OPA exceptions - data driven

data.yaml

dockerfile:  
  policies:
    - name: warn_latest_tag
      enabled: true

policy.rego

package main

import data.dockerfile


# read disabled policies from data file and set as exceptions
exception[disabledPolicies] {
    disabledPolicies := [p | p = substring(dockerfile.policies[i].name, indexof(dockerfile.policies[i].name,"_") +1 ,-1); dockerfile.policies[i].enabled == false]
}

# images do not use latest tag
warn_latest_tag[msg] {
	input[i].Cmd == "from"
	split_image := split(input[i].Value[0], ":")
	lower(split_image[1]) == "latest"
	msg = sprintf("Do not use latest tag with image: %s", [input[i].Value[0]])
}