rallyhealth / conftest-policy-packs Goto Github PK

Proposed Change to CONTRIBUTING.md:

- *Lua*
+ *Open Policy Agent*

PKGSEC-0001 requires Node projects using a package.json file to wrap their package name underneath an organization scope. It relies on the is_package_json utility function in lib/packages_functions.rego.

The only required top-level fields in a package.json file are name and version, so those are checked for existence to determine whether the JSON file we're evaluating is a package.json file. This is not granular enough and the policy incorrectly flags unrelated JSON files with this policy.

The "best" way to resolve this would be for conftest to include file metadata in the data available when evaluating a policy. I originally filed this against opa with open-policy-agent/opa#3662 and never followed up to file an issue with conftest. I'll do that now.

Not sure if there are alternative solutions to make the policy more accurate.