chore: resolve merge conficts

Author: Piskoo

app/cli/cmd/policy_develop_lint.go

@@ -65,7 +65,7 @@ func newPolicyDevelopLintCmd() *cobra.Command {
 	}
 
 	cmd.Flags().StringVarP(&policyPath, "policy", "p", "policy.yaml", "Path to policy file")
-	cmd.Flags().BoolVar(&format, "format", false, "Auto-format file with opa fmt")
+	cmd.Flags().BoolVar(&format, "format", false, "Auto-format standalone policy rego files with opa fmt (embedded policies not supported)")
 	cmd.Flags().StringVar(&regalConfig, "regal-config", "", "Path to custom regal config (Default: https://github.com/chainloop-dev/chainloop/tree/main/app/cli/internal/policydevel/.regal.yaml)")
 	return cmd
 }

app/cli/documentation/cli-reference.mdx

@@ -2973,7 +2973,7 @@ chainloop policy develop lint [flags]
 Options
 
 ```
---format                Auto-format file with opa fmt
+--format                Auto-format standalone policy rego files with opa fmt (embedded policies not supported)
 -h, --help                  help for lint
 -p, --policy string         Path to policy file (default "policy.yaml")
 --regal-config string   Path to custom regal config (Default: https://github.com/chainloop-dev/chainloop/tree/main/app/cli/internal/policydevel/.regal.yaml)

app/cli/internal/policydevel/eval.go

@@ -29,6 +29,10 @@ import (
 	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter/materials"
 )
 
+const (
+	enablePrint = true
+)
+
 type EvalOptions struct {
 	PolicyPath       string
 	MaterialKind     string
@@ -100,6 +104,7 @@ func verifyMaterial(schema *v1.CraftingSchema, material *v12.Attestation_Materia
 	}
 
 	opts = append(opts, policies.WithIncludeRawData(debug))
+	opts = append(opts, policies.WithEnablePrint(enablePrint))
 
 	v := policies.NewPolicyVerifier(schema, nil, logger, opts...)
 	policyEvs, err := v.VerifyMaterial(context.Background(), material, materialPath)

app/cli/internal/policydevel/lint.go

@@ -16,7 +16,6 @@
 package policydevel
 
 import (
-	"bytes"
 	"context"
 	"embed"
 	"errors"
@@ -123,8 +122,7 @@ func Lookup(absPath, config string, format bool) (*PolicyToLint, error) {
 	return policy, nil
 }
 
-// Loads referenced rego files from all YAML files in the policy
-// Loads referenced rego files from all YAML files in the policy
+// Loads referenced rego files from YAML files in the policy
 func (p *PolicyToLint) loadReferencedRegoFiles(baseDir string) error {
 	seen := make(map[string]struct{})
 	for _, yamlFile := range p.YAMLFiles {
@@ -184,77 +182,12 @@ func (p *PolicyToLint) processFile(filePath string) error {
 }
 
 func (p *PolicyToLint) Validate() {
-	// Validate all YAML files (including their embedded policies)
-	for _, yamlFile := range p.YAMLFiles {
-		p.validateYAMLFile(yamlFile)
-	}
-
 	// Validate standalone rego files
 	for _, regoFile := range p.RegoFiles {
 		p.validateRegoFile(regoFile)
 	}
 }
 
-func (p *PolicyToLint) validateYAMLFile(file *File) {
-	var policy v1.Policy
-	if err := unmarshal.FromRaw(file.Content, unmarshal.RawFormatYAML, &policy, true); err != nil {
-		p.AddError(file.Path, "failed to parse/validate policy", 0)
-		return
-	}
-
-	p.processEmbeddedPolicies(&policy, file)
-
-	// Update policy file with formatted content
-	if p.Format {
-		var root yaml.Node
-		if err := yaml.Unmarshal(file.Content, &root); err != nil {
-			p.AddError(file.Path, "failed to parse YAML", 0)
-			return
-		}
-
-		if err := p.updateEmbeddedRegoInYAML(file, &root); err != nil {
-			p.AddError(file.Path, fmt.Sprintf("failed to update embedded Rego: %v", err), 0)
-			return
-		}
-
-		var buf bytes.Buffer
-		enc := yaml.NewEncoder(&buf)
-		enc.SetIndent(2)
