Skip to content

ast: report violations from multiple compiler stages - #9175

Open
sspaink wants to merge 1 commit into
open-policy-agent:mainfrom
sspaink:fix-5815-strict-multiple-errors
Open

ast: report violations from multiple compiler stages#9175
sspaink wants to merge 1 commit into
open-policy-agent:mainfrom
sspaink:fix-5815-strict-multiple-errors

Conversation

@sspaink

@sspaink sspaink commented Sep 8, 2026

Copy link
Copy Markdown
Member

Compilation stopped at the first stage that recorded an error, so a policy with several violations only ever surfaced one. Errors from checks that leave the modules intact can now be marked as recoverable, so later stages still run, and the collected errors are sorted by location.

The only errors that have been marked recoverable are from stages that are read only and won't have the cascading error issue @johanfylling pointed out.

Message Stage
import data.foo unused CheckUnusedImports (new stage)
import must not shadow import data.foo CheckDuplicateImports
rules must not shadow input|data (use a different rule name) CheckKeywordOverrides
variables must not shadow input|data (use a different variable name) CheckKeywordOverrides
args must not shadow input|data (use a different variable name) CheckKeywordOverrides
unused argument x. (hint: use _ (wildcard variable) instead) RewriteLocalVars
assigned var x unused RewriteLocalVars
declared var x unused RewriteLocalVars

The policy from the issue will now print out 3 errors:

package p

import data.foo

a := any([foo])
b := all([true])

f(x) {
    input.foo
}
BEFORE  1 error occurred: p.rego:8: rego_compile_error: unused argument x. (hint: use _ ...)

AFTER   3 errors occurred:
        p.rego:5: rego_type_error: deprecated built-in function calls in expression: any
        p.rego:6: rego_type_error: deprecated built-in function calls in expression: all
        p.rego:8: rego_compile_error: unused argument x. (hint: use _ ...)

Fixes: #5815

Compilation stopped at the first stage that recorded an error, so a policy with
several violations only ever surfaced one. Errors from checks that leave the
modules intact are now recoverable, so later stages still run, and the collected
errors are sorted by location.

Fixes: open-policy-agent#5815
Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Only a single issue reported by opa check --strict

1 participant