fix: address review feedback on OPA evaluator

- Add default case to type switch in evalOPAQuery to surface unexpected
  result types instead of silently dropping them (fail-open fix)
- Use case-sensitive comparison for rule name dedup (OPA rules are
  case-sensitive)
- Fix success padding to use unique rule count instead of total rule
  occurrences across modules
- Wire IsOpaEnabled() into input validation path so EC_USE_OPA=1
  actually uses the OPA evaluator for validate input
- Propagate error from theEnvironmentVarilableIsSet in acceptance test
  setup
- Fix and rename broken "returns error from init" test
- Extract collectRuleNames and evaluateRule helpers from queryNamespace
  for better separation of concerns and testability
- Add TestBuildInput, TestCollectRuleNames, TestEvaluateRule, and
  unexpected result type test

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: joejstuart

acceptance/cli/cli.go

@@ -861,7 +861,11 @@ func AddStepsTo(sc *godog.ScenarioContext) {
 	sc.Step(`^a track bundle file named "([^"]*)" containing$`, createTrackBundleFile)
 	sc.Before(func(ctx context.Context, _ *godog.Scenario) (context.Context, error) {
 		if v := os.Getenv("EC_USE_OPA"); v != "" {
-			ctx, _ = theEnvironmentVarilableIsSet(ctx, "EC_USE_OPA="+v)
+			var err error
+			ctx, err = theEnvironmentVarilableIsSet(ctx, "EC_USE_OPA="+v)
+			if err != nil {
+				return ctx, fmt.Errorf("setting EC_USE_OPA: %w", err)
+			}
 		}
 		return ctx, nil
 	})

internal/evaluation_target/application_snapshot_image/application_snapshot_image_test.go

@@ -326,6 +326,100 @@ func TestWriteInputFileMultipleAttestations(t *testing.T) {
 	assert.JSONEq(t, string(inputJSON), string(bytes))
 }
 
+func TestBuildInput(t *testing.T) {
+	t.Run("basic round-trip", func(t *testing.T) {
+		a := ApplicationSnapshotImage{
+			reference:    name.MustParseReference("registry.io/repository/image:tag"),
+			attestations: []attestation.Attestation{createSimpleAttestation(nil)},
+			snapshot: app.SnapshotSpec{
+				Components: []app.SnapshotComponent{
+					{ContainerImage: "registry.io/repository/image:tag"},
+				},
+			},
+			component: app.SnapshotComponent{
+				Name:           "my-component",
+				ContainerImage: "registry.io/repository/image:tag",
+			},
+		}
+
+		parsed, inputJSON, err := a.BuildInput(context.Background())
+		require.NoError(t, err)
+		assert.NotNil(t, parsed)
+		assert.NotEmpty(t, inputJSON)
+
+		img, ok := parsed["image"].(map[string]any)
+		require.True(t, ok)
+		assert.Equal(t, "registry.io/repository/image:tag", img["ref"])
+
+		assert.Equal(t, "my-component", parsed["component_name"])
+
+		var fromJSON map[string]any
+		require.NoError(t, json.Unmarshal(inputJSON, &fromJSON))
+		assert.Equal(t, parsed["component_name"], fromJSON["component_name"])
+	})
+
+	t.Run("with parent image", func(t *testing.T) {
+		a := ApplicationSnapshotImage{
+			reference:        name.MustParseReference("registry.io/repository/image:tag"),
+			parentRef:        name.MustParseReference("registry.io/repository/parent:latest"),
+			parentConfigJSON: json.RawMessage(`{"Labels":{"io.k8s.display-name":"Base"}}`),
+		}
+
+		parsed, _, err := a.BuildInput(context.Background())
+		require.NoError(t, err)
+
+		img, ok := parsed["image"].(map[string]any)
+		require.True(t, ok)
+		parent, ok := img["parent"].(map[string]any)
+		require.True(t, ok)
+		assert.Equal(t, "registry.io/repository/parent:latest", parent["ref"])
+	})
+
+	t.Run("without parent image", func(t *testing.T) {
+		a := ApplicationSnapshotImage{
+			reference: name.MustParseReference("registry.io/repository/image:tag"),
+		}
+
+		parsed, _, err := a.BuildInput(context.Background())
+		require.NoError(t, err)
+
+		img, ok := parsed["image"].(map[string]any)
+		require.True(t, ok)
+		parent, exists := img["parent"]
+		if exists {
+			parentMap, ok := parent.(map[string]any)
+			assert.True(t, !ok || parentMap["ref"] == nil || parentMap["ref"] == "")
+		}
+	})
+
+	t.Run("matches WriteInputFile output", func(t *testing.T) {
+		a := ApplicationSnapshotImage{
+			reference:    name.MustParseReference("registry.io/repository/image:tag"),
+			attestations: []attestation.Attestation{createSimpleAttestation(nil)},
+			snapshot: app.SnapshotSpec{
+				Components: []app.SnapshotComponent{
+					{ContainerImage: "registry.io/repository/image:tag"},
+				},
+			},
+			component: app.SnapshotComponent{
+				Name:           "test-component",
+				ContainerImage: "registry.io/repository/image:tag",
+			},
+		}
+
+		parsed, buildJSON, err := a.BuildInput(context.Background())
+		require.NoError(t, err)
+
+		fs := afero.NewMemMapFs()
+		ctx := utils.WithFS(context.Background(), fs)
+		_, writeJSON, err := a.WriteInputFile(ctx)
+		require.NoError(t, err)
+
+		assert.JSONEq(t, string(writeJSON), string(buildJSON))
+		assert.NotNil(t, parsed)
+	})
+}
+
 func TestNewApplicationSnapshotImage(t *testing.T) {
 	ctx := context.Background()
 

