{"id":29210665,"url":"https://github.com/embarkstudios/opa-policies","last_synced_at":"2025-07-02T21:07:28.913Z","repository":{"id":43277410,"uuid":"310227465","full_name":"EmbarkStudios/opa-policies","owner":"EmbarkStudios","description":"Contains OPA Policies for Dockerfiles, Kubernetes YAMLs, Terraform, etc","archived":false,"fork":false,"pushed_at":"2025-06-10T09:09:34.000Z","size":274,"stargazers_count":33,"open_issues_count":13,"forks_count":4,"subscribers_count":9,"default_branch":"main","last_synced_at":"2025-06-10T10:26:19.281Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Open Policy Agent","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/EmbarkStudios.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE-APACHE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2020-11-05T07:58:32.000Z","updated_at":"2025-06-10T09:07:48.000Z","dependencies_parsed_at":"2025-05-13T08:33:14.849Z","dependency_job_id":"13a668e1-d26f-43e2-bb31-3a3a8909f9a3","html_url":"https://github.com/EmbarkStudios/opa-policies","commit_stats":null,"previous_names":[],"tags_count":10,"template":false,"template_full_name":null,"purl":"pkg:github/EmbarkStudios/opa-policies","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmbarkStudios%2Fopa-policies","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmbarkStudios%2Fopa-policies/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmbarkStudios%2Fopa-policies/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmbarkStudios%2Fopa-policies/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/EmbarkStudios","download_url":"https://codeload.github.com/EmbarkStudios/opa-policies/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/EmbarkStudios%2Fopa-policies/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":263215298,"owners_count":23431895,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-07-02T21:07:28.204Z","updated_at":"2025-07-02T21:07:28.896Z","avatar_url":"https://github.com/EmbarkStudios.png","language":"Open Policy Agent","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 📜 OPA Policies\nThe Open Policy Agent (OPA, pronounced “oh-pa”) is an open source, general-purpose policy engine that unifies policy enforcement across the stack. OPA provides a high-level declarative language that let’s you specify policy as code and simple APIs to offload policy decision-making from your software. You can use OPA to enforce policies in microservices, Kubernetes, CI/CD pipelines, API gateways, and more.\n\nThe policies are written in a language called [rego](https://www.openpolicyagent.org/docs/latest/policy-language/). You can find examples of policies for different technologies [here](https://github.com/open-policy-agent/conftest/tree/master/examples).\n\n## Structure\nEach type will have its own folder (and namespace) inside of [policy](policy). If you want to add a new type, you can refer to [policy/docker](policy/docker).\n\n## How to use it\n[conftest](https://www.conftest.dev/) is a utility to help you write tests against structured configuration data. For instance, you could write tests for your Kubernetes configurations, Tekton pipeline definitions, Terraform code, Serverless configs or any other structured data.\n\nYou can find information on how to install conftest [here](https://www.conftest.dev/install/)\n\n## Writing tests\nWe can unit-test our policies. You can find more information on how to write tests [here](https://www.openpolicyagent.org/docs/latest/policy-testing/) and see the [tests for our Dockerfile policies](policy/docker).\n\nYou can run the tests by executing `conftest verify`\n\n## Excluding policies\nYou can find more information on how to except policies [here](https://www.conftest.dev/exceptions/). You can also find more information in the README under each type in this repository.\n\n\n## Example usage\nGiven the following Dockerfile:\n```\nFROM ubuntu:latest # will warn due to \"latest\"\n\nWORKDIR /app\n\n# will fail due to \"root\"\nUSER root\n\n# will fail due to usage of ADD instead of COPY\nADD app /app\n\nCOPY README.md /app/README.md\nRUN sudo apt-get update # will fail due to \"sudo\"\n\n# will fail due to curl/wget bashing\nRUN wget https://some-url.com | sh\n\nRUN apt-get update \u0026\u0026 apt-get install -y htop\n\nCMD [\"/bin/bash\", \"/app/entrypoint.sh\"]\n```\nRunning `conftest test ../Dockerfile --namespace docker` will produce the following output given the current rules in [policy/docker](policy/docker):\n```\nWARN - Dockerfile - Do not use latest tag with image: [\"ubuntu:latest\"]\nFAIL - Dockerfile - Avoid using 'sudo' command: sudo apt-get update\nFAIL - Dockerfile - Use COPY instead of ADD: app /app\nFAIL - Dockerfile - Use COPY instead of ADD: code /tmp/code\nFAIL - Dockerfile - Avoid curl/wget bashing\n```\n\n## Contributing\n\n[![Contributor Covenant](https://img.shields.io/badge/contributor%20covenant-v1.4-ff69b4.svg)](CODE_OF_CONDUCT.md)\n\nWe welcome community contributions to this project.\n\nPlease read our [Contributor Guide](CONTRIBUTING.md) for more information on how to get started.\n\n## License\n\nLicensed under either of\n\n* Apache License, Version 2.0, ([LICENSE-APACHE](LICENSE-APACHE) or http://www.apache.org/licenses/LICENSE-2.0)\n* MIT license ([LICENSE-MIT](LICENSE-MIT) or http://opensource.org/licenses/MIT)\n\nat your option.\n\n### Contribution\n\nUnless you explicitly state otherwise, any contribution intentionally\nsubmitted for inclusion in the work by you, as defined in the Apache-2.0\nlicense, shall be dual licensed as above, without any additional terms or\nconditions.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fembarkstudios%2Fopa-policies","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fembarkstudios%2Fopa-policies","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fembarkstudios%2Fopa-policies/lists"}