
 		return false
@@ -1158,7 +1171,7 @@ func (c *Compiler) checkRuleConflicts() {
 							continue // don't self-conflict
 						}
 						msg := fmt.Sprintf("%v conflicts with rule %v defined at %v", childMod.Package, rule.Head.Ref(), rule.Loc())
-						c.err(NewError(TypeErr, mod.Package.Loc(), msg))
+						c.err(NewError(TypeErr, mod.Package.Loc(), msg)) //nolint:govet
 					}
 				}
 			}
@@ -1639,7 +1652,7 @@ func (c *Compiler) init() {
 		if schema := c.schemaSet.Get(SchemaRootRef); schema != nil {
 			tpe, err := loadSchema(schema, c.capabilities.AllowNet)
 			if err != nil {
-				c.err(NewError(TypeErr, nil, err.Error()))
+				c.err(NewError(TypeErr, nil, err.Error())) //nolint:govet
 			} else {
 				c.inputType = tpe
 			}
@@ -1761,7 +1774,7 @@ func (c *Compiler) resolveAllRefs() {
 		WalkRules(mod, func(rule *Rule) bool {
 			err := resolveRefsInRule(globals, rule)
 			if err != nil {
-				c.err(NewError(CompileErr, rule.Location, err.Error()))
+				c.err(NewError(CompileErr, rule.Location, err.Error())) //nolint:govet
 			}
 			return false
 		})
@@ -1786,7 +1799,7 @@ func (c *Compiler) resolveAllRefs() {
 
 		parsed, err := c.moduleLoader(c.Modules)
 		if err != nil {
-			c.err(NewError(CompileErr, nil, err.Error()))
+			c.err(NewError(CompileErr, nil, err.Error())) //nolint:govet
 			return
 		}
 
@@ -2677,7 +2690,7 @@ func (vis *ruleArgLocalRewriter) Visit(x interface{}) Visitor {
 			Walk(vis, vcpy)
 			return k, vcpy, nil
 		}); err != nil {
-			vis.errs = append(vis.errs, NewError(CompileErr, t.Location, err.Error()))
+			vis.errs = append(vis.errs, NewError(CompileErr, t.Location, err.Error())) //nolint:govet
 		} else {
 			t.Value = cpy
 		}
@@ -5258,7 +5271,7 @@ func rewriteEveryStatement(g *localVarGenerator, stack *localDeclaredVars, expr
 		if v := every.Key.Value.(Var); !v.IsWildcard() {
 			gv, err := rewriteDeclaredVar(g, stack, v, declaredVar)
 			if err != nil {
-				return nil, append(errs, NewError(CompileErr, every.Loc(), err.Error()))
+				return nil, append(errs, NewError(CompileErr, every.Loc(), err.Error())) //nolint:govet
 			}
 			every.Key.Value = gv
 		}
@@ -5270,7 +5283,7 @@ func rewriteEveryStatement(g *localVarGenerator, stack *localDeclaredVars, expr
 	if v := every.Value.Value.(Var); !v.IsWildcard() {
 		gv, err := rewriteDeclaredVar(g, stack, v, declaredVar)
 		if err != nil {
-			return nil, append(errs, NewError(CompileErr, every.Loc(), err.Error()))
+			return nil, append(errs, NewError(CompileErr, every.Loc(), err.Error())) //nolint:govet
 		}
 		every.Value.Value = gv
 	}
@@ -5288,7 +5301,7 @@ func rewriteSomeDeclStatement(g *localVarGenerator, stack *localDeclaredVars, ex
 		switch v := decl.Symbols[i].Value.(type) {
 		case Var:
 			if _, err := rewriteDeclaredVar(g, stack, v, declaredVar); err != nil {
-				return nil, append(errs, NewError(CompileErr, decl.Loc(), err.Error()))
+				return nil, append(errs, NewError(CompileErr, decl.Loc(), err.Error())) //nolint:govet
 			}
 		case Call:
 			var key, val, container *Term
@@ -5316,7 +5329,7 @@ func rewriteSomeDeclStatement(g *localVarGenerator, stack *localDeclaredVars, ex
 
