checkout-anywhere
diff --git a/‎.github/dependabot.yml
Lines changed: 5 additions & 0 deletions b/‎.github/dependabot.yml
Lines changed: 5 additions & 0 deletions
diff --git a/‎.github/workflows/release.yaml
Lines changed: 6 additions & 3 deletions b/‎.github/workflows/release.yaml
Lines changed: 6 additions & 3 deletions
diff --git a/‎.github/workflows_bak/pr.yaml
Lines changed: 37 additions & 14 deletions b/‎.github/workflows_bak/pr.yaml
Lines changed: 37 additions & 14 deletions
diff --git a/‎.golangci.yaml
Lines changed: 35 additions & 16 deletions b/‎.golangci.yaml
Lines changed: 35 additions & 16 deletions
diff --git a/‎.pre-commit-hooks.yaml
Lines changed: 19 additions & 0 deletions b/‎.pre-commit-hooks.yaml
Lines changed: 19 additions & 0 deletions
diff --git a/‎Dockerfile
Lines changed: 2 additions & 2 deletions b/‎Dockerfile
Lines changed: 2 additions & 2 deletions
diff --git a/‎Makefile
Lines changed: 6 additions & 2 deletions b/‎Makefile
Lines changed: 6 additions & 2 deletions
diff --git a/‎README.md
Lines changed: 2 additions & 2 deletions b/‎README.md
Lines changed: 2 additions & 2 deletions
diff --git a/‎acceptance.bats
Lines changed: 9 additions & 0 deletions b/‎acceptance.bats
Lines changed: 9 additions & 0 deletions
diff --git a/‎docs/debug.md
Lines changed: 14 additions & 0 deletions b/‎docs/debug.md
Lines changed: 14 additions & 0 deletions
@@ -30,3 +30,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
@@ -4,6 +4,9 @@ on:
   push:
     tags:
       - 'v*'
+env:
+  IMAGE: openpolicyagent/conftest
+  PLATFORMS: linux/amd64,linux/arm64
 
 jobs:
   release:
@@ -42,14 +45,14 @@ jobs:
       #   run: make push TAG=$VERSION
 
       - name: setup go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5
         with:
-          go-version: "1.23.x"
+          go-version: "1.24.x"
 
       - name: release
         uses: goreleaser/goreleaser-action@v6
         with:
           args: release --clean
           version: "~> v1"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -2,17 +2,12 @@ name: pr
 
 on: [pull_request]
 
-permissions:
-  actions: read
-  checks: none
-  contents: none
-  deployments: none
-  issues: none
-  packages: none
-  pull-requests: none
-  repository-projects: none
-  security-events: none
-  statuses: none
+
+permissions: {}
+
+env:
+  IMAGE: openpolicyagent/conftest
+  PLATFORMS: linux/amd64,linux/arm64
 
 jobs:
   style:
@@ -59,11 +54,11 @@ jobs:
       - name: setup go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.23.x"
+          go-version: "1.24.x"
           cache: false
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v8
         with:
           args: --timeout=5m --color=always --max-same-issues=0 --max-issues-per-linter=0
 
@@ -73,8 +68,16 @@ jobs:
       - name: unit test
         run: make test
 
+      # Ensure Actions runner has Python installed
+      # This is required for pre-commit tests to work
+      - name: setup python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+          cache: 'pip'
+
       - name: setup bats
-        uses: bats-core/bats-action@1.5.4
+        uses: bats-core/bats-action@3.0.1
         with:
           # Pin bats version to fix CI issue: https://github.com/bats-core/bats-action/pull/4
           bats-version: "1.10.0"
@@ -91,3 +94,23 @@ jobs:
 
       - name: test oci push/pull
         run: ./scripts/push-pull-e2e.sh
+
+  docker:
+    runs-on: ubuntu-latest
+    needs:
+      - validate
+    steps:
+      - name: checkout source
+        uses: actions/checkout@v4
+
+      - name: setup docker buildx
+        run: docker buildx create --name conftestbuild --use
+
+      - name: Build Docker image
+        uses: docker/build-push-action@v6 
+        with:
+          context: .
+          push: false
+          tags: |
+            ${{ env.IMAGE }}:latest
+          platforms: ${{ env.PLATFORMS }}
@@ -1,23 +1,10 @@
-linters-settings:
-  misspell:
-    locale: US
-  govet:
-    enable:
-      - nilness
-  staticcheck:
-    checks:
-      - "all" # Include all checks except the ones below.
-      - "-SA1019" # Do not block the build if deprecated functions or packages are used.
-
+version: "2"
 linters:
-  disable-all: true
+  default: none
   enable:
     - errcheck
     - goconst
-    - gofmt
-    - goimports
     - gosec
-    - gosimple
     - govet
     - ineffassign
     - makezero
@@ -26,8 +13,40 @@ linters:
     - predeclared
     - revive
     - staticcheck
-    - typecheck
     - unconvert
     - unparam
     - unused
     - wastedassign
+  settings:
+    govet:
+      enable:
+        - nilness
+    misspell:
+      locale: US
+    staticcheck:
+      checks:
+        # These are processed in order. It is important that the inclusion
+        # comes before the exclusion.
+        - all
+        - -SA1019
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
@@ -0,0 +1,19 @@
+- id: conftest-test
+  name: Conftest Test Policy Check
+  description: Validate configuration files against Open Policy Agent policies using Conftest
+  entry: conftest test
+  language: golang
+  pass_filenames: true
+  require_serial: true
+  minimum_pre_commit_version: "2.9.0"
+  stages: [pre-commit, pre-merge-commit, pre-push, manual]
+
+- id: conftest-verify
+  name: Conftest Verify Policy Tests
+  description: Run Rego unit tests for Conftest policies
+  entry: conftest verify
+  language: golang
+  pass_filenames: false
+  require_serial: true
+  minimum_pre_commit_version: "2.9.0"
+  stages: [pre-commit, pre-merge-commit, pre-push, manual]
@@ -1,4 +1,4 @@
-FROM golang:1.23.6-alpine as base
+FROM golang:1.24.2-alpine as base
 ARG TARGETARCH
 ARG VERSION
 ARG COMMIT
@@ -52,7 +52,7 @@ RUN go install cuelang.org/go/cmd/cue@latest
 WORKDIR /examples
 
