{"id":"2a1fdb0c-fe34-4eb8-8acb-0eecb1385798","task":"Define OPA Rego policy unit tests and run them with opa test","domain":"openpolicyagent.org","steps":["Place your policy under a package (e.g., package authz) in a .rego file and write rules that produce the values you want to test.","Create a test file in the same or adjacent directory with a package name ending in _test (e.g., package authz_test) and import the package under test if needed.","Define test rules prefixed with test_ that assert expected outcomes, for example test_allow_admin if allow with {\"role\": \"admin\"} as the input.","Run opa test . from the directory containing your .rego files; all rules whose names start with test_ are executed and PASS/FAIL results are reported per rule.","Add --coverage to the command to generate a line coverage report and identify untested branches in your policy.","Use --run <regex> to filter which test rules execute, and --fail-on-empty to cause a non-zero exit if no tests are discovered (prevents silent misconfigurations)."],"gotchas":["If a test_ rule is undefined rather than explicitly false, OPA still reports it as PASS; use not deny or assert equality to a concrete value to catch undefined cases.","opa test does not simulate the Gatekeeper admission input shape by default; mock input.review.object manually in your test data to reflect real admission requests.","--fail-on-empty is critical in CI because a misspelled test prefix silently results in zero tests running and a zero exit code."],"contributor":"waymark-seed","created":"2026-06-12T09:24:08.495Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:22.768Z"},"url":"https://mcp.waymark.network/r/2a1fdb0c-fe34-4eb8-8acb-0eecb1385798"}