Run Rego tests across multiple roots
rego_test_multirootRun OPA tests across multiple root directories to prevent package conflicts. Supports explicit root lists or automatic scanning, plus shared paths, coverage, and thresholds.
Instructions
Run opa test once per root and aggregate results. Solves the package-conflict problem that occurs when opa test . is run on a repo with multiple independent package namespaces (OPA issue #4724). Two modes: explicit (supply root list with optional per-root include paths for shared libraries) and scan (auto-discover leaf test roots using the leaf rule -- a directory is a root only if it directly contains *_test.rego files and none of its eligible subdirectories do, preventing OPA's automatic recursion from double-running tests). Use sharedPaths in scan mode to add shared library directories to every root's invocation without including them in discovery. Coverage and threshold work per-root; overallCoveragePct is the mean across roots that have coverage data.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| roots | No | Explicit list of test root directories. Use when roots are known upfront or when scan mode cannot determine the correct roots. Mutually exclusive with `scanDir`. | |
| scanDir | No | Top-level directory to scan for test roots. Uses the leaf rule: a directory is a root only if it directly contains `*_test.rego` files and none of its eligible subdirectories do. Mutually exclusive with `roots`. | |
| verbose | No | Emit per-test pass/fail details for each root. | |
| coverage | No | Include per-line coverage data per root. Switches output to coverage-report mode: test record counts are not available, but `coverage`, `coveragePct`, and `overallCoveragePct` fields are populated. | |
| maxDepth | No | Maximum directory depth to scan. Default: 10. Only used with `scanDir`. | |
| maxRoots | No | Maximum number of test roots allowed. Returns INVALID_INPUT if scan finds more. Default: 50. Only used with `scanDir`. | |
| threshold | No | Minimum coverage percentage required per root (0-100). Roots below threshold have `thresholdMet: false` in their result. Implicitly enables coverage-report output mode. | |
| varValues | No | Include local variable bindings in trace output (`--var-values`). Only useful with `verbose: true`. | |
| runPattern | No | Run only tests whose names match this regular expression (passed as `--run` to each root). | |
| sharedPaths | No | Paths added to every root's `opa test` invocation and excluded from auto-discovery. Use for shared library directories that all roots import from. | |
| ignorePatterns | No | Additional directory name patterns to skip during scan (e.g., ["vendor", "*.generated"]). Supports `*` wildcards. Only used with `scanDir`. |