Auto-fix Rego violations
rego_fixDestructiveIdempotent
Automatically fix Rego policy files by applying mechanical fixes for five regal rules, including formatting and syntax improvements. Preview changes with dry run before modifying files.
Instructions
Run regal fix to automatically apply mechanical fixes for the five rules regal 0.30.0 supports: opa-fmt, use-rego-v1, use-assignment-operator, no-whitespace-comment, and directory-package-mismatch. Use dryRun: true to preview changes before modifying files. NOTE: directory-package-mismatch moves files to match their package path -- use disable: ["directory-package-mismatch"] to skip it. Files with uncommitted git changes require force: true. Requires regal.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| paths | Yes | Policy files or directories to fix. Each must be inside an allowed root (OPA_MCP_ALLOWED_PATHS). | |
| dryRun | No | Preview what would be fixed without modifying any files. Recommended before the first real run. | |
| force | No | Allow fixing files that have uncommitted git changes, or when the project is not a git repository. Without this flag regal refuses to touch uncommitted files. | |
| configFile | No | Path to a Regal config file (.regal/config.yaml). | |
| disable | No | Disable specific fix rules. Useful to skip directory-package-mismatch if you do not want files moved. | |
| enable | No | Enable specific fix rules. | |
| disableCategory | No | Disable all rules in a category. | |
| enableCategory | No | Enable all rules in a category. | |
| ignoreFiles | No | Glob patterns to exclude from fixing. |