internal/evaluation_target/input/input.go

@@ -24,9 +24,11 @@ import (
 	"github.com/conforma/cli/internal/evaluator"
 	"github.com/conforma/cli/internal/policy"
 	"github.com/conforma/cli/internal/policy/source"
+	"github.com/conforma/cli/internal/utils"
 )
 
 var newConftestEvaluator = evaluator.NewConftestEvaluator
+var newOPAEvaluator = evaluator.NewOPAEvaluator
 
 // Input represents the structure needed to evaluate a generic file input
 type Input struct {
@@ -48,13 +50,19 @@ func NewInput(ctx context.Context, paths []string, p policy.Policy) (*Input, err
 			log.Debugf("policySource: %#v", policySource)
 		}
 
-		c, err := newConftestEvaluator(ctx, policySources, p, sourceGroup)
+		var c evaluator.Evaluator
+		var err error
+		if utils.IsOpaEnabled() {
+			c, err = newOPAEvaluator(ctx, policySources, p, sourceGroup, nil)
+		} else {
+			c, err = newConftestEvaluator(ctx, policySources, p, sourceGroup)
+		}
 		if err != nil {
-			log.Debug("Failed to initialize the conftest evaluator!")
+			log.Debug("Failed to initialize the evaluator!")
 			return nil, err
 		}
 
-		log.Debug("Conftest evaluator initialized")
+		log.Debug("Evaluator initialized")
 		i.Evaluators = append(i.Evaluators, c)
 
 	}

internal/evaluator/opa_evaluator.go

@@ -240,8 +240,31 @@ func (o *opaEvaluator) queryNamespace(ctx context.Context, fileName string, inpu
 		Namespace: namespace,
 	}
 
+	ruleNames := o.collectRuleNames(namespace)
+
+	var successes int
+	for _, ruleName := range ruleNames {
+		ruleResult, err := o.evaluateRule(ctx, input, namespace, ruleName)
+		if err != nil {
+			return Outcome{}, err
+		}
+		successes += ruleResult.successes
+		outcome.Failures = append(outcome.Failures, ruleResult.failures...)
+		outcome.Warnings = append(outcome.Warnings, ruleResult.warnings...)
+		outcome.Exceptions = append(outcome.Exceptions, ruleResult.exceptions...)
+	}
+
+	resultCount := len(outcome.Failures) + len(outcome.Warnings) + len(outcome.Exceptions) + successes
+	if resultCount < len(ruleNames) {
+		successes += len(ruleNames) - resultCount
+	}
+	outcome.Successes = make([]Result, successes)
+
+	return outcome, nil
+}
+
+func (o *opaEvaluator) collectRuleNames(namespace string) []string {
 	var ruleNames []string
-	var ruleCount int
 	for _, module := range o.engine.Modules() {
 		ns := strings.Replace(module.Package.Path.String(), "data.", "", 1)
 		if ns != namespace {
@@ -252,10 +275,9 @@ func (o *opaEvaluator) queryNamespace(ctx context.Context, fileName string, inpu
 			if !isOPAFailure(name) && !isOPAWarning(name) {
 				continue
 			}
-			ruleCount++
 			found := false
 			for _, existing := range ruleNames {
-				if strings.EqualFold(existing, name) {
+				if existing == name {
 					found = true
 					break
 				}
@@ -265,52 +287,53 @@ func (o *opaEvaluator) queryNamespace(ctx context.Context, fileName string, inpu
 			}
 		}
 	}
+	return ruleNames
+}
 
