Panic when creating a bundle with a policy with a single term package

[nikpivkin]

Short description

The documentation says that a single term package is valid and policy packaging without an optimization flag completes successfully. If there is a constraint on the package, it would be nice to return an error.

❯ opa version
Version: 1.0.0
Build Commit: 
Build Timestamp: 
Build Hostname: 
Go Version: go1.23.4
Platform: darwin/arm64
Rego Version: v1

Steps To Reproduce

❯ cat rego/test.rego
# METADATA
# entrypoint: true
package test

foo := true

❯ opa build --optimize 2 rego/test.rego
panic: runtime error: index out of range [1] with length 1

goroutine 1 [running]:
github.com/open-policy-agent/opa/v1/format.(*writer).writePackage(0x14000296b40, 0x140002950e0, {0x0?, 0x8a21?, 0x90?})
        github.com/open-policy-agent/opa/v1/format/format.go:412 +0x224
github.com/open-policy-agent/opa/v1/format.(*writer).writeModule(0x14000296b40, 0x14000296990?)
        github.com/open-policy-agent/opa/v1/format/format.go:379 +0x198
github.com/open-policy-agent/opa/v1/format.AstWithOpts({0x101af7e80?, 0x140002966c0?}, {0xd0?, 0x1400061db60?, 0x1400060f680?, 0xe0?})
        github.com/open-policy-agent/opa/v1/format/format.go:263 +0x7a4
github.com/open-policy-agent/opa/v1/bundle.(*Bundle).FormatModulesForRegoVersion(0x14000419180, 0x3, 0x1, 0x0)
        github.com/open-policy-agent/opa/v1/bundle/bundle.go:1106 +0x144
github.com/open-policy-agent/opa/v1/compile.(*Compiler).Build(0x14000419040, {0x101bae178, 0x1025502a0})
        github.com/open-policy-agent/opa/v1/compile/compile.go:384 +0x368
github.com/open-policy-agent/opa/cmd.dobuild({0x140001a6b10, 0x14000467a70, 0x0, 0x0, 0x2, {{0x0, 0x0, 0x0}, 0x0}, {0x10137b2db, ...}, ...}, ...)
        github.com/open-policy-agent/opa/cmd/build.go:347 +0x88c
github.com/open-policy-agent/opa/cmd.init.1.func2(0x1400040cd00?, {0x1400061d050?, 0x4?, 0x101370eb4?})
        github.com/open-policy-agent/opa/cmd/build.go:240 +0x50
github.com/spf13/cobra.(*Command).execute(0x14000412f08, {0x1400061cff0, 0x3, 0x3})
        github.com/spf13/[email protected]/command.go:989 +0x81c
github.com/spf13/cobra.(*Command).ExecuteC(0x10250c4e0)
        github.com/spf13/[email protected]/command.go:1117 +0x344
github.com/spf13/cobra.(*Command).Execute(0x1023e80c8?)
        github.com/spf13/[email protected]/command.go:1041 +0x1c
main.main()
        github.com/open-policy-agent/opa/main.go:14 +0x24

[ashutosh-narkar]

Able to repro with 1.1.0. Needs further investigation. cc @johanfylling

[johanfylling]

OPA started to panic in v0.69.0, prior to which it would output a bundle with a broken support module:

package <illegal path "data">

test = __result__ {
	__result__ = {"foo": true}
}

IMO, outputting an error (but not a panic) is better than silently outputting a broken bundle. Better, of course, is to make OPA not rearrange the package into an illegal path.

Speculation: this looks to be a side effect of optimization being able to reduce everything inside the entrypoint to a single ground value.