feat(opa-proto): support proto-format plan bundles (opa build --format=proto) - #110

…ndor

Address zizmor findings on the verify-proto-vendor job: pin all four
actions to commit SHAs (blanket-pinning policy) and set
persist-credentials: false on checkout, matching the rest of the workflow.

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>

- Drop the misleading '.manifest.pb before .manifest' comment; branches
  use exact equals() matching, so order is irrelevant.
- Replace the redundant 'else if (!entry.isDirectory())' with a plain
  else; directories already continue at the top of the loop.

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>

Replace the lazy ProtoDecoderHolder with a static final PROTO_DECODER
field, matching POLICY_READER and BUNDLE_PARSER. loadOptional still
returns null for JSON-only classpaths, so the only behavioral change is
that a duplicate-provider misconfig now fails at class-init rather than
on first proto load — a classpath error we want to surface early.

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>

Per review: fold the three StructConverter number-conversion cases into a
@ParameterizedTest, and the two ProtoBundleParity per-entrypoint methods
into one parameterized test over (entrypoint, input). Structurally
distinct cases are left as their own @test methods.

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>

The other dependencies carry no rationale; opa-proto's purpose is clear
from the module name and documented in ProtoBundleDecoder's javadoc.

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>

ProtoBundleParityTest only exercised the proto decoder on one authz
bundle. This extends coverage to the full OPA compliance corpus so the
decoder is validated against the same breadth of IR the JSON reader is.

- generate-compliance-tests: emit a base64 `plan_proto` per case next to
  the JSON `plan`, produced by OPA's own ir.PolicyToProto (the same path
  as `opa build --format=proto`), so the proto fixtures are faithful to
  OPA rather than a Java-side re-encoding.
- ProtoComplianceTest: for every case, decode both the JSON and proto
  plans and assert they evaluate identically. Evaluation parity (not a
  structural Policy comparison) is the contract that matters — the JSON
  reader and proto decoder legitimately differ on how absent repeated
  fields are represented (null vs empty list), which does not affect
  evaluation.
- Regenerate the fixtures from the pinned OPA version so every case
  carries the new plan_proto column; the JSON content is unchanged.
- opa-proto: add jackson-databind as a test dependency for reading the
  fixtures.

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>

The opa-proto module was never wired into CI, so its tests (including the
new ProtoComplianceTest) never ran on PRs. Add a test-opa-proto job gated
by the change filter, extend the pr-check Rego (and its tests) with an
opa-proto rule, and add the job to the summary's required set.

opa-proto's filter also triggers on tools/generate-compliance-tests/
changes, since ProtoComplianceTest decodes the plan_proto fixtures that
generator emits (an OPA version bump there changes them).

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>

CodeQL flagged the leading String parameter of two parameterized tests as
unused (it fed only the {0} display name). Use it in the AssertJ
description instead, which resolves the finding and improves the failure
message.

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>

The test-opa-proto and verify-proto-vendor jobs were pinned before main's
latest Dependabot action bumps landed. Match the SHAs already used by the
other jobs so the workflow pins one version of each action.

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>

OPA v1.19.0 is the first tagged release with `opa build --format=proto`, and
main now pins it, so the commit-pin scaffolding can go:

- vendorProtoSchemas: drop the GOSUMDB bypass — a tagged release is in
  sum.golang.org, so the checksum database can stay on.
- proto/README.md: describe the pin as v1.19.0 rather than the interim commit.
- Services: restore the braced if body dropped while replaying onto main.

Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>