Motivation

With the Rego library files now free of linter-detected bugs, this PR adds tooling to keep them that way. It covers every .rego file in the repo, not just the libraries directory, and provides three layers of enforcement: a CI gate, an opt-in pre-commit hook, and format-on-save for VS Code and Cursor.

Changes

CI (lint-rego.yml)

A new workflow triggers on any PR or push to main that touches a .rego file or the Regal config. It checks formatting with opa fmt --fail across the whole repo, then runs regal lint restricted to the bugs category. Style, idiomatic, performance, import, and testing findings are suppressed so the gate stays focused on correctness.

Pre-commit hooks (.pre-commit-config.yaml)

Two local hooks cover all staged .rego files:

1. opa fmt --fail — blocks the commit if any file is not properly formatted.
2. regal lint --fail-level error with non-bug categories disabled — blocks only on real correctness issues.

Install with pip install pre-commit && pre-commit install.

Editor formatting (.vscode/settings.json)

The workspace settings file sets opa fmt as the default Rego formatter and enables format-on-save. This applies automatically in VS Code and Cursor for anyone with the OPA extension installed. .vscode/ is unignored so this ships with the repo.

Regal config (.regal/config.yaml)

Added suppression for testing/test-outside-test-package since library tests intentionally live alongside their library files rather than in a separate test package.

QA Instruction

1. cd assets/libraries && opa test . -v — all library tests pass.
2. opa fmt --fail . — exits 0.
3. regal lint --fail-level error --disable-category style --disable-category idiomatic --disable-category performance --disable-category imports --disable-category testing . — exits 0.
4. Wait for the new lint-rego CI job to go green.

Impact

No runtime behavior changes. CI gains a new required job for all Rego files; the pre-commit hook is opt-in. Contributors using VS Code or Cursor get automatic Rego formatting on save.

Future work

This PR intentionally starts with the bugs category only. Follow-up PRs will turn the rest of Regal back on for CI and pre-commit by dropping the matching --disable-category flags (and any other temporary suppressions) once the corresponding findings are cleared.

The idiomatic, performance, and style categories currently report a large backlog and are the main candidates for that rollout. A few rules are expected to stay suppressed because they conflict with deliberate contracts rather than indicating real issues: directory-package-mismatch (the engine requires every rule to live in package datadog regardless of directory), and the name-based rules such as prefer-snake-case and avoid-get-and-list-prefix on shared library functions (these names are a public API consumed by the detection rules and cannot be renamed without a coordinated change across repositories).