undefinedChainloopBuiltins extracts chainloop.* function names from OPA undefined-function type errors. Returns nil if the error doesn't involve any chainloop builtins (e.g., intentionally blocked OPA functions like opa.runtime or trace still produce hard errors).
(err error)
| 690 | // any chainloop builtins (e.g., intentionally blocked OPA functions like |
| 691 | // opa.runtime or trace still produce hard errors). |
| 692 | func undefinedChainloopBuiltins(err error) []string { |
| 693 | matches := undefinedChainloopBuiltinRe.FindAllStringSubmatch(err.Error(), -1) |
| 694 | if len(matches) == 0 { |
| 695 | return nil |
| 696 | } |
| 697 | names := make([]string, 0, len(matches)) |
| 698 | for _, m := range matches { |
| 699 | names = append(names, m[1]) |
| 700 | } |
| 701 | return names |
| 702 | } |
| 703 | |
| 704 | // LoadPolicySpec loads and validates a policy spec from a contract |
| 705 | func (pv *PolicyVerifier) loadPolicySpec(ctx context.Context, attachment *v1.PolicyAttachment) (*v1.Policy, *PolicyDescriptor, error) { |