 			for _, v0 := range outputVarsForExprEq(e, container.Vars()).Sorted() {
 				if _, err := rewriteDeclaredVar(g, stack, v0, declaredVar); err != nil {
-					return nil, append(errs, NewError(CompileErr, decl.Loc(), err.Error()))
+					return nil, append(errs, NewError(CompileErr, decl.Loc(), err.Error())) //nolint:govet
 				}
 			}
 			return rewriteDeclaredVarsInExpr(g, stack, e, errs, strict)
@@ -5370,7 +5383,7 @@ func rewriteDeclaredAssignment(g *localVarGenerator, stack *localDeclaredVars, e
 		switch v := t.Value.(type) {
 		case Var:
 			if gv, err := rewriteDeclaredVar(g, stack, v, assignedVar); err != nil {
-				errs = append(errs, NewError(CompileErr, t.Location, err.Error()))
+				errs = append(errs, NewError(CompileErr, t.Location, err.Error())) //nolint:govet
 			} else {
 				t.Value = gv
 			}
@@ -5385,7 +5398,7 @@ func rewriteDeclaredAssignment(g *localVarGenerator, stack *localDeclaredVars, e
 		case Ref:
 			if RootDocumentRefs.Contains(t) {
 				if gv, err := rewriteDeclaredVar(g, stack, v[0].Value.(Var), assignedVar); err != nil {
-					errs = append(errs, NewError(CompileErr, t.Location, err.Error()))
+					errs = append(errs, NewError(CompileErr, t.Location, err.Error())) //nolint:govet
 				} else {
 					t.Value = gv
 				}

ast/compile_test.go

@@ -1977,8 +1977,8 @@ p[r] := 2 if { r := "foo" }`,
 		"rego_type_error: conflicting rules data.badrules.complete_partial.p[r] found",
 		"rego_type_error: conflicting rules data.badrules.p[x] found",
 		"rego_type_error: conflicting rules data.badrules.q found",
-		"rego_type_error: multiple default rules data.badrules.defkw.foo found",
-		"rego_type_error: multiple default rules data.badrules.defkw.p.q.bar found",
+		"rego_type_error: multiple default rules data.badrules.defkw.foo found at mod3.rego:3, mod3.rego:4",
+		"rego_type_error: multiple default rules data.badrules.defkw.p.q.bar found at mod3.rego:7, mod3.rego:8",
 		"rego_type_error: package badrules.s conflicts with rule s defined at mod1.rego:10",
 		"rego_type_error: package badrules.s conflicts with rule s defined at mod1.rego:9",
 		"rego_type_error: package badrules.t conflicts with rule t defined at mod1.rego:11",
@@ -2048,7 +2048,7 @@ func TestCompilerCheckRuleConflictsDotsInRuleHeads(t *testing.T) {
 				`package pkg.p.q
 				default r = 4
 				r = 2`),
-			err: "rego_type_error: multiple default rules data.pkg.p.q.r found",
+			err: "rego_type_error: multiple default rules data.pkg.p.q.r found at mod0.rego:2, mod1.rego:2",
 		},
 		{
 			note: "arity mismatch, ref and ref rule",
@@ -2068,7 +2068,7 @@ func TestCompilerCheckRuleConflictsDotsInRuleHeads(t *testing.T) {
 				`package pkg.p
 				default q.w.r = 4
 				q.w.r = 2`),
-			err: "rego_type_error: multiple default rules data.pkg.p.q.w.r found",
+			err: "rego_type_error: multiple default rules data.pkg.p.q.w.r found at mod0.rego:2, mod1.rego:2",
 		},
 		{
 			note: "multi-value + single-value rules, both with same ref prefix",