Skip to content

Commit a4adca6

Browse files
authored
docs: Add docs for location metadata and outputters (#1205)
* docs: Add docs for location metadata and outputters Also, move pre-commit docs to their own page to keep the introductory usage docs as brief as possible. Signed-off-by: James Alseth <james@jalseth.me> * docs: Format docs with mdformat This ensures consistency and makes the docs easier to read when viewing the markdown files directly rather than the rendered HTML. Signed-off-by: James Alseth <james@jalseth.me> --------- Signed-off-by: James Alseth <james@jalseth.me>
1 parent 345297c commit a4adca6

File tree

16 files changed

+546
-175
lines changed

16 files changed

+546
-175
lines changed

.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ site
88
.DS*
99
.idea
1010

11+
# Running docs site locally
12+
Pipfile*
13+
1114
# NodeJS files/dirs created when installing bats
1215
node_modules/
1316
package.json

Makefile

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -60,12 +60,12 @@ lint: ## Lints Conftest.
6060
ratchet-update:
6161
@ratchet update .github/workflows/*.yaml
6262

63+
.PHONY: format-docs
64+
format-docs:
65+
@mdformat --wrap 80 docs
66+
6367
.PHONY: all
6468
all: lint build test test-examples test-acceptance ## Runs all linting and tests.
6569

6670
help:
6771
@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m\033[0m\n"} /^[$$()% a-zA-Z_-]+:.*?##/ { printf " \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
68-
69-
#
70-
##@ Releases
71-
#

docs/README.md

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,20 @@
11
# Conftest documentation
22

3-
The documentation for Conftest is stored as markdown files in this directory, and a documentation site generated using [Mkdocs](https://www.mkdocs.org/).
3+
The documentation for Conftest is stored as markdown files in this directory,
4+
and a documentation site generated using [Mkdocs](https://www.mkdocs.org/).
45

5-
Conftest provides a `Pipfile` for managing the required dependencies. At the top level of this repository (ie. _not_ in the `docs` directory) run:
6+
Conftest provides a `Pipfile` for managing the required dependencies. At the top
7+
level of this repository (ie. _not_ in the `docs` directory) run:
68

79
```console
810
pipenv install
911
```
1012

11-
With the dependencies installed you can run the site locally. Any modifications to the files in `docs` will be automatically rebuilt.
13+
With the dependencies installed you can run the site locally. Any modifications
14+
to the files in `docs` will be automatically rebuilt.
1215

1316
```console
14-
pipenv run mkdir serve
17+
pipenv run mkdocs serve
1518
INFO - Building documentation...
1619
INFO - Cleaning site directory
1720
INFO - Documentation built in 0.45 seconds

docs/debug.md

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
# Debugging policies
22

3-
When working on more complex queries (or when learning Rego), it's useful to see exactly how the policy is applied. For this purpose you can use the `--trace` flag. This will output a large trace from Open Policy Agent like the following:
3+
When working on more complex queries (or when learning Rego), it's useful to see
4+
exactly how the policy is applied. For this purpose you can use the `--trace`
5+
flag. This will output a large trace from Open Policy Agent like the following:
46

57
```console
68
$ conftest test --trace deployment.yaml
@@ -111,7 +113,11 @@ TRAC | Redo data.main.deny = _
111113

112114
## Using trace with other output formats
113115

114-
You can use the `--trace` flag together with any output format. When using `--trace` with formats like `--output=table` or `--output=json`, the trace information will be written to stderr while the formatted output will be written to stdout. This allows you to capture trace information for debugging while still using your preferred output format.
116+
You can use the `--trace` flag together with any output format. When using
117+
`--trace` with formats like `--output=table` or `--output=json`, the trace
118+
information will be written to stderr while the formatted output will be written
119+
to stdout. This allows you to capture trace information for debugging while
120+
still using your preferred output format.
115121

116122
For example:
117123

docs/documentation.md

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22

33
## Document your policies
44

5-
OPA has introduced a standard way to document policies called [Metadata](https://www.openpolicyagent.org/docs/latest/policy-language/#metadata).
5+
OPA has introduced a standard way to document policies called
6+
[Metadata](https://www.openpolicyagent.org/docs/latest/policy-language/#metadata).
67
This format allows for structured in code documentation of policies.
78

89
```opa
@@ -17,29 +18,34 @@ allow if {
1718
}
1819
```
1920

20-
For the generated documentation to make sense your `packages` should be documented with at least the `title` field
21-
and `rules` should have both `title` and `description`. This will ensure that no section is empty in your
21+
For the generated documentation to make sense your `packages` should be
22+
documented with at least the `title` field and `rules` should have both `title`
23+
and `description`. This will ensure that no section is empty in your
2224
documentations.
2325

2426
## Generate the documentation
2527

26-
In code documentation is great but what we often want it to later generated an actual static reference documentation.
27-
The `doc` command will retrieve all annotation of a targeted module and generate a markdown documentation for it.
28+
In code documentation is great but what we often want it to later generated an
29+
actual static reference documentation. The `doc` command will retrieve all
30+
annotation of a targeted module and generate a markdown documentation for it.
2831

