Build OPA bundle
opa_bundle_buildBuild a deployable OPA bundle from policy and data paths, outputting a .tar.gz archive with optional signing and optimization.
Instructions
Build a deployable bundle from policy / data paths using opa build. Output is a .tar.gz archive with optional inline signing. Supports optimization, custom revision strings, and the WASM target.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| paths | Yes | Policy / data paths to include. Each must be in an allowed root. | |
| output | Yes | Output bundle path (typically `*.tar.gz`). Must be in an allowed root. | |
| optimize | No | Optimization level (0 = none, 2 = aggressive). | |
| revision | No | Bundle revision string written to the manifest. | |
| target | No | Build target (default `rego`; `wasm` compiles to WebAssembly). | |
| entrypoints | No | Entrypoint refs (required when `target=wasm` or `optimize > 0`). | |
| signingKey | No | Path to a signing key for inline signing. | |
| signingAlg | No | Signing algorithm (e.g. RS256). | |
| claimsFile | No | Path to a claims file for inline signing. | |
| capabilities | No | Path to a capabilities JSON file. | |
| bundle | No | Load `paths` as bundle files or root directories (`--bundle`). Required when rebuilding or re-signing an existing bundle. | |
| pruneUnused | No | Exclude dependents of entrypoints that are not reachable from them (`--prune-unused`). Most useful alongside `entrypoints`. | |
| ignore | No | File/directory name patterns to ignore during loading (`--ignore`), e.g. `[".*"]` to skip hidden files. These are name patterns, not filesystem paths. | |
| v1Compatible | No | Opt in to OPA v1.0-compatible behaviors (`--v1-compatible`). Affects the built bundle's runtime semantics. | |
| verificationKey | No | Path to a PEM public key (or HMAC secret file) used to re-verify an existing signed bundle during the build (`--verification-key`). Pair with `bundle: true`. | |
| verificationKeyId | No | Key ID for verification (`--verification-key-id`, OPA default `default`). |