Skip to main content

Conftest (OPA)

Latest release conftest 0.1.2

Run Conftest against each unit's plan, so your Rego policies decide whether a change may merge.

Usage​

repository {
  after_hook "conftest" {
    commands = ["plan"]
    execute  = ["pipelines", "hook", "conftest@v0.1"]

    env {
      PIPELINES_HOOK_CONFTEST_POLICIES_SOURCE = "<REQUIRED>"
    }
  }
}

Policies​

PIPELINES_HOOK_CONFTEST_POLICIES_SOURCE takes one of two forms:

  • A path in the repository Pipelines is running against, such as ./policies.
  • A remote source, such as git::https://github.com/acme/policies.git//rego, to share one set of policies across repositories. Any source conftest pull accepts works.

The run fails if the source holds no .rego files.

Writing a policy​

input is the unit's plan as JSON, for example:

package main

warn contains msg if {
	some change in input.resource_changes
	change.type == "aws_db_instance"
	"create" in change.change.actions
	change.change.after.deletion_protection == false
	msg := sprintf("%s has deletion protection disabled", [change.address])
}

A deny or violation rule blocks the merge; a warn rule is advisory. A rule name may carry a suffix, so deny_deletion_protection still counts as a deny.

Conftest loads every .rego file in the source, including those in subdirectories, and evaluates all of them against every unit's plan. Only rules in package main run.

Set any additional Conftest environment variables in the hook's env block. Each is a flag name prefixed with CONFTEST_, such as CONFTEST_NAMESPACE to evaluate a package other than main.

Outputs​

The hook posts a table on the pull or merge request, one row per message:

UnitResultMessage
dev/us-east-1/databaseWARNaws_db_instance.this has deletion protection disabled
prod/us-east-1/vpcNOT CHECKEDNo plan to check

The hook reports deny when a policy fails. It reports warn when a policy warns, or when a unit had no plan to check. Otherwise it reports pass.

Inputs​

Configure inputs in the hook's env block.

Required

VariableDescription
PIPELINES_HOOK_CONFTEST_POLICIES_SOURCEWhere your Rego policies live: a path in your repository, or a remote source conftest pull accepts, such as git::https://github.com/org/policies.git//rego. The hook stops if it finds no .rego files there.

Optional

VariableDescription
PIPELINES_HOOK_CONFTEST_CLI_VERSIONThe Conftest CLI version the hook installs. Defaults to 0.70.0.
PIPELINES_HOOK_CONFTEST_LOG_LEVELLog verbosity. A more verbose PIPELINES_LOG_LEVEL overrides it. One of trace, debug, info, warning, error, fatal, panic. Defaults to info.