feat(opa-proto): support proto-format plan bundles (opa build --format=proto)#110
Draft
sspaink wants to merge 4 commits into
Draft
feat(opa-proto): support proto-format plan bundles (opa build --format=proto)#110sspaink wants to merge 4 commits into
sspaink wants to merge 4 commits into
Conversation
…t=proto) Add a new opa-proto module that decodes protobuf-format plan bundles (plan.pb / .manifest.pb) into the existing IR model, so bundles built with `opa build --format=proto` evaluate identically to their JSON counterparts. Proto bundles keep data.json as JSON, so opa-proto is an optional add-on alongside a JSON provider rather than a replacement. opa-proto module: - Vendored plan.proto / manifest.proto (Java bindings generated via protobuf-gradle-plugin + protobuf-java 4.x). - PlanMapper (all 34 IR statement types), ManifestMapper, and StructConverter. - ProtoBundleReader implementing the new optional ProtoBundleDecoder SPI. opa-evaluator: - ProtoBundleDecoder SPI (optional, zero-or-one). - BundleFormat: filename constants + mixed-format rejection matching OPA. - InputStreamSource + BundleAssembler.loadPlanAndManifest: shared detect/validate/route logic so loaders only do file discovery. - Services.loadAtMostOne: one shared ServiceLoader helper (dedups three copies). - PROTO_DECODER resolved lazily so proto misconfiguration cannot break JSON-only bundle loading. Loaders/CLI: - FileSystemBundleLoader and TarballBundleLoader detect .pb and route through the shared path. - CLI depends on opa-proto at runtime so it can read proto bundles. Version pinning: - Pin the OPA version in tools/generate-compliance-tests/go.mod (single source of truth) and re-vendor .proto via the native vendorProtoSchemas Gradle task; CI verify-proto-vendor guards against drift. Tests: proto-vs-JSON evaluation parity, mixed-format rejection, manifest omitempty fidelity, numeric-type parity, and malformed-plan handling. Closes open-policy-agent#101 Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
…-bundles Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com> # Conflicts: # opa-evaluator/src/main/java/io/github/open_policy_agent/opa/bundle/BundleAssembler.java # opa-evaluator/src/main/java/io/github/open_policy_agent/opa/mapper/AnnotationIntrospectors.java
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…ndor Address zizmor findings on the verify-proto-vendor job: pin all four actions to commit SHAs (blanket-pinning policy) and set persist-credentials: false on checkout, matching the rest of the workflow. Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
…-bundles # Conflicts: # .github/workflows/pull-request.yml # opa-services/src/main/java/io/github/open_policy_agent/opa/bundle/TarballBundleLoader.java # tools/generate-compliance-tests/go.mod # tools/generate-compliance-tests/go.sum
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds support for reading protobuf-format plan bundles produced by
opa build --format=proto(plan.pb/.manifest.pb), decoding them into the existing IR model so they evaluate identically to their JSON counterparts.Proto bundles keep
data.jsonas JSON, so proto support is an optional add-on alongside a JSON provider (e.g. opa-jackson), not a replacement.Closes #101
opa build --format=protoisn't in a tagged OPA release yet, sogo.modis pinned to a temporary commit (f6092b9ce, ~v1.19.0-dev; PRs open-policy-agent/opa#8825 and #8775).