 ## RELEASE ##
-FROM alpine:3.21.2
+FROM alpine:3.21.3
 
 # Install git for protocols that depend on it when using conftest pull
 RUN apk add --no-cache git
 
@@ -39,11 +39,15 @@ test-examples: build ## Runs the tests for the examples.
 	@bats acceptance.bats
 
 .PHONY: test-acceptance
-test-acceptance: build ## Runs the tests in the test folder.
+test-acceptance: build install-test-deps ## Runs the tests in the test folder.
 	@for testdir in $(TEST_DIRS) ; do \
 		cd $(CURDIR)/$$testdir && CONFTEST=$(ROOT_DIR)/$(BIN) bats test.bats || exit 1; \
 	done
 
+.PHONY: install-test-deps
+install-test-deps: ## Installs dependencies required for testing.
+	@command -v pre-commit >/dev/null 2>&1 || python -m pip install -r requirements-dev.txt
+
 .PHONY: test-oci
 test-oci: ## Runs the OCI integration test for push and pull.
 	@./scripts/push-pull-e2e.sh
@@ -75,4 +79,4 @@ help:
 # 	@test -n "$(TAG)" || (echo "TAG parameter not set." && exit 1)
 # 	@$(DOCKER) buildx build . --push --build-arg VERSION="$(TAG)" -t $(IMAGE):$(TAG) --platform $(DOCKER_PLATFORMS)
 # 	@$(DOCKER) buildx build . --push --build-arg VERSION="$(TAG)" -t $(IMAGE):latest --platform $(DOCKER_PLATFORMS)
-# 	@$(DOCKER) buildx build . --push --target examples -t $(IMAGE):examples --platform $(DOCKER_PLATFORMS)
+# 	@$(DOCKER) buildx build . --push --target examples -t $(IMAGE):examples --platform $(DOCKER_PLATFORMS)
@@ -15,14 +15,14 @@ Here's a quick example. Save the following as `policy/deployment.rego`:
 ```rego
 package main
 
-deny[msg] {
+deny contains msg if {
   input.kind == "Deployment"
   not input.spec.template.spec.securityContext.runAsNonRoot
 
   msg := "Containers must not run as root"
 }
 
-deny[msg] {
+deny contains msg if {
   input.kind == "Deployment"
   not input.spec.selector.matchLabels.app
 
 
@@ -521,3 +521,12 @@ EOF"
   [ "$status" -eq 1 ]
   [[ "$output" =~ "look up message type" ]]
 }
+
+@test "Can parse files from a symlinked directory" {
+  TMPDIR="$(mktemp -d -u)"
+  ln -s $(pwd)/examples/hcl2 ${TMPDIR}
+  run ./conftest test -p examples/hcl2/policy ${TMPDIR}
+  rm -rf ${TMPDIR}
+  [ "$status" -eq 1 ]
+  [[ "$output" =~ "10 tests, 3 passed, 0 warnings, 7 failures, 0 exceptions" ]]
+}
@@ -108,3 +108,17 @@ TRAC | Exit data.main.deny = _
 TRAC Redo data.main.deny = _
 TRAC | Redo data.main.deny = _
 ```
+
+## Using trace with other output formats
+
+You can use the `--trace` flag together with any output format. When using `--trace` with formats like `--output=table` or `--output=json`, the trace information will be written to stderr while the formatted output will be written to stdout. This allows you to capture trace information for debugging while still using your preferred output format.
+
+For example:
+
+```console
+# Output trace to stderr and table format to stdout
+$ conftest test --trace --output=table deployment.yaml
+
+# Capture trace output to a file while viewing table output
+$ conftest test --trace --output=table deployment.yaml 2>trace.log
+```