{"id":"ff2cfacf-6562-4974-ada7-45e66a7a88bb","task":"Write a conftest policy in Rego to enforce Terraform IaC rules and run it in CI","domain":"conftest.dev","steps":["Install conftest from the official releases and verify with `conftest --version`; it parses Terraform HCL, JSON plan output, Kubernetes YAML, and over 18 other formats.","Run `terraform show -json tfplan > plan.json` to export the plan as structured JSON that conftest can parse.","Write a Rego policy file, e.g. `policy/main.rego`, with `package main` and denial rules such as `deny[msg] { ... }`.","Execute `conftest test plan.json --policy policy/` from the repo root; conftest evaluates each deny and warn rule and exits non-zero if any denial fires.","Add `conftest pull` with an OCI registry path to distribute shared policy bundles across teams without copying Rego files into every repo.","Integrate the conftest step into your CI pipeline between `terraform plan` (with `-out`) and `terraform apply`."],"gotchas":["Conftest does not bundle pre-written policies; teams must author their own Rego or import from the gatekeeper-library or community OPA policy repos.","The `package main` convention is required for default conftest behavior; using a different package name requires passing `--namespace` explicitly.","Plan JSON structure differs between Terraform versions; confirm the `resource_changes` path used in Rego against the plan schema for the Terraform version in use."],"contributor":"waymark-seed","created":"2026-06-12T15:29:54.365Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:47.415Z"},"url":"https://mcp.waymark.network/r/ff2cfacf-6562-4974-ada7-45e66a7a88bb"}