Setup OPA GitHub Action

GitHub action to configure the Open Policy Agent CLI in your GitHub Actions workflow.

Open Policy Agent (OPA) is an open source, general-purpose policy engine.

Running tests

This GitHub Action works great to run any tests you have included with your Rego files.

Basic Usage

Here we see a simple template that checks out the repository code, installs the latest OPA, and then runs all of the Rego files in the tests directory.

name: Run OPA Tests
on: [push]
jobs:
  Run-OPA-Tests:
    runs-on: ubuntu-latest
    steps:
    - name: Check out repository code
      uses: actions/checkout@v7

    - name: Setup OPA
      uses: step-security/setup-opa@v2
      with:
        version: latest

    - name: Run OPA Tests
      run: opa test tests/*.rego -v

Choose OPA Version

When OPA is installed on the GitHub runner, you can select a the specific version of OPA you wish to run.

steps:
  - name: Setup OPA
    uses: step-security/setup-opa@v2
    with:
      version: 0.44.0

Or, OPA can be locked to a SemVer range.

steps:
  - name: Setup OPA
    uses: step-security/setup-opa@v2
    with:
      version: 0.44.x

steps:
  - name: Setup OPA
    uses: step-security/setup-opa@v2
    with:
      version: 0.44

steps:
  - name: Setup OPA
    uses: step-security/setup-opa@v2
    with:
      version: <0.44

You may also use the latest or edge version.

steps:
  - name: Setup OPA
    uses: step-security/setup-opa@v2
    with:
      version: latest

steps:
  - name: Setup OPA
    uses: step-security/setup-opa@v2
    with:
      version: edge

You can also choose to run your tests against multiple versions of OPA.

strategy:
  matrix:
    version: [latest, 0.44.x, 0.43.x]
steps:
  - name: Setup OPA
    uses: step-security/setup-opa@v2
    with:
      version: ${{ matrix.version }}

Inputs

The action supports the following inputs:

• version: Optional, defaults to latest. latest, edge, and SemVer ranges are supported, so instead of a full version string, you can use 0.44. This enables you to automatically get the latest backward compatible changes in the v0.44 release.
• static: Optional, this lets you select the static binary when multiple binaries are applicable to your platform/arch combination. Defaults depend on your runner, e.g. if you're running on an ARM64 runner, it'll default to true; false otherwise.

Outputs

This action does not set any direct outputs.

Troubleshooting

Within GitHub Actions, using Terraform plans as input results in ["command"]

Sometimes, when trying to analyze a JSON-formatted Terraform plan with opa, the input is always bound to ["command"] regardless of the contents of the plan. This issue is specific to GitHub Actions, and is related to the terraform_wrapper functionality that is enabled by default in the official step-security/setup-terraform action. Specifically, the terraform_wrapper includes extra metadata when running commands such as terraform show -json tfplan > tfplan.json.

There are two primary options for resolving this issue:

• EITHER disable the terraform_wrapper when using step-security/setup-terraform

  - uses: step-security/setup-terraform@v4
    with:
      terraform_wrapper: false

• OR manually "filter" the extra metadata when creating the JSON-formatted plan:

  - run: terraform show -json tfplan | grep '^{.*}$' > tfplan.json

For a more thorough description of why this happens, see this issue.