ci: run OPA check on version matrix

Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io>

Author: nikpivkin

.github/workflows/test-rego.yaml

@@ -49,3 +49,7 @@ jobs:
 
       - name: Test Rego checks
         run: make test-rego
+
+      - name: Run OPA Check
+        run: make check-rego-matrix
+        shell: bash

Makefile

@@ -1,10 +1,16 @@
+SHELL := /bin/bash
+
 OUTDATED_API_DATA_URL=https://raw.githubusercontent.com/aquasecurity/trivy-db-data/refs/heads/main/k8s/api/k8s-outdated-api.json
 OUTDATED_API_CHECK=checks/kubernetes/workloads/outdated_api.rego
 BUNDLE_FILE=bundle.tar.gz
 REGISTRY_PORT=5111
 
-SED ?= sed
+TRIVY_VERSIONS := latest v0.67.0 v0.63.0
+
+SCHEMAS := cloud.json dockerfile.json kubernetes.json
+SCHEMAS_BASE := pkg/iac/rego/schemas
 
+SED ?= sed
 ifeq ($(shell uname), Darwin)
 	SED = gsed
 endif
@@ -19,11 +25,24 @@ test-integration:
 
 .PHONY: download-schemas
 download-schemas:
-	@schemas_path=schemas ; \
-	base_url=https://raw.githubusercontent.com/aquasecurity/trivy/main/pkg/iac/rego/schemas ; \
-	mkdir -p $$schemas_path ; \
-	for file in cloud.json dockerfile.json kubernetes.json ; do \
-		wget -q -O $$schemas_path/$$file $$base_url/$$file ; \
+	@for version in $(TRIVY_VERSIONS); do \
+		schemas_path="schemas/$$version"; \
+		if [ "$$version" = "latest" ]; then \
+			base_url="https://raw.githubusercontent.com/aquasecurity/trivy/main/$(SCHEMAS_BASE)"; \
+		else \
+		    if [ -d "$$schemas_path" ]; then \
+				echo "Skipping $$version, schemas already exist"; \
+				continue; \
+			fi; \
+			base_url="https://raw.githubusercontent.com/aquasecurity/trivy/refs/tags/$$version/$(SCHEMAS_BASE)"; \
+		fi; \
+		echo "Downloading schemas for $$version..."; \
+		mkdir -p $$schemas_path; \
+		for file in $(SCHEMAS); do \
+			url="$$base_url/$$file"; \
+			echo "  - $$file"; \
+			wget -q -O $$schemas_path/$$file $$url || { echo "Failed to download $$url"; exit 1; }; \
+		done; \
 	done
 
 .PHONY: rego
@@ -39,7 +58,45 @@ test-rego:
 
 .PHONY: check-rego
 check-rego: download-schemas
-	@go run ./cmd/opa check lib checks --v0-v1 --strict -s schemas
+	@go run ./cmd/opa check lib checks --v0-v1 --strict -s schemas/latest
+
+.PHONY: check-rego-matrix
+check-rego-matrix: download-schemas build-opa
+	@for version in $(TRIVY_VERSIONS); do \
+		echo "Running OPA check for $$version..."; \
+		errors=$$(./opa check lib checks --strict -s schemas/$$version -f json --max-errors -1 2>&1 | jq -c '.errors[]?'); \
+		if [ -z "$$errors" ]; then \
+			echo "No errors for $$version"; \
+			continue; \
+		fi; \
+		errs=""; \
+		while read -r err; do \
+			msg=$$(echo $$err | jq -r '.message'); \
+			file=$$(echo $$err | jq -r '.location.file'); \
+			if echo "$$msg" | grep -q '^undefined ref'; then \
+				min_version=$$(./opa parse "$$file" -f json --json-include -comments,-locations \
+					| jq -r '.annotations[0]?.custom.minimum_trivy_version'); \
+				if [ "$$min_version" != "null" ]; then \
+					ver=$${version#v};\
+					cmp=$$(printf "%s\n%s\n" "$$ver" "$$min_version" | sort -V | head -n1); \
+					if [ "$$cmp" = "$$ver" ] && [ "$$ver" != "$$min_version" ]; then \
+						echo "Skipping undefined ref in $$file: matrix version $$ver < minimum required $$min_version"; \
+						continue; \
+					fi; \
+				fi; \
+			fi; \
+			row=$$(echo $$err | jq -r '.location.row'); \
+			code=$$(echo $$err | jq -r '.code'); \
+			errs="$$errs$$file:$$row: $$code: $$msg\n"; \
+		done <<< "$$errors"; \
+		if [ -n "$$errs" ]; then \
+			echo "Found remaining errors for $$version:"; \
+			echo "$$errs"; \
+			exit 1; \
+		else \
+			echo "No relevant errors for $$version"; \
+		fi; \
+	done
 
 .PHONY: lint-rego
 lint-rego: check-rego

cmd/opa/main.go

@@ -1,7 +1,6 @@
 package main
 
 import (
-	"fmt"
 	"os"
 
 	"github.com/open-policy-agent/opa/cmd"
@@ -14,7 +13,6 @@ func main() {
 	rego.RegisterBuiltins()
 	// runs: opa test lib/ checks/
 	if err := cmd.RootCommand.Execute(); err != nil {
-		fmt.Println(err)
 		os.Exit(1)
 	}
 }

test/test_input_schema_test.go

@@ -123,9 +123,9 @@ func loadSchemas(t *testing.T) map[string]*gojsonschema.Schema {
 	t.Helper()
 
 	return map[string]*gojsonschema.Schema{
-		"cloud":      loadSchema(t, "../schemas/cloud.json", enforceNoAdditionalProperties),
-		"kubernetes": loadSchema(t, "../schemas/kubernetes.json"),
-		"dockerfile": loadSchema(t, "../schemas/dockerfile.json"),
+		"cloud":      loadSchema(t, "../schemas/latest/cloud.json", enforceNoAdditionalProperties),
+		"kubernetes": loadSchema(t, "../schemas/latest/kubernetes.json"),
+		"dockerfile": loadSchema(t, "../schemas/latest/dockerfile.json"),
 	}
 }