conftest: 0.59.0 -> 0.62.0 (#423994)

doc/release-notes/rl-2511.section.md

@@ -24,6 +24,8 @@
 
 - `gnome-keyring` no longer ships with an SSH agent anymore because it has been deprecated upstream. You should use `gcr_4` instead, which provides the same features. More information on why this was done can be found on [the relevant GCR upstream PR](https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67).
 
+- `conftest` since `0.60.0` has moved to use rego `v1` as default. To continue using `v0` use `--rego-version v0`. For more information about upgrading to Rego v1 syntax, see the [upstream docs](https://www.openpolicyagent.org/docs/latest/v0-upgrade/).
+
 - `tooling-language-server` has been renamed to `deputy` (both the package and binary), following the rename of the upstream project.
 
 - `lima` package now only includes the guest agent for the host's architecture by default. If your guest VM's architecture differs from your Lima host's, you'll need to enable the `lima-additional-guestagents` package by setting `withAdditionalGuestAgents = true` when overriding lima with this input.

pkgs/by-name/co/conftest/package.nix

@@ -1,23 +1,27 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
   versionCheckHook,
   writableTmpDirAsHomeHook,
+  buildPackages,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "conftest";
-  version = "0.59.0";
+  version = "0.62.0";
+
+  __darwinAllowLocalNetworking = true; # required for tests
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "conftest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bmZp1cPNTm6m30YxjlWdnfv2437nDXH+taDNFZ0OKIY=";
+    hash = "sha256-6LEzWvnTMSNdMzoStS8cfJxiYCo752e0Js185PGa0y4=";
   };
-  vendorHash = "sha256-aPvGbtAucb9OdcydO4dMLJrrM3XretPI7zyJULlm1fg=";
+  vendorHash = "sha256-Jf9Ui7iHyUZyDLuhI2tjFFawUfKLdcAJUlk79yAqckg=";
 
   ldflags = [
     "-s"
@@ -29,12 +33,20 @@ buildGoModule (finalAttrs: {
     installShellFiles
   ];
 
-  postInstall = ''
-    installShellCompletion --cmd conftest \
-      --bash <($out/bin/conftest completion bash) \
-      --fish <($out/bin/conftest completion fish) \
-      --zsh <($out/bin/conftest completion zsh)
-  '';
+  postInstall =
+    let
+      conftest =
+        if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
+          placeholder "out"
+        else
+          buildPackages.conftest;
+    in
+    ''
+      installShellCompletion --cmd conftest \
+        --bash <(${conftest}/bin/conftest completion bash) \
+        --fish <(${conftest}/bin/conftest completion fish) \
+        --zsh <(${conftest}/bin/conftest completion zsh)
+    '';
 
   nativeCheckInputs = [
     writableTmpDirAsHomeHook