[Add] Updated conftest to latest version, policies updated, precommit hook also updated

terraform/policy/main.rego

@@ -7,7 +7,7 @@ import input
 vms := [r | r := input.planned_values.root_module.resources[_]; r.type == "proxmox_vm_qemu"]
 
 # Helper function to check if a value is empty or undefined
-is_empty(value) {
+is_empty(value) if {
     value == ""
 } {
     value == null
@@ -19,28 +19,28 @@ is_empty(value) {
 min_memory = 512
 
 # Deny if VM allows password authentication
-deny[msg] {
+deny contains msg if {
     some vm in vms
     not is_empty(vm.values.cipassword)
     msg := sprintf("VM '%s' uses password authentication. Use SSH keys only.", [vm.name])
 }
 
 # Deny if VM allows root login
-deny[msg] {
+deny contains msg if {
     some vm in vms
     vm.values.ciuser == "root"
     msg := sprintf("VM '%s' allows root login. Use a non-root user.", [vm.name])
 }
 
 # Deny if qemu-agent is not enabled
-deny[msg] {
+deny contains msg if {
     some vm in vms
     vm.values.agent != 1
     msg := sprintf("VM '%s' does not have qemu-agent enabled (agent = 1).", [vm.name])
 }
 
 # Deny if VM uses insecure network bridge
-deny[msg] {
+deny contains msg if {
     some vm in vms
     net := vm.values.network[_]
     net.bridge != "vmbr2"
@@ -48,28 +48,28 @@ deny[msg] {
 }
 
 # Deny if IPv6 is not disabled
-deny[msg] {
+deny contains msg if {
     some vm in vms
     not vm.values.skip_ipv6
     msg := sprintf("VM '%s' does not have IPv6 disabled (skip_ipv6 = true).", [vm.name])
 }
 
 # Deny if TLS verification is disabled
-deny[msg] {
+deny contains msg if {
     tls_enabled := input.variables.pm_tls_insecure.value
     tls_enabled == true
     msg := "TLS verification must be enabled (pm_tls_insecure = false)"
 }
 
 # Deny if provider version is not pinned
-deny[msg] {
+deny contains msg if {
     provider := input.configuration.terraform.required_providers.proxmox
     not startswith(provider.version_constraint, "=")
     msg := "Provider version must be pinned with '=' constraint"
 }
 
 # Deny if VM memory is below minimum requirement
-deny[msg] {
+deny contains msg if {
     some vm in vms
     memory := to_number(vm.values.memory)
     memory < min_memory
@@ -77,20 +77,20 @@ deny[msg] {
 }
 
 # Deny if VM does not have a description
-deny[msg] {
+deny contains msg if {
     some vm in vms
     is_empty(vm.values.desc)
     msg := sprintf("VM '%s' must have a description for documentation purposes.", [vm.name])
 }
 
 # Deny if VM uses default SCSI controller
-deny[msg] {
+deny contains msg if {
     some vm in vms
     vm.values.scsihw == "lsi"
     msg := sprintf("VM '%s' uses default SCSI controller. Use virtio-scsi-pci for better performance.", [vm.name])
 }
 
 # Test rule to verify policy is loaded
-test_policy_loaded {
+test_policy_loaded if {
     true
 } 

terraform/policy/policy_test.rego

@@ -109,47 +109,46 @@ mock_input_insecure := {
 }
 
 # Test secure configuration passes
-test_secure_config {
-    input := mock_input_secure
-    count(deny) == 0
+test_secure_config if {
+    count(deny) == 0 with input as mock_input_secure
 }
 
 # Test password authentication
-test_password_auth {
+test_password_auth if {
     deny["VM 'insecure_vm' uses password authentication. Use SSH keys only."] with input as mock_input_insecure
 }
 
 # Test qemu agent
-test_qemu_agent {
+test_qemu_agent if {
     deny["VM 'insecure_vm' does not have qemu-agent enabled (agent = 1)."] with input as mock_input_insecure
 }
 
 # Test network bridge
-test_network_bridge {
+test_network_bridge if {
     deny["VM 'insecure_vm' uses insecure network bridge 'vmbr0'. Use 'vmbr2'."] with input as mock_input_insecure
 }
 
 # Test TLS verification
-test_tls_verification {
+test_tls_verification if {
     deny["TLS verification must be enabled (pm_tls_insecure = false)"] with input as mock_input_insecure
 }
 
 # Test provider version pinning
-test_provider_version {
+test_provider_version if {
     deny["Provider version must be pinned with '=' constraint"] with input as mock_input_insecure
 }
 
 # Test minimum memory requirement
-test_minimum_memory {
+test_minimum_memory if {
     deny["VM 'insecure_vm' has insufficient memory (256MB). Minimum required: 512MB."] with input as mock_input_insecure
 }
 
 # Test VM description requirement
-test_vm_description {
+test_vm_description if {
     deny["VM 'insecure_vm' must have a description for documentation purposes."] with input as mock_input_insecure
 }
 
 # Test SCSI controller requirement
-test_scsi_controller {
+test_scsi_controller if {
     deny["VM 'insecure_vm' uses default SCSI controller. Use virtio-scsi-pci for better performance."] with input as mock_input_insecure
 }

terraform/policy/test.json

@@ -1,47 +0,0 @@
-{
-  "planned_values": {
-    "root_module": {
-      "resources": [
-        {
-          "type": "proxmox_vm_qemu",
-          "name": "insecure_vm",
-          "values": {
-            "cipassword": "password123",
-            "ciuser": "root",
-            "agent": 0,
-            "network": [
-              {
-                "bridge": "vmbr0"
-              }
-            ],
-            "skip_ipv6": false,
-            "memory": 256,
-            "desc": "",
-            "scsihw": "lsi",
-            "cpu": "",
-            "backup": false,
-            "tags": ""
-          }
-        }
-      ]
-    }
-  },
-  "configuration": {
-    "provider_config": {
-      "proxmox": {
-        "expressions": {
-          "pm_tls_insecure": {
-            "constant_value": true
-          }
-        }
-      }
-    },
-    "terraform": {
-      "required_providers": {
-        "proxmox": {
-          "version_constraint": "~2.9.14"
-        }
-      }
-    }
-  }
-}