policy-ci.yml

name: Policy CI

on:
  push:
    branches:
    - main
  pull_request:
    branches:
    - main

permissions:
  contents: read

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
    - name: Setup OPA
      uses: open-policy-agent/setup-opa@34a30e8a924d1b03ce2cf7abe97250bbb1f332b5 # v2.2.0
      with:
        version: latest
    - name: Checkout Repository
      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
    - name: Check
      run: >
        opa check ./examples/policies
        --schema ./examples/schemas
        --strict
        --format pretty
    - name: Test
      run: opa test -v ./examples/policies

  package:
    name: Package
    runs-on: ubuntu-latest
    needs:
    - test
    steps:
    - name: Setup OPA
      uses: open-policy-agent/setup-opa@34a30e8a924d1b03ce2cf7abe97250bbb1f332b5 # v2.2.0
      with:
        version: latest
    - name: Checkout Repository
      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
    - name: Build Bundle
      run: opa build -o ./bundle.tar.gz -r ${{ github.sha }} ./examples/policies
    - uses: actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9 # v4
      with:
        name: policy-bundle
        path: ./bundle.tar.gz