2932
```bash
3033
conftest doc path/to/policy
3134
```
3235

3336
## Use your own template
3437

35-
You can override the [default template](https://raw.githubusercontent.com/open-policy-agent/conftest/refs/heads/master/document/resources/document.md) with your own template
38+
You can override the
39+
[default template](https://raw.githubusercontent.com/open-policy-agent/conftest/refs/heads/master/document/resources/document.md)
40+
with your own template
3641

3742
```aiignore
3843
conftest -t template.md path/tp/policies
3944
```
4045

41-
All annotation are returned as a sorted list of all annotations, grouped by the path and location of their targeted
42-
package or rule. For instance using this template
46+
All annotation are returned as a sorted list of all annotations, grouped by the
47+
path and location of their targeted package or rule. For instance using this
48+
template
4349

4450
```bash
4551
{{ range . -}}

docs/examples.md

Lines changed: 33 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,36 @@
11
# Examples
22

3-
You can find examples using various other tools in the `examples` directory, including:
3+
You can find examples using various other tools in the `examples` directory,
4+
including:
45

5-
* [AWS SAM Framework](https://github.com/open-policy-agent/conftest/tree/master/examples/awssam)
6-
* [Builtin-Errors](https://github.com/open-policy-agent/conftest/tree/master/examples/builtin-errors)
7-
* [Capabilities](https://github.com/open-policy-agent/conftest/tree/master/examples/capabilities)
8-
* [Combine](https://github.com/open-policy-agent/conftest/tree/master/examples/combine)
9-
* [Configfile](https://github.com/open-policy-agent/conftest/tree/master/examples/configfile)
10-
* [CUE](https://github.com/open-policy-agent/conftest/tree/master/examples/cue)
11-
* [Cyclonedx](https://github.com/open-policy-agent/conftest/tree/master/examples/cyclonedx)
12-
* [Data](https://github.com/open-policy-agent/conftest/tree/master/examples/data)
13-
* [Docker compose](https://github.com/open-policy-agent/conftest/tree/master/examples/compose)
14-
* [Dockerfile](https://github.com/open-policy-agent/conftest/tree/master/examples/docker)
15-
* [Dotenv](https://github.com/open-policy-agent/conftest/tree/master/examples/dotenv)
16-
* [EDN](https://github.com/open-policy-agent/conftest/tree/master/examples/edn)
17-
* [Exceptions](https://github.com/open-policy-agent/conftest/tree/master/examples/exceptions)
18-
* [HCL](https://github.com/open-policy-agent/conftest/tree/master/examples/hcl1)
19-
* [HCL 2](https://github.com/open-policy-agent/conftest/tree/master/examples/hcl2)
20-
* [HOCON](https://github.com/open-policy-agent/conftest/tree/master/examples/hocon)
21-
* [Ignore](https://github.com/open-policy-agent/conftest/tree/master/examples/ignore)
22-
* [INI](https://github.com/open-policy-agent/conftest/tree/master/examples/ini)
23-
* [Jsonnet](https://github.com/open-policy-agent/conftest/tree/master/examples/jsonnet)
24-
* [Kubernetes](https://github.com/open-policy-agent/conftest/tree/master/examples/kubernetes)
25-
* [Kustomize](https://github.com/open-policy-agent/conftest/tree/master/examples/kustomize)
26-
* [Properties](https://github.com/open-policy-agent/conftest/tree/master/examples/properties)
27-
* [Report](https://github.com/open-policy-agent/conftest/tree/master/examples/report)
28-
* [Serverless Framework](https://github.com/open-policy-agent/conftest/tree/master/examples/serverless)
29-
* [Spdx](https://github.com/open-policy-agent/conftest/tree/master/examples/spdx)
30-
* [Strict-rules](https://github.com/open-policy-agent/conftest/tree/master/examples/strict-rules/policy)
31-
* [Textproto](https://github.com/open-policy-agent/conftest/tree/master/examples/textproto)
32-
* [Traefik](https://github.com/open-policy-agent/conftest/tree/master/examples/traefik)
33-
* [Typescript](https://github.com/open-policy-agent/conftest/tree/master/examples/ts)
34-
* [VCL](https://github.com/open-policy-agent/conftest/tree/master/examples/vcl)
35-
* [XML](https://github.com/open-policy-agent/conftest/tree/master/examples/xml)
6+
- [AWS SAM Framework](https://github.com/open-policy-agent/conftest/tree/master/examples/awssam)
7+
- [Builtin-Errors](https://github.com/open-policy-agent/conftest/tree/master/examples/builtin-errors)
8+
- [Capabilities](https://github.com/open-policy-agent/conftest/tree/master/examples/capabilities)
9+
- [Combine](https://github.com/open-policy-agent/conftest/tree/master/examples/combine)
10+
- [Configfile](https://github.com/open-policy-agent/conftest/tree/master/examples/configfile)
11+
- [CUE](https://github.com/open-policy-agent/conftest/tree/master/examples/cue)
12+
