autonomy policy build

Build a policy bundle .tar.gz from a directory of .rego files

Synopsis

Compiles all .rego files in --in into a versioned bundle archive at --out.

The archive contains:
  manifest.json  — version, required runtime range, content hash, name, timestamp
  *.rego         — all Open Policy Agent source files from --in

The inner manifest's policy_frontend field declares which authoring
frontend produced the Rego (#747 C04). Defaults to empty (resolves to
"rego" for legacy compat); set --policy-frontend yaml-dsl when
bundling output from autonomy policy compile-yaml so downstream
explainability + provenance audits can distinguish hand-authored Rego
from YAML-compiled Rego.

Example:
  autonomy policy build --in ./policies --out bundle.tar.gz --version 1.2.0 \
    --runtime-version ">=0.1.0 <2.0.0"

  autonomy policy compile-yaml policy.yaml --out compiled/policy.rego
  autonomy policy build --in compiled --out bundle.tar.gz --version 1.0.0 \
    --policy-frontend yaml-dsl

Usage

autonomy policy build [flags]

Options

      --in string                source directory containing .rego files (default: .)
      --name string              bundle name (default: basename of --in)
      --out string               output .tar.gz path (default: bundle.tar.gz)
      --policy-frontend string   authoring frontend the Rego came from: "rego" (default), "yaml-dsl", "json-rules", or "graph". Stamped on the inner manifest's policy_frontend field for provenance.
      --runtime-version string   required runtime semver range, e.g. ">=0.1.0 <2.0.0" (default: no constraint)
      --version string           bundle semver version (required)

Options inherited from parent commands

      --require-signed-manifest   Refuse to start if the SHA256SUMS release manifest or its cosign signature is missing/invalid (Tier 2 binary-integrity check; default: build-time compile-in via -ldflags -X, build-hardened artifacts=true, all others=false)

See also