opa test: Unit-Test Rego Policies
opa test policy/ runs every test_ rule in your Rego and exits non-zero if any test fails.
opa test is the built-in test runner for Rego. Run it in CI so policy changes are validated by their own tests before they gate real config.
What it does
opa test loads a directory of Rego, finds rules named test_..., evaluates each, and reports PASS/FAIL. It supports coverage reporting and a coverage threshold that fails the run if not met. Exit code is non-zero when any test fails.
Common usage
# run all policy tests
opa test policy/
# verbose output showing each test
opa test -v policy/
# enforce a coverage floor
opa test --coverage --threshold 80 policy/Options
| Flag | What it does |
|---|---|
| -v, --verbose | Show each test result, not just failures |
| --coverage | Report Rego line coverage |
| --threshold <n> | Fail if coverage is below n percent |
| -r, --run <regex> | Only run tests matching the regex |
| --bench | Benchmark the tests instead of asserting |
| -f, --format pretty|json | Output format |
In CI
Run opa test policy/ as a required step so a broken policy test fails the pipeline (it already exits non-zero on failure). Add --coverage --threshold N to block merges that drop policy coverage, and -v so the log shows which test failed.
Common errors in CI
A failure prints FAIL: policy/deny_test.rego:12: data.main.test_deny_root and a summary line. rego_parse_error is a syntax error in a test or policy file. Code coverage threshold not met: 62.50 < 80.00 means --threshold failed. no test cases found means no rule name starts with test_; check the naming.