-		defer enc.Close()
-
-		if err := enc.Encode(&root); err != nil {
-			p.AddError(file.Path, err.Error(), 0)
-			return
-		}
-
-		outYAML := buf.Bytes()
-		if err := os.WriteFile(file.Path, outYAML, 0600); err != nil {
-			p.AddError(file.Path, err.Error(), 0)
-		} else {
-			if err := os.WriteFile(file.Path, outYAML, 0600); err != nil {
-				p.AddError(file.Path, fmt.Sprintf("failed to save updated file: %v", err), 0)
-			} else {
-				file.Content = outYAML
-			}
-		}
-	}
-}
-
-func (p *PolicyToLint) processEmbeddedPolicies(pa *v1.Policy, file *File) {
-	for idx, spec := range pa.Spec.Policies {
-		if regoSrc := spec.GetEmbedded(); regoSrc != "" {
-			formatted := p.validateAndFormatRego(
-				regoSrc,
-				fmt.Sprintf("%s:(embedded #%d)", file.Path, idx+1),
-			)
-
-			if p.Format && formatted != regoSrc {
-				spec.Source = &v1.PolicySpecV2_Embedded{Embedded: formatted}
-			}
-		}
-	}
-}
-
 func (p *PolicyToLint) validateRegoFile(file *File) {
 	original := string(file.Content)
 	formatted := p.validateAndFormatRego(original, file.Path)
@@ -435,64 +368,6 @@ func (p *PolicyToLint) loadDefaultConfig() (*config.Config, error) {
 	return &cfg, nil
 }
 
-// Updates the embedded rego policies in a YAML file
-// Manual update required due to yaml.marshal limitations
-func (p *PolicyToLint) updateEmbeddedRegoInYAML(file *File, rootNode *yaml.Node) error {
-	if rootNode.Kind != yaml.DocumentNode || len(rootNode.Content) == 0 {
-		return fmt.Errorf("unexpected YAML root structure")
-	}
-
-	doc := rootNode.Content[0]
-	if doc.Kind != yaml.MappingNode {
-		return fmt.Errorf("expected mapping node at document root")
-	}
-
-	// Locate spec policy node
-	var specNode *yaml.Node
-	for i := 0; i < len(doc.Content)-1; i += 2 {
-		if doc.Content[i].Value == "spec" && doc.Content[i+1].Kind == yaml.MappingNode {
-			specNode = doc.Content[i+1]
-			break
-		}
-	}
-	if specNode == nil {
-		return fmt.Errorf("spec node not found")
-	}
-
-	// Locate policies node within spec
-	var policiesNode *yaml.Node
-	for i := 0; i < len(specNode.Content)-1; i += 2 {
-		if specNode.Content[i].Value == "policies" && specNode.Content[i+1].Kind == yaml.SequenceNode {
-			policiesNode = specNode.Content[i+1]
-			break
-		}
-	}
-	if policiesNode == nil {
-		return fmt.Errorf("spec.policies node not found")
-	}
-
-	// Iterate over and update each rego policy
-	for _, policy := range policiesNode.Content {
-		if policy.Kind != yaml.MappingNode {
-			continue
-		}
-
-		for i := 0; i < len(policy.Content)-1; i += 2 {
-			key := policy.Content[i]
-			val := policy.Content[i+1]
-
-			if key.Value == "embedded" && val.Kind == yaml.ScalarNode {
-				formatted := p.validateAndFormatRego(val.Value, file.Path)
-				if formatted != val.Value {
-					val.Value = formatted
-				}
-			}
-		}
-	}
-
-	return nil
-}
-
 // Creates a mapping from line numbers to Rego rule names
 func (p *PolicyToLint) buildRegoRuleMap(regoSrc string) map[int]string {
 	ruleMap := make(map[int]string)

pkg/policies/engine/rego/rego.go

@@ -24,6 +24,7 @@ import (
 	"github.com/chainloop-dev/chainloop/pkg/policies/engine"
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/rego"
+	"github.com/open-policy-agent/opa/v1/topdown/print"
 	"golang.org/x/exp/maps"
 )
 
@@ -37,6 +38,8 @@ type Engine struct {
 	allowedNetworkDomains []string
 	// includeRawData determines whether to collect raw evaluation data
 	includeRawData bool
+	// enablePrint determines whether to enable print statements in rego policies
+	enablePrint bool
 }
 
 type EngineOption func(*newEngineOptions)
@@ -59,10 +62,17 @@ func WithIncludeRawData(include bool) EngineOption {