-	var successes int
-	for _, ruleName := range ruleNames {
-		exceptionQuery := fmt.Sprintf("data.%s.exception[_][_] == %q", namespace, stripRulePrefix(ruleName))
-		exceptionResults, err := o.evalOPAQuery(ctx, input, exceptionQuery)
-		if err != nil {
-			return Outcome{}, fmt.Errorf("query exception: %w", err)
-		}
+type ruleEvalResult struct {
+	failures   []Result
+	warnings   []Result
+	exceptions []Result
+	successes  int
+}
 
-		var exceptions []Result
-		for _, er := range exceptionResults {
-			if er.Message == "" {
-				exceptions = append(exceptions, Result{Message: exceptionQuery})
-			}
-		}
+func (o *opaEvaluator) evaluateRule(ctx context.Context, input any, namespace string, ruleName string) (ruleEvalResult, error) {
+	var result ruleEvalResult
 
-		ruleQuery := fmt.Sprintf("data.%s.%s", namespace, ruleName)
-		ruleResults, err := o.evalOPAQuery(ctx, input, ruleQuery)
-		if err != nil {
-			return Outcome{}, fmt.Errorf("query rule: %w", err)
-		}
+	exceptionQuery := fmt.Sprintf("data.%s.exception[_][_] == %q", namespace, stripRulePrefix(ruleName))
+	exceptionResults, err := o.evalOPAQuery(ctx, input, exceptionQuery)
+	if err != nil {
+		return result, fmt.Errorf("query exception: %w", err)
+	}
 
-		for _, rr := range ruleResults {
-			if len(exceptions) > 0 {
-				continue
-			}
-			if rr.Message == "" {
-				successes++
-				continue
-			}
-			if isOPAFailure(ruleName) {
-				outcome.Failures = append(outcome.Failures, rr)
-			} else {
-				outcome.Warnings = append(outcome.Warnings, rr)
-			}
+	for _, er := range exceptionResults {
+		if er.Message == "" {
+			result.exceptions = append(result.exceptions, Result{Message: exceptionQuery})
 		}
-		outcome.Exceptions = append(outcome.Exceptions, exceptions...)
 	}
 
-	resultCount := len(outcome.Failures) + len(outcome.Warnings) + len(outcome.Exceptions) + successes
-	if resultCount < ruleCount {
-		successes += ruleCount - resultCount
+	ruleQuery := fmt.Sprintf("data.%s.%s", namespace, ruleName)
+	ruleResults, err := o.evalOPAQuery(ctx, input, ruleQuery)
+	if err != nil {
+		return result, fmt.Errorf("query rule: %w", err)
 	}
-	outcome.Successes = make([]Result, successes)
 
-	return outcome, nil
+	for _, rr := range ruleResults {
+		if len(result.exceptions) > 0 {
+			continue
+		}
+		if rr.Message == "" {
+			result.successes++
+			continue
+		}
+		if isOPAFailure(ruleName) {
+			result.failures = append(result.failures, rr)
+		} else {
+			result.warnings = append(result.warnings, rr)
+		}
+	}
+
+	return result, nil
 }
 
 func (o *opaEvaluator) evalOPAQuery(ctx context.Context, input any, query string) ([]Result, error) {
@@ -372,6 +395,11 @@ func (o *opaEvaluator) evalOPAQuery(ctx context.Context, input any, query string
 						Message:  msg,
 						Metadata: metadata,
 					})
+				default:
+					results = append(results, Result{
+						Message:  fmt.Sprintf("unexpected policy result type %T: %v", v, v),
+						Metadata: map[string]any{},
+					})
 				}
 			}
 		}