Open Policy Agent CI example (GitHub Actions workflow)

main.workflow

workflow "OPA evaluation" {
  on = "push"
  resolves = ["install"]
}

# Determines whether the policy has been violated
action "evaluate" {
  uses = "docker://openpolicyagent/opa:0.11.0"
  args = [
    "eval",
    "--fail-defined", "data.ci.violations[pkg]",
    "--input", "package.json",
    "--data", "ci.rego",
    "--format", "pretty"
  ]
}

# Installs the dependencies in package.json
# iff the evaluate action succeeds
action "install" {
  uses = "nuxt/actions-yarn@master"
  args = "install"
  needs = "evaluate"
}