 	}
 }
 
+func WithEnablePrint(enable bool) EngineOption {
+	return func(e *newEngineOptions) {
+		e.enablePrint = enable
+	}
+}
+
 type newEngineOptions struct {
 	operatingMode         EnvironmentMode
 	allowedNetworkDomains []string
 	includeRawData        bool
+	enablePrint           bool
 }
 
 // NewEngine creates a new policy engine with the given options
@@ -88,6 +98,7 @@ func NewEngine(opts ...EngineOption) *Engine {
 		// append base allowed network domains to the user provided ones
 		allowedNetworkDomains: append(baseAllowedNetworkDomains, options.allowedNetworkDomains...),
 		includeRawData:        options.includeRawData,
+		enablePrint:           options.enablePrint,
 	}
 }
 
@@ -112,6 +123,15 @@ var builtinFuncNotAllowed = []*ast.Builtin{
 	ast.Trace,
 }
 
+// Implements the OPA print.Hook interface to capture and output
+// print statements from Rego policies during evaluation.
+type regoOutputHook struct{}
+
+func (p *regoOutputHook) Print(_ print.Context, msg string) error { //nolint:forbidigo
+	fmt.Println(msg)
+	return nil
+}
+
 // Force interface
 var _ engine.PolicyEngine = (*Engine)(nil)
 
@@ -156,11 +176,21 @@ func (r *Engine) Verify(ctx context.Context, policy *engine.Policy, input []byte
 	var res rego.ResultSet
 	// Function to execute the query with appropriate parameters
 	executeQuery := func(rule string, strict bool) error {
+		options := []func(r *rego.Rego){regoInput, regoFunc, rego.Capabilities(r.Capabilities())}
+
+		// Add print support if enabled
+		if r.enablePrint {
+			options = append(options,
+				rego.EnablePrintStatements(true),
+				rego.PrintHook(&regoOutputHook{}),
+			)
+		}
+
 		if strict {
-			res, err = queryRego(ctx, rule, regoInput, regoFunc, rego.Capabilities(r.Capabilities()), rego.StrictBuiltinErrors(true))
-		} else {
-			res, err = queryRego(ctx, rule, regoInput, regoFunc, rego.Capabilities(r.Capabilities()))
+			options = append(options, rego.StrictBuiltinErrors(true))
 		}
+
+		res, err = queryRego(ctx, rule, options...)
 		return err
 	}
 

pkg/policies/policies.go

@@ -66,13 +66,15 @@ type PolicyVerifier struct {
 	client           v13.AttestationServiceClient
 	allowedHostnames []string
 	includeRawData   bool
+	enablePrint      bool
 }
 
 var _ Verifier = (*PolicyVerifier)(nil)
 
 type PolicyVerifierOptions struct {
 	AllowedHostnames []string
 	IncludeRawData   bool
+	EnablePrint      bool
 }
 
 type PolicyVerifierOption func(*PolicyVerifierOptions)
@@ -89,6 +91,12 @@ func WithIncludeRawData(include bool) PolicyVerifierOption {
 	}
 }
 
+func WithEnablePrint(enable bool) PolicyVerifierOption {
+	return func(o *PolicyVerifierOptions) {
+		o.EnablePrint = enable
+	}
+}
+
 func NewPolicyVerifier(schema *v1.CraftingSchema, client v13.AttestationServiceClient, logger *zerolog.Logger, opts ...PolicyVerifierOption) *PolicyVerifier {
 	options := &PolicyVerifierOptions{}
 	for _, opt := range opts {
@@ -101,6 +109,7 @@ func NewPolicyVerifier(schema *v1.CraftingSchema, client v13.AttestationServiceC
 		logger:           logger,
 		allowedHostnames: options.AllowedHostnames,
 		includeRawData:   options.IncludeRawData,
+		enablePrint:      options.EnablePrint,
 	}
 }
 
@@ -349,6 +358,10 @@ func (pv *PolicyVerifier) executeScript(ctx context.Context, script *engine.Poli
 		engineOpts = append(engineOpts, rego.WithIncludeRawData(true))
 	}
 
+	if pv.enablePrint {
+		engineOpts = append(engineOpts, rego.WithEnablePrint(true))
+	}
+
 	// verify the policy
 	ng := rego.NewEngine(engineOpts...)
 	res, err := ng.Verify(ctx, script, material, getInputArguments(args))