ci: test with OPA 1.20.2 only and drop OPA 1.19

.github/workflows/test.yml

@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: open-policy-agent/setup-opa@v2
         with:
-          version: 1.19.0
+          version: 1.20.2
       - uses: open-policy-agent/setup-regal@v2.0.0
         with:
           version: 0.43.0
@@ -50,24 +50,13 @@ jobs:
             exit 1
           fi
 
-  opa-1-20:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - uses: open-policy-agent/setup-opa@v2
-        with:
-          version: 1.20.2
-      - run: opa check --strict . --ignore .github
-      - run: opa fmt --list --fail .
-      - run: opa test . --ignore .github --timeout 120s
-
   wasm:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
       - uses: open-policy-agent/setup-opa@v2
         with:
-          version: 1.19.0
+          version: 1.20.2
       - name: Run the tests compiled to Wasm
         run: opa test . --ignore .github --target wasm --timeout 120s
 
@@ -77,7 +66,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: open-policy-agent/setup-opa@v2
         with:
-          version: 1.19.0
+          version: 1.20.2
       - uses: actions/setup-node@v7
         with:
           node-version: 24
@@ -92,7 +81,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: open-policy-agent/setup-opa@v2
         with:
-          version: 1.19.0
+          version: 1.20.2
       - name: Check every rule a case cites exists, and every rule has a case
         run: python3 spec/check_rules.py
       - name: Check the corpus JSON matches the markdown

AGENTS.md

@@ -41,18 +41,12 @@ The `regal lint` command runs [Regal](https://www.openpolicyagent.org/projects/r
 
 OPA loads every JSON and YAML file it finds as data. The workflow files under `.github` clash with each other, so the checks ignore that folder.
 
-CI runs these checks on pull requests and on pushes to `main` (`.github/workflows/test.yml`), using the OPA version the README names and Regal 0.43.0. When you change the OPA version, change it in the README, in every job of the workflow and in the Docker command below.
-
-A second job runs `opa check --strict`, `opa fmt --list` and `opa test` with OPA 1.20.2, the version the Kosli CLI embeds. Repos that copy `ergo.rego` lint their copy with it, and the two versions don't always format the same way. To run them yourself:
-
-```sh
-docker run --rm -v "$PWD":/src:ro -w /src openpolicyagent/opa:1.20.2 fmt --list .
-```
+CI runs these checks on pull requests and on pushes to `main` (`.github/workflows/test.yml`), using the OPA version the README names and Regal 0.43.0. That's OPA 1.20.2, the version the Kosli CLI embeds. When you change the OPA version, change it in the README, in `CONTRIBUTING.md`, in every job of the workflow, in the Docker command below and in `opaVersion` in `site/hugo.toml`.
 
 CI also runs every test compiled to Wasm, with `opa test . --ignore .github --target wasm --timeout 120s`, because Wasm walks objects and sets in a different order from `opa eval`, so anything that ends up in the report has to be sorted. That needs the Linux build of OPA. The macOS one says `engine not found`, so on a Mac run it in Docker:
 
 ```sh
-docker run --rm -v "$PWD":/src:ro -w /src openpolicyagent/opa:1.19.0 test . --ignore .github --target wasm --timeout 120s
+docker run --rm -v "$PWD":/src:ro -w /src openpolicyagent/opa:1.20.2 test . --ignore .github --target wasm --timeout 120s
 ```
 
 CI also runs every test with OPA's JavaScript runtime, `@open-policy-agent/opa-wasm` (`.github/wasm-js.cjs`), because that runtime brings its own versions of some built-ins, like a `sprintf` that formats lists and objects differently, and lacks others. The script compiles each test as a Wasm entrypoint, fails if ergo uses a built-in the runtime doesn't have (apart from `time.parse_rfc3339_ns`, which it passes in, as `REFERENCE.md` tells Wasm users to), and then runs every test. It also fails if `ergo.report` or `ergo.violations` needs any built-in that OPA's Wasm build runs outside the module. OPA reads the arguments of those built-ins back as Rego, so a string holding a byte-order mark fails the whole evaluation. `time.parse_rfc3339_ns` is allowed because ergo only passes it strings that already match the RFC 3339 pattern. If you add a function for users to call, add it to the entrypoint the script writes, so the check covers it. `sprintf` is one of them, so build text with `concat` instead. `concat` takes only strings, so write anything else with `_text` first. Last, it builds one report on 100 deployments and fails if that uses more than 20 MB of Wasm memory. Wasm doesn't cache function calls and frees nothing until the report is done, so something worked out again for every row shows up there long before it slows down `opa eval`.

CONTRIBUTING.md

@@ -12,7 +12,7 @@ If the bug lets a check pass when it should fail, or you think it's a security p
 
 ## Making a change
 
-You'll need [OPA](https://www.openpolicyagent.org/docs/#1-download-opa) 1.19 and [Regal](https://www.openpolicyagent.org/projects/regal) 0.43.0. Some checks also need Docker.
+You'll need [OPA](https://www.openpolicyagent.org/docs/#1-download-opa) 1.20.2 and [Regal](https://www.openpolicyagent.org/projects/regal) 0.43.0. Some checks also need Docker.
 
 [`AGENTS.md`](AGENTS.md) has the full rules and the commands CI runs. It's written for coding agents, but it's the same guide for people. In short:
 

README.md

@@ -6,7 +6,7 @@ ergo is brand new and still changing a lot before its first alpha, so expect bre
 
 ergo is a single Rego file, so using it is as simple as copying it into your project.
 
-You'll need [OPA](https://www.openpolicyagent.org/docs/#1-download-opa) to run it. We test ergo with OPA 1.19 and 1.20.2. Older versions may not load it: OPA 1.2, for example, stops with `rego_parse_error: unexpected as keyword`. Run `opa version` to see which one you have.
+You'll need [OPA](https://www.openpolicyagent.org/docs/#1-download-opa) 1.20.1 or later to run it, and we test ergo with OPA 1.20.2. Older versions give wrong results or don't load it: OPA 1.19 says `1 >= 100.0` is true, so a check can pass when it should fail, OPA 1.20.0 stops with `panic: illegal value` on `0.0 == 1.5`, and OPA 1.2 stops with `rego_parse_error: unexpected as keyword`. Run `opa version` to see which one you have.
 
 ### 1. Copy the library
 

site/content/bakery.md

@@ -47,7 +47,7 @@ Only batch 001 should pass.
 
 {{< example "baking/plain-rego/baking.rego" "rego" >}}
 
-This is the example's policy with three changes. It reads every batch in the list instead of a single one, so it can say which batch each result is about. The rules need `if`, because OPA 1.19 won't load them without it. And the `contains` helper is renamed `has`, because it clashes with a function OPA now has built in.
+This is the example's policy with three changes. It reads every batch in the list instead of a single one, so it can say which batch each result is about. The rules need `if`, because OPA 1.20 won't load them without it. And the `contains` helper is renamed `has`, because it clashes with a function OPA now has built in.
 
 </div>
 <div class="side--ergo">

site/hugo.toml

@@ -7,7 +7,7 @@ disableKinds = ["taxonomy", "term", "rss"]
   description = "Ergo is an open source language for writing explainable policies. Instead of a binary result, every decision returns an audit report of what was checked, and why it passed or failed."
   repo = "https://github.com/kosli-dev/ergo"
   fork = "https://github.com/kosli-dev/ergo/fork"
-  opaVersion = "1.19"
+  opaVersion = "1.20"
 
 [markup.goldmark.renderer]
   unsafe = true