bundle.yaml

name: bundle
on:
  push:
  workflow_dispatch:

env:
  OPA_VERSION: "0.62.1"

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
      - name: Setup OPA
        uses: open-policy-agent/setup-opa@34a30e8a924d1b03ce2cf7abe97250bbb1f332b5 # v2.2.0
        with:
          version: ${{ env.OPA_VERSION }}
      - name: Test Policy
        run: opa test --verbose .

  release:
    needs:
      - test
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
      - name: Setup OPA
        uses: open-policy-agent/setup-opa@34a30e8a924d1b03ce2cf7abe97250bbb1f332b5 # v2.2.0
        with:
          version: ${{ env.OPA_VERSION }}
      - name: Setup Node.js
        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4
        with:
          node-version: 20
      - name: Test Policies
        run: opa test .
      - name: Build OPA Bundle
        run: opa build --ignore "*_test.rego" policy
      - name: Setup Semantic Release
        run: npm install -g semantic-release @semantic-release/github -D
      - name: Release OPA Bundle
        run: npx semantic-release
        env:
          GH_TOKEN: ${{ github.token }}