examples/enforce-module-use-policy.rego (1)

37-48: Verify intended set membership semantics for this rule.

With deny contains failed_reasons if { ... failed_reasons := [...][_] }, the trailing [_] causes each comprehension element to become its own entry in deny (one membership per reason). That matches the prior deny[failed_reasons] { ... failed_reasons := [...][_] } behavior, so this is a faithful migration — just calling it out since the rule head now reads a bit ambiguously (looks like a single value is being added). A small readability improvement would be to replace the inner indexing with a direct iteration so the rule produces one reason per match without the [_] trick:

♻️ Optional readability refactor

-deny contains failed_reasons if {
-	# Did any of the resources fail to pass?
-	count(invalid_resources[_]) > 0
-
-	# Build a list of reasons for each failure
-	failed_reasons := [sprintf(
-		"Resource '%s' in top level module named '%s' is being created with the incorrect terraform module '%s'. Module(s) '%s' must be used instead.",
-		[reason.resource_type, reason.top_level_module_name, reason.resource_module_name, concat("', '", controlled_resource_types[reason.resource_type])],
-	) |
-		reason := invalid_resources[_]
-	][_]
-}
+deny contains failed_reason if {
+	some reason in invalid_resources
+	failed_reason := sprintf(
+		"Resource '%s' in top level module named '%s' is being created with the incorrect terraform module '%s'. Module(s) '%s' must be used instead.",
+		[reason.resource_type, reason.top_level_module_name, reason.resource_module_name, concat("', '", controlled_resource_types[reason.resource_type])],
+	)
+}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@examples/enforce-module-use-policy.rego` around lines 37 - 48, The rule head
deny contains failed_reasons combined with the comprehension failed_reasons :=
[...][_] uses the trailing [_] to emit one deny entry per reason but reads
ambiguously; change the comprehension to iterate directly and bind each reason
per rule evaluation (e.g., remove the outer list indexing and yield reason in
the comprehension) so that deny produces one failed_reasons value per
invalid_resources item—update the comprehension that builds failed_reasons
(referencing invalid_resources, failed_reasons, and controlled_resource_types)
to a direct generator form instead of using the trailing [_] trick to improve
readability while preserving semantics.

src/opaCommands.ts (2)

77-79: Nit: de-duplicate compatFlag derivation.

The same ternary appears in both executeOpaTestByDirectory and executeIndividualOpaTests. Extracting a tiny helper at module scope keeps the two call sites in lockstep if a third compat mode ever gets added.

♻️ Proposed refactor

 const opaV0CompatibleFlag = "--v0-compatible"; // https://www.openpolicyagent.org/docs/latest/v0-compatibility/
 const opaV1CompatibleFlag = "--v1-compatible";
+
+const getCompatFlag = (useV1Compatible: boolean): string =>
+  useV1Compatible ? opaV1CompatibleFlag : opaV0CompatibleFlag;

-  const compatFlag = useV1Compatible
-    ? opaV1CompatibleFlag
-    : opaV0CompatibleFlag;
+  const compatFlag = getCompatFlag(useV1Compatible);

Also applies to: 170-172

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/opaCommands.ts` around lines 77 - 79, Both executeOpaTestByDirectory and
executeIndividualOpaTests compute the same compatFlag ternary; extract that
logic into a small module‑scope helper (e.g., getCompatFlag or deriveCompatFlag)
that takes the useV1Compatible boolean and returns opaV1CompatibleFlag or
opaV0CompatibleFlag so both functions call the helper instead of duplicating the
ternary; update both call sites (executeOpaTestByDirectory and
executeIndividualOpaTests) to use the new helper and remove the inline ternary
expressions.

---

14-39: Optional: use JSON output and surface stdout.

opa check supports --format=json, which would let the PR comment render file/line offenders in a structured way instead of raw text. If you prefer to keep raw output, no change needed — but consider that the caller in src/index.ts currently drops the output field, so anything OPA writes to stdout is lost. Either drop output from the return shape, or have callers concatenate both (see related comment in src/index.ts).

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/opaCommands.ts` around lines 14 - 39, The function
executeOpaV1CompatibilityCheck currently captures stdout but callers drop the
output; change the OPA invocation to use structured output by adding the
"--format=json" flag to the exec args (i.e., ["check", path,
opaV1CompatibleFlag, "--format=json"]) and keep returning output so callers can
render JSON file/line offenders, then update the caller in src/index.ts to
concatenate or use both return.output and return.error (or otherwise surface
output) instead of ignoring it; alternatively, if you prefer not to emit stdout,
remove the output field from executeOpaV1CompatibilityCheck's return type and
ensure callers only use error/exitCode.

README.md (1)

108-115: Minor: step sequence framing.

Step 3 reads as a distinct action step, but the v1 compatibility check is actually executed inside the existing Execute and Parse Results from Tests node step (in src/index.ts), not as its own composite step in action.yml. The current wording is fine for users thinking in logical stages, but if you want literal fidelity with action.yml, consider grouping steps 3–6 under the single "Execute and Parse Results" step or noting that compatibility check, tests, coverage, and parsing all run in one node step.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@README.md` around lines 108 - 115, Update README.md to accurately reflect the
implementation: change the framing so that steps 3–6 (the Rego v1 compatibility
check, running opa test, coverage tests, and parsing/formatting) are described
as part of the single "Execute and Parse Results from Tests" node step rather
than separate action steps; reference that the v1 compatibility check is
performed inside src/index.ts and that action.yml defines one composite node
step that runs those tasks, or alternatively note that steps 3–6 are logical
sub-steps executed by that single node step.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes