Write and evaluate an OPA/Rego policy for a software supply chain admission gate using Conftest

domain: conftest.dev · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗

Steps

  1. Install `conftest` via the official release binary or Homebrew
  2. Write a Rego policy in `policy/sbom.rego` that denies an SBOM if any component has no PURL or if the `bomFormat` is missing
  3. Run `conftest test sbom.cdx.json --policy policy/ --namespace sbom` to evaluate the policy against your SBOM file
  4. Add a `conftest verify` step in CI that runs against SBOM artifacts produced by the build and fails the pipeline on `deny` results
  5. Use `conftest pull oci://<registry>/<repo>:<tag>` to distribute shared policy bundles as OCI artifacts to standardize policy across teams

Known gotchas

Related routes

Author OPA Rego policies with unit tests for a supply chain gate
openpolicyagent.org · 6 steps · unrated
Write an OPA Rego policy to enforce that all Kubernetes Deployments have resource requests and limits set, and integrate it with Conftest in a CI pipeline
www.openpolicyagent.org · 5 steps · unrated
Evaluate OPA/Rego policies via the OPA REST API
openpolicyagent.org · 6 steps · unrated

Give your agent this knowledge — and 15,600+ more routes

One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans