You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
-**`violations`** — a set of messages describing why the policy failed. The rule iterates over trails, then over pull requests within the `pull-request` attestation, looking for PRs where `approvers` is empty.
58
-
-**`allow`** — trails are allowed only when there are no violations.
55
+
***`package policy`** — every evaluate policy must use the `policy` package.
56
+
***`import rego.v1`** — use Rego v1 syntax (the `if`/`contains` keywords).
***`violations`** — a set of messages describing why the policy failed. The rule iterates over trails, then over pull requests within the `pull-request` attestation, looking for PRs where `approvers` is empty.
59
+
***`allow`** — trails are allowed only when there are no violations.
59
60
60
61
{{<hintinfo>}}
61
62
**Policy contract** — these are Kosli-specific conventions, not OPA built-ins:
62
63
63
-
-**`package policy`** — required. Kosli queries `data.policy.*` to find your rules.
64
-
-**`allow`** — required. Must evaluate to a **boolean**. Kosli exits with code 0 when `true`, code 1 when `false`.
65
-
-**`violations`** — optional but recommended. Must be a **set of strings**, where each string is a human-readable reason the policy failed. Kosli displays these when `allow` is `false`.
64
+
***`package policy`** — required. Kosli queries `data.policy.*` to find your rules.
65
+
***`allow`** — required. Must evaluate to a **boolean**. Kosli exits with code 0 when `true`, code 1 when `false`.
66
+
***`violations`** — optional but recommended. Must be a **set of strings**, where each string is a human-readable reason the policy failed. Kosli displays these when `allow` is `false`.
66
67
{{</hint>}}
67
68
68
69
## Step 3: Evaluate multiple trails
@@ -135,7 +136,7 @@ allow if {
135
136
This policy iterates over every artifact in the trail, looks up its `snyk-container-scan` attestation, and checks whether any result has a non-zero `high_count`.
136
137
137
138
Use `--attestations` to enrich only the snyk data (faster than fetching all attestation details).
138
-
The value uses the format `artifact-name.attestation-type` — here, `dashboard` is the artifact name and `snyk-container-scan` is the attestation type:
139
+
The value uses the format `artifact-name.attestation-type` — here, `dashboard` is the artifact name and `snyk-container-scan` is the attestation name:
139
140
140
141
```shell {.command}
141
142
kosli evaluate trail \
@@ -259,12 +260,12 @@ kosli attest generic \
259
260
260
261
This creates a generic attestation on the trail with:
261
262
262
-
-**`--compliant`** set based on whether the policy allowed or denied — read directly
263
+
***`--compliant`** set based on whether the policy allowed or denied — read directly
263
264
from the JSON report rather than relying on the exit code, which avoids issues with
264
265
`set -e` in CI environments like GitHub Actions
265
-
-**`--attachments`** containing the Rego policy (for reproducibility) and the full
266
+
***`--attachments`** containing the Rego policy (for reproducibility) and the full
266
267
JSON evaluation report (including the input data the policy evaluated)
267
-
-**`--user-data`** containing the violations, which appear in the Kosli UI as
268
+
***`--user-data`** containing the violations, which appear in the Kosli UI as
0 commit comments