opa

Write, test, validate, explain, and debug OPA Rego policies with Conftest.

AI-agent behavior, not infra policy: to gate what an AI coding agent (Copilot, Claude Code) can edit or run in a repo, use /platform-skills:ai-governance — a different policy engine for a different input shape (tool calls and diffs, not Terraform/Kubernetes manifests).

---

Interactive Wizard (fires when no arguments are provided)

When invoked with no arguments, ask before proceeding:

Q1 — Mode?

What do you need?
  1. generate — write a new production-ready Rego policy
  2. test     — write _test.rego unit tests for an existing policy
  3. validate — run the full pipeline (fmt, lint, tests) against a directory
  4. explain  — translate an existing Rego policy into plain English
  5. debug    — diagnose why a policy is not firing as expected

Enter 1–5 or mode name:

Q2 — Context (after mode selected, one at a time):

• generate: Describe the policy — target resource type (Terraform/Kubernetes/GHA/Dockerfile) and what to deny or warn on:
• test: Paste the Rego policy to write tests for:
• validate: Provide the directory path containing your .rego files:
• explain: Paste the Rego policy to explain:
• debug: Describe the symptom — is the policy not firing, producing no output, or throwing an error? Paste the conftest output:

Then proceed into the relevant mode below.

---

Mode: generate

Write a production-ready Rego policy from a description.

Steps:

1. Ask for: target resource type (Terraform HCL, Kubernetes manifest, GitHub Actions workflow, Dockerfile, JSON/YAML), the rule logic (what to deny or warn on), and whether a named namespace is needed
2. Parse what Conftest sees — use conftest parse <file> to show the input shape if the user has a file, then write rules that match that shape exactly
3. Generate the policy file:
   • Start with a # METADATA block: title, description, authors, entrypoint: true
   • Declare package <namespace> — use main only when a single policy set applies; use a named package (package terraform.iam, package k8s.pods) for multi-domain repos
   • Add import rego.v1 — required for modern Rego syntax
   • Use deny for hard failures, warn for advisory violations, violation for OPA framework integrations (Gatekeeper, Conftest policy sets)
   • Generate a descriptive msg that includes the offending resource name/value and a remediation hint
   • Use some for iteration, in for membership, startswith/contains for string matching
4. Show the Conftest command to test the policy against sample input
5. State CI placement: conftest runs after terraform validate and before terraform plan as a blocking gate — failing conftest must prevent plan from running