ci: add OPA policy test workflow

[marcialwushu]

Summary

• generate and version the DEC-001 Rego policy
• add native Rego tests and an HTTP integration suite using opa run --server
• add an OPA conformance job for pushes and pull requests targeting main
• document the local OPA workflow

Validation

• npm run check
• npm test — 57 passed
• npm run opa:check
• npm run opa:test — 2 passed
• npm run opa:server:test — 4 cases passed
• npm run opa:conformance — 4/4 cases conform

[marcialwushu]

revisado

[Copilot]

Copilot review overview

🟡 Changes recommended

Dot-reference generation produces invalid Rego for accepted input names that are reserved keywords.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Reject Rego reserved keywords in dot-reference input names · New
• Unreference fallback timeout after successful server exit · New

What changed in this PR

Adds generated OPA policies, native/HTTP conformance tests, CI validation, and local workflow documentation.

Changes:

• Generates and versions DEC-001 Rego policy.
• Adds native, HTTP, and CLI conformance testing.
• Runs OPA checks in CI.

File	Description
tests/​conformance.test.mjs	Updates generated Rego expectations.
src/​infrastructure/​opa/​rego-generator.ts	Formats input references and policy indentation.
scripts/​test-opa-server.mjs	Adds HTTP integration tests.
scripts/​generate-opa-policies.mjs	Generates versioned policies from YAML.
package.json	Adds OPA workflow scripts.
opa/​tests/​dec_001_test.rego	Adds native Rego tests.
opa/​policies/​dec_001.rego	Versions the generated DEC-001 policy.
docs/​TESTING.md	Documents local OPA validation.
.github/​workflows/​ci.yml	Adds the OPA/Rego CI job.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.