feat(SIG-107): add Regal policy linting batch

[damartinezjulio]

What

• Add default-on Regal Rego policy linting with a runner-owned high-confidence bug/import profile and pinned binary checksum.
• Move existing zizmor and Hadolint scan bodies into runner scripts so scan.yml stays below the 1k-line file limit.
• Wire Regal through the static tool manifest, SARIF contract, README catalog, and CI test list.

Why

• Adds another CodeRabbit-parity deterministic tool that can improve policy-as-code review signal without executing caller code.
• Frees workflow line budget for the remaining SIG-107 batches while preserving missing-output manifest behavior for existing tool install/download failures.

How verified

• python3 .github/scripts/policy_iac_tools_workflow_test.py
• python3 -m unittest discover -s .github/scripts -p '*_test.py'
• CI test list from .github/workflows/ci.yml, including py_compile
• Workflow YAML parse via temporary PyYAML venv
• actionlint v1.7.12 Darwin binary
• Wrapper smoke checks: no-Rego Regal, no-workflow zizmor, no-Dockerfile Hadolint
• git diff --check
• line count check: scan.yml 957 lines; largest script test 911 lines
• reviewer model re-review: SHIP

[sigilix]

Sigilix Overview

Effort: 3/5 (medium)

Quality gates

• ✅ PR title follows convention
• ✅ PR description is complete
• ℹ️ PR is linked to an issue — No Closes #N / Closes SIG-N keyword found in PR body or commit messages.

Summary — latest push

Adds default-on Regal Rego policy linting with a pinned binary checksum and a runner-owned high-confidence bug/import profile, and extracts the inline zizmor and Hadolint scan steps into standalone runner scripts to keep scan.yml under the 1k-line limit. The Regal integration wires through the static tool manifest, SARIF contract, README catalog, and CI test list. The specialist review found zero findings and approved the change.

Important files

File	Score	Notes	Next step
.github/scripts/run_regal.sh	5/5	New shell script that downloads the pinned Regal binary with SHA256 verification, discovers Rego files while excluding generated/vendor directories, and runs the linter with the Sigilix config before piping output through the SARIF contract.	Add a unit test or mock-based integration test verifying the version-regex and checksum-regex validation branches emit empty SARIF when malformed values are supplied.
.github/scripts/policy_iac_tools_workflow_test.py	4/5	New test suite asserting Regal is default-on in the workflow, that all three policy/IaC tools delegate to runner scripts, and that the Regal wrapper uses the high-confidence profile with specific disabled categories.	Add a test case covering the Regal script's checksum mismatch and download failure fallback paths to confirm they emit empty SARIF.
.github/workflows/scan.yml	3/5	Adds the regal boolean input, pinned version/checksum env vars, the Regal SARIF step, and the REGAL_ENABLED manifest env var; replaces inline zizmor and Hadolint steps with script delegation.	Verify the removed inline zizmor and Hadolint blocks are fully covered by the new runner scripts with no behavioral divergence in error handling.
.github/scripts/run_hadolint.sh	3/5	Extracts the Hadolint scan logic from scan.yml into a standalone script, preserving the download, chmod, file discovery, and SARIF contract pipeline.	Add a checksum verification step for the Hadolint binary download to match the security posture established by the Regal script.
.github/scripts/run_zizmor.sh	2/5	Extracts the zizmor scan logic from scan.yml into a standalone script with the same install-and-scan flow.	Pin the zizmor install with a hash verification step to prevent supply-chain tampering, consistent with the Regal script's approach.

Sequence diagram

sequenceDiagram
    participant CI as scan.yml
    participant Regal as run_regal.sh
    participant Config as regal-sigilix.yaml
    participant SARIF as sigilix_sarif_contract.py
    CI->>Regal: bash run_regal.sh
    Regal->>Regal: discover_rego_files
    Regal->>Regal: download & verify regal binary
    Regal->>Config: load --config-file
    Regal->>Regal: regal lint (SARIF output)
    Regal->>SARIF: normalize regal.raw.sarif → regal.sarif

Loading

Confidence: 4/5

The change is well-structured with comprehensive tests, pinned binary verification, and graceful empty-SARIF fallbacks, though the new shell scripts would benefit from integration tests covering their failure paths.

• run_regal.sh lines 42-43: The version regex ^[0-9]+[.][0-9]+[.][0-9]+$ and checksum regex ^[0-9a-f]{64}$ silently emit empty SARIF on mismatch — confirm this is the desired behavior rather than failing the workflow.
• run_hadolint.sh: Unlike Regal, Hadolint lacks SHA256 checksum verification on the downloaded binary, creating an inconsistent supply-chain security posture.
• scan.yml: The inline zizmor and Hadolint blocks were replaced with script delegation — verify the new scripts handle the set -euo pipefail exit semantics identically, especially the || true on linter invocations.
• run_regal.sh line 80: The --disable-category flags are hardcoded in the script rather than sourced from regal-sigilix.yaml — if the config file is meant to be the single source of truth, these should be removed from the CLI args.

Suggested labels: feature

[coderabbitai]

Warning

Review limit reached

@damartinezjulio, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 36 minutes and 23 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more credits in the billing tab to continue.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 67f1d024-a01f-4f70-abdf-3436c37d9a28

📥 Commits

Reviewing files that changed from the base of the PR and between 157449b and 1b44974.

📒 Files selected for processing (11)

• .github/config/regal-sigilix.yaml
• .github/config/tool-manifest.json
• .github/scripts/policy_iac_tools_workflow_test.py
• .github/scripts/run_hadolint.sh
• .github/scripts/run_regal.sh
• .github/scripts/run_zizmor.sh
• .github/scripts/sigilix_sarif_contract.py
• .github/scripts/sigilix_sarif_test.py
• .github/workflows/ci.yml
• .github/workflows/scan.yml
• README.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sig-107-next-batch

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[damartinezjulio]

Post-merge response to Sigilix overview notes:

• run_regal.sh malformed version/checksum values intentionally emit empty SARIF instead of failing the caller workflow. This matches the runner's best-effort contract: tool failures become empty or missing deterministic evidence, not red caller CI.
• Missing output for delegated zizmor/Hadolint was verified against the manifest/merge contract before merge: enabled missing files are recorded as missing-output, and SARIF merge treats absent per-tool files as empty documents.
• Hadolint/zizmor checksum hardening is a valid follow-up, but this PR preserved their existing behavior while moving the inline blocks into scripts to recover line budget for subsequent SIG-107 batches.
• Regal category disables are intentionally CLI-level because Regal v0.41.1 does not accept category-level level: ignore in config; the runner-owned config still carries the import/migration suppressions.

Validation for commit 1b4497485d0bd6e8f2399ce8aec3d6de2822f274: CI test list + py_compile, full script test discovery, workflow YAML parse, actionlint v1.7.12, wrapper smoke checks, git diff --check, line-count check. All PR checks passed and Sigilix approved.