From 8b72c5aa81dbc4f534d3702b642fd36a8ea92858 Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Thu, 10 Jul 2025 10:08:24 +0100
Subject: [PATCH 1/3] conftest: 0.59.0 -> 0.62.0

Diff: https://github.com/open-policy-agent/conftest/compare/refs/tags/v0.59.0...refs/tags/v0.62.0

Changelog: https://github.com/open-policy-agent/conftest/releases/tag/v0.62.0

Added release note for 0.60.0 breaking change moving to v1 rego by
default.
---
 doc/release-notes/rl-2511.section.md | 2 ++
 pkgs/by-name/co/conftest/package.nix | 6 +++---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index 2c5eb1492217..0ab5bff0f700 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -24,6 +24,8 @@
 
 - `gnome-keyring` no longer ships with an SSH agent anymore because it has been deprecated upstream. You should use `gcr_4` instead, which provides the same features. More information on why this was done can be found on [the relevant GCR upstream PR](https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67).
 
+- `conftest` since `0.60.0` has moved to use rego `v1` as default. To continue using `v0` use `--rego-version v0`. For more information about upgrading to Rego v1 syntax, see the [upstream docs](https://www.openpolicyagent.org/docs/latest/v0-upgrade/).
+
 - `tooling-language-server` has been renamed to `deputy` (both the package and binary), following the rename of the upstream project.
 
 - `lima` package now only includes the guest agent for the host's architecture by default. If your guest VM's architecture differs from your Lima host's, you'll need to enable the `lima-additional-guestagents` package by setting `withAdditionalGuestAgents = true` when overriding lima with this input.
diff --git a/pkgs/by-name/co/conftest/package.nix b/pkgs/by-name/co/conftest/package.nix
index 6878520d44c6..aab67c86bce5 100644
--- a/pkgs/by-name/co/conftest/package.nix
+++ b/pkgs/by-name/co/conftest/package.nix
@@ -9,15 +9,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "conftest";
-  version = "0.59.0";
+  version = "0.62.0";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "conftest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bmZp1cPNTm6m30YxjlWdnfv2437nDXH+taDNFZ0OKIY=";
+    hash = "sha256-6LEzWvnTMSNdMzoStS8cfJxiYCo752e0Js185PGa0y4=";
   };
-  vendorHash = "sha256-aPvGbtAucb9OdcydO4dMLJrrM3XretPI7zyJULlm1fg=";
+  vendorHash = "sha256-Jf9Ui7iHyUZyDLuhI2tjFFawUfKLdcAJUlk79yAqckg=";
 
   ldflags = [
     "-s"

From 7aa90db876d9a402d07a8c85107375b55e143166 Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Thu, 10 Jul 2025 10:10:19 +0100
Subject: [PATCH 2/3] conftest: allow for building completions when
 cross-compiling

---
 pkgs/by-name/co/conftest/package.nix | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/co/conftest/package.nix b/pkgs/by-name/co/conftest/package.nix
index aab67c86bce5..5446094dedec 100644
--- a/pkgs/by-name/co/conftest/package.nix
+++ b/pkgs/by-name/co/conftest/package.nix
@@ -1,10 +1,12 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
   versionCheckHook,
   writableTmpDirAsHomeHook,
+  buildPackages,
 }:
 
 buildGoModule (finalAttrs: {
@@ -29,12 +31,20 @@ buildGoModule (finalAttrs: {
     installShellFiles
   ];
 
-  postInstall = ''
-    installShellCompletion --cmd conftest \
-      --bash <($out/bin/conftest completion bash) \
-      --fish <($out/bin/conftest completion fish) \
-      --zsh <($out/bin/conftest completion zsh)
-  '';
+  postInstall =
+    let
+      conftest =
+        if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
+          placeholder "out"
+        else
+          buildPackages.conftest;
+    in
+    ''
+      installShellCompletion --cmd conftest \
+        --bash <(${conftest}/bin/conftest completion bash) \
+        --fish <(${conftest}/bin/conftest completion fish) \
+        --zsh <(${conftest}/bin/conftest completion zsh)
+    '';
 
   nativeCheckInputs = [
     writableTmpDirAsHomeHook

From 3705087b5488ad3e650be5336ee0ae802d40aab6 Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Thu, 10 Jul 2025 12:06:20 +0100
Subject: [PATCH 3/3] conftest: allow local networking in darwin sandbox for
 testing

---
 pkgs/by-name/co/conftest/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/co/conftest/package.nix b/pkgs/by-name/co/conftest/package.nix
index 5446094dedec..f7ddb73e8bf8 100644
--- a/pkgs/by-name/co/conftest/package.nix
+++ b/pkgs/by-name/co/conftest/package.nix
@@ -13,6 +13,8 @@ buildGoModule (finalAttrs: {
   pname = "conftest";
   version = "0.62.0";
 
+  __darwinAllowLocalNetworking = true; # required for tests
+
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "conftest";