add eopa-pull step

.github/workflows/pull-request.yaml

@@ -20,6 +20,25 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+      - uses: robinraju/[email protected]
+        with:
+          repository: StyraInc/enterprise-opa
+          latest: true
+          fileName: eopa_Linux_x86_64 
+      - name: prep eopa binary
+        run: |
+          mkdir bin
+          mv eopa_Linux_x86_64 bin/eopa
+          chmod +x bin/eopa
+          echo "$(pwd)/bin" >> $GITHUB_PATH
+      - name: pull libraries from DAS
+        run: |
+          eopa pull --url=https://expo.styra.com
+          chmod -R a+rx .styra
+        env:
+          EOPA_LICENSE_KEY: ${{ secrets.EOPA_LICENSE_KEY }}
+          EOPA_STYRA_DAS_TOKEN: ${{ secrets.STYRA_DAS_TOKEN }}
+          STYRA_DAS_TENANT: expo
       - name: setup
         run: docker compose --profile ci up --quiet-pull --wait --wait-timeout 300
         env:
@@ -30,7 +49,10 @@ jobs:
       - name: test
         run: docker compose run --quiet-pull integration-tests
       - name: dump logs
-        run: docker compose logs
+        run: docker compose --profile ci logs
+        if: failure()
+      - name: dump logs of eopa-ci
+        run: docker compose --profile ci logs opa-ci
         if: failure()
       - name: Publish Test Report
         uses: mikepenz/action-junit-report@v4

.styra.yaml

@@ -0,0 +1,3 @@
+data:
+- .styra/include
+

docker-compose.yaml

@@ -3,29 +3,32 @@ x-styra-env:
   &styra-env
   EOPA_LICENSE_KEY: ${EOPA_LICENSE_KEY}
   STYRA_DAS_TOKEN: ${STYRA_DAS_TOKEN}
+  EOPA_STYRA_DAS_TOKEN: ${STYRA_DAS_TOKEN}
   STYRA_DAS_TENANT: ${STYRA_DAS_TENANT}
   STYRA_DAS_SYSTEM: ${STYRA_DAS_SYSTEM:-}
+x-styra-image: &eopa-image ${EOPA_IMAGE:-ghcr.io/styrainc/enterprise-opa:latest}
 
 services:
   opa-ci:
-    image: ghcr.io/styrainc/enterprise-opa:latest
+    image: *eopa-image
     ports:
       - "8181:8181"
     command:
       - run
       - --server
       - --addr=:8181
-      - users:/data/data.json
-      - /policies/rules/rules.rego
+      - policies/rules/rules.rego
+    working_dir: /work
     volumes:
-      - ./opa/:/data
-      - ./policies/prod/:/policies
+      - .styra.yaml:/work/.styra.yaml
+      - .styra:/work/.styra
+      - ./policies/prod:/work/policies
     environment: *styra-env
     profiles:
       - ci
 
   opa-prod:
-    image: ghcr.io/styrainc/enterprise-opa:latest
+    image: *eopa-image
     ports:
       - "8181:8181"
     command:

policies/prod/rules/rules.rego

@@ -1,8 +1,8 @@
 package rules
 
-import data.dataset
 import future.keywords.if
 import future.keywords.in
+import data.libraries.eopa_ci_demo.users
 
 default allow := false
 
@@ -24,8 +24,8 @@ allow if {
   input.resource.owner == input.subject.name
 }
 
-users_graph[data.users[username].name] := edges if {
-  edges := data.users[username].subordinates
+users_graph[users[username].name] := edges if {
+  edges := users[username].subordinates
 }
 
 users_access[username] := access if {