Run Rego tests across multiple roots
rego_test_multirootRuns opa test once per test root and aggregates results, preventing package-conflict failures in repositories with multiple independent Rego package namespaces. Supports explicit root lists and automatic leaf-root scanning.
Instructions
Run opa test once per root and aggregate results. Solves the package-conflict problem that occurs when opa test . is run on a repo with multiple independent package namespaces (OPA issue #4724). Two modes: explicit (supply root list with optional per-root include paths for shared libraries) and scan (auto-discover leaf test roots using the leaf rule -- a directory is a root only if it directly contains *_test.rego files and none of its eligible subdirectories do, preventing OPA's automatic recursion from double-running tests). Use sharedPaths in scan mode to add shared library directories to every root's invocation without including them in discovery. Coverage and threshold work per-root; overallCoveragePct is the mean across roots that have coverage data.
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "rego_test_multiroot"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| roots | No | Explicit list of test root directories. Use when roots are known upfront or when scan mode cannot determine the correct roots. Mutually exclusive with `scanDir`. | |
| scanDir | No | Top-level directory to scan for test roots. Uses the leaf rule: a directory is a root only if it directly contains `*_test.rego` files and none of its eligible subdirectories do. Mutually exclusive with `roots`. | |
| verbose | No | Emit per-test pass/fail details for each root. | |
| coverage | No | Add per-line coverage (`coverage`, `coveragePct`, and `overallCoveragePct` across roots) to the test results. Each root runs twice, once for the results and once for coverage. A root where a test fails or errors gets no coverage, and a `note` saying so: opa reports none for such a run. | |
| maxDepth | No | Maximum directory depth to scan. Default: 10. Only used with `scanDir`. | |
| maxRoots | No | Maximum number of test roots allowed. Returns INVALID_INPUT if scan finds more. Default: 50. Only used with `scanDir`. | |
| threshold | No | Minimum coverage percentage required per root (0-100). A root whose tests pass below it gets `thresholdMet: false` and a COVERAGE_BELOW_THRESHOLD error. Implies `coverage`. | |
| varValues | No | Include local variable bindings in trace output (`--var-values`). Only useful with `verbose: true`. | |
| runPattern | No | Run only tests whose names match this regular expression (passed as `--run` to each root). | |
| sharedPaths | No | Paths added to every root's `opa test` invocation and excluded from auto-discovery. Use for shared library directories that all roots import from. | |
| v0Compatible | No | Read the policy as Rego v0 (`--v0-compatible`), the syntax OPA used before 1.0: rules without `if`, partial sets as `deny[msg] { ... }`. Needed for a policy that has not been migrated, which OPA 1.x otherwise refuses to load. Where the tool also takes a query, the query is read as v0 too, with the future keywords imported so `in`, `every` and `some x in` still work in it. | |
| ignorePatterns | No | Additional directory name patterns to skip during scan (e.g., ["vendor", "*.generated"]). Supports `*` wildcards. Only used with `scanDir`. |