- [Cyclonedx](https://github.com/open-policy-agent/conftest/tree/master/examples/cyclonedx)
13+
- [Data](https://github.com/open-policy-agent/conftest/tree/master/examples/data)
14+
- [Docker compose](https://github.com/open-policy-agent/conftest/tree/master/examples/compose)
15+
- [Dockerfile](https://github.com/open-policy-agent/conftest/tree/master/examples/docker)
16+
- [Dotenv](https://github.com/open-policy-agent/conftest/tree/master/examples/dotenv)
17+
- [EDN](https://github.com/open-policy-agent/conftest/tree/master/examples/edn)
18+
- [Exceptions](https://github.com/open-policy-agent/conftest/tree/master/examples/exceptions)
19+
- [HCL](https://github.com/open-policy-agent/conftest/tree/master/examples/hcl1)
20+
- [HCL 2](https://github.com/open-policy-agent/conftest/tree/master/examples/hcl2)
21+
- [HOCON](https://github.com/open-policy-agent/conftest/tree/master/examples/hocon)
22+
- [Ignore](https://github.com/open-policy-agent/conftest/tree/master/examples/ignore)
23+
- [INI](https://github.com/open-policy-agent/conftest/tree/master/examples/ini)
24+
- [Jsonnet](https://github.com/open-policy-agent/conftest/tree/master/examples/jsonnet)
25+
- [Kubernetes](https://github.com/open-policy-agent/conftest/tree/master/examples/kubernetes)
26+
- [Kustomize](https://github.com/open-policy-agent/conftest/tree/master/examples/kustomize)
27+
- [Properties](https://github.com/open-policy-agent/conftest/tree/master/examples/properties)
28+
- [Report](https://github.com/open-policy-agent/conftest/tree/master/examples/report)
29+
- [Serverless Framework](https://github.com/open-policy-agent/conftest/tree/master/examples/serverless)
30+
- [Spdx](https://github.com/open-policy-agent/conftest/tree/master/examples/spdx)
31+
- [Strict-rules](https://github.com/open-policy-agent/conftest/tree/master/examples/strict-rules/policy)
32+
- [Textproto](https://github.com/open-policy-agent/conftest/tree/master/examples/textproto)
33+
- [Traefik](https://github.com/open-policy-agent/conftest/tree/master/examples/traefik)
34+
- [Typescript](https://github.com/open-policy-agent/conftest/tree/master/examples/ts)
35+
- [VCL](https://github.com/open-policy-agent/conftest/tree/master/examples/vcl)
36+
- [XML](https://github.com/open-policy-agent/conftest/tree/master/examples/xml)

docs/exceptions.md

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,12 @@
11
# Exceptions
22

3-
There might be cases where rules might not apply under certain circumstances. For those occasions, you can use `exceptions`. Exceptions are also written in rego, and allow you to specify policies for when a given `deny` or `violation` rule does not apply.
3+
There might be cases where rules might not apply under certain circumstances.
4+
For those occasions, you can use `exceptions`. Exceptions are also written in
5+
rego, and allow you to specify policies for when a given `deny` or `violation`
6+
rule does not apply.
47

5-
Inputs matched by the `exception` will be exempted from the rules specified in `rules`, prefixed by `deny_` or `violation_`:
8+
Inputs matched by the `exception` will be exempted from the rules specified in
9+
`rules`, prefixed by `deny_` or `violation_`:
610

711
```rego
812
exception contains rules if {
@@ -12,19 +16,24 @@ exception contains rules if {
1216
}
1317
```
1418

15-
The above would provide an exception from `deny_foo` and `violation_foo` as well as `deny_bar` and `violation_bar`.
19+
The above would provide an exception from `deny_foo` and `violation_foo` as well
20+
as `deny_bar` and `violation_bar`.
1621

17-
Note that if you specify the empty string, the exception will match *all* rules named `deny` or `violation`. It is recommended to use identifiers in your rule names to allow for targeted exceptions.
22+
Note that if you specify the empty string, the exception will match *all* rules
23+
named `deny` or `violation`. It is recommended to use identifiers in your rule
24+
names to allow for targeted exceptions.
1825

1926
## Reporting
2027

21-
Exceptions are reported as a separate tally in Conftest's output, so you can detect when exceptions are being made. For example, you might see this summary:
28+
Exceptions are reported as a separate tally in Conftest's output, so you can
29+
detect when exceptions are being made. For example, you might see this summary:
2230

2331
`2 tests, 1 passed, 0 warnings, 0 failures, 1 exception`.
2432

2533
## Examples
2634

27-
In the below example, a Kubernetes deployment named `can-run-as-root` will be allowed to run as root, while others will not:
35+
In the below example, a Kubernetes deployment named `can-run-as-root` will be
36+
allowed to run as root, while others will not:
2837

2938
```rego
3039
package main

0 commit comments

Comments
 (0)