Create new Rego setup phase preceeding lint evalutation

[anderseknert]

I don't think it's a goal we're touting anywhere, but given the overarching goals of the project it should go without saying that if we can do something either in Go or Rego, we'll do it in Rego. There's currently a few things we either do in Go, or do both in Go and Rego, that could be done only in Rego:

• Parsing and merging of provided / user configuration
• Filtering of files / ignores
• Parsing of input policies

Could be that the last step is too expensive to do in Rego (and regal.parse_module) but the two other steps would be cheaper to do in a pre-lint step even in Rego, as we currently do at least some parts of config evaluation per input file. This is redundant, of course, as the config doesn't change between input files, and should really only be calculated once.

Another benefit of providing a pre-lint evaluation phase executed in Rego is that policy authors — similarly to when they provide custom rules — could provide custom logic for what to do before linting, and have whatever data collected in that step provided as part of the input when running the lint phase.

[anderseknert]

I think we'll have to leave parsing out of this, even though I'd love to do that using regal.parse_module. The Go machinery for parsing parallelizes the process across all the input files, and doing this serially in Rego would likely be a too hard hit on initialization time. Anything related to configuration and overrides should still be done here though!

[anderseknert]

Adding to the list — querying each rule for notices, and return back the result so that rules can be disabled conditionally based on those. This works today already, but for each linted file, a list like this is returned:

  "notices": [
    {
      "category": "bugs",
      "description": "Since OPA 1.0, deprecated-builtin enabled only when provided a v0 policy,\nBUT please note that this may change in the future if new built-in functions\nare deprecated.\n",
      "level": "notice",
      "severity": "none",
      "title": "deprecated-builtin"
    },
    {
      "category": "bugs",
      "description": "Since OPA 1.0, rule-named-if enabled only when provided a v0 policy",
      "level": "notice",
      "severity": "none",
      "title": "rule-named-if"
    },
    {
      "category": "idiomatic",
      "description": "Since OPA 1.0, use-contains enabled only when provided a v0 policy",
      "level": "notice",
      "severity": "none",
      "title": "use-contains"
    },
    {
      "category": "idiomatic",
      "description": "Since OPA 1.0, use-if enabled only when provided a v0 policy",
      "level": "notice",
      "severity": "none",
      "title": "use-if"
    },
    {
      "category": "imports",
      "description": "Since OPA 1.0, import-shadows-import enabled only when provided a v0 policy,",
      "level": "notice",
      "severity": "none",
      "title": "import-shadows-import"
    },
    {
      "category": "imports",
      "description": "Since OPA 1.0, use-rego-v1 enabled only when provided a v0 policy",
      "level": "notice",
      "severity": "none",
      "title": "use-rego-v1"
    }
  ],

I guess the "when provided a v0 policy" will sometimes still have to be decided per input file, but not in the case where a whole project is configured for v1.