Batch-evaluate OPA policy against input files
opa_execIndependently evaluate each input file against a Rego policy decision, returning per-file results and error-flagged failures. Ideal for CI pipelines checking many config files in one call.
Instructions
Evaluate a policy decision against one or more input files using opa exec --format=json. Unlike rego_eval (single input), opa exec processes every file independently and returns a per-file result -- ideal for CI pipelines that check many config files against a policy in one call. Supply bundle for bundle-based policies or dataPaths for raw policy files; these are mutually exclusive. Each file that fails evaluation appears in results with an error field rather than a result field.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| inputPaths | Yes | One or more JSON/YAML input file paths, or a directory containing input files. OPA evaluates each file independently. Every path must be inside an allowed root. | |
| decision | Yes | The policy entrypoint to evaluate for each input, e.g. `"data.authz.allow"` or `"data.policy.violations"`. Must be a fully-qualified Rego reference. | |
| bundle | No | Path to an OPA bundle directory or `.tar.gz` archive to load as the policy source. Mutually exclusive with `dataPaths`. | |
| dataPaths | No | Policy and/or data file or directory paths to load. Mutually exclusive with `bundle`. |