Can this be used to install conftest ? If not, is there a plan for an official action

[nitrocode]

Hi all,

I noticed that there are a number of conftest actions out there

https://github.com/marketplace/actions/conftest - instrumenta/conftest-action
https://github.com/marketplace/actions/conftest-action - YubicoLabs/action-conftest
https://github.com/marketplace/actions/setup-opa-conftest - princespaghetti/setup-conftest
https://github.com/marketplace/actions/conftest-opa-test-runner - ibiqlik/conftest-action-docker

In light of the recent tj-actions incident, it would be good to have an official conftest action, if this action cannot be used to install conftest since so many unofficial actions seem to be published.

Workaround

      - name: Install Conftest
        run: |
          curl -sSL https://github.com/open-policy-agent/conftest/releases/download/v0.55.0/conftest_0.55.0_Linux_x86_64.tar.gz -o conftest.tar.gz
          tar -xzvf conftest.tar.gz -C /usr/local/bin/
          chmod +x /usr/local/bin/conftest
          rm conftest.tar.gz

[anderseknert]

Yeah, that makes sense to me. Since it is an "official" project under the OPA org, it would feel natural finding its action here. @jalseth @jpreese what do you think?

[jpreese]

I agree. I think it makes sense to have a setup-conftest action, similar to setup-opa, in the OPA organization.

Given the current state of the conftest actions listed above, and the reletively simple nature of creating a "setup" action. it may be easier to just add a new repo under the opa organization, rather than migrating something.

[mattkeeler]

Any movement on this? Ran across this today and also thought an official github action would be helpful.

[jalseth]

Seems reasonable to me, though I don't think it should go under setup-opa which is specifically for the opa CLI.. I would like to get release signing implemented (open-policy-agent/conftest#1116) before we proceed though.

[jalseth]

As always, PRs are welcome.

[anderseknert]

A new repo under the OPA org requires a bit more than a PR :) I’m looking into it.