Build OPA bundle
opa_bundle_buildBuild deployable OPA bundles from policy and data paths, producing a .tar.gz archive with optional signing, optimization, custom revision, and WASM target.
Instructions
Build a deployable bundle from policy / data paths using opa build. Output is a .tar.gz archive with optional inline signing. Supports optimization, custom revision strings, and the WASM target.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| paths | Yes | Policy / data paths to include. Each must be in an allowed root. | |
| bundle | No | Load `paths` as bundle files or root directories (`--bundle`). Implied by `signingKey` and `verificationKey`; set it explicitly to rebuild an existing bundle without signing. | |
| ignore | No | File/directory name patterns to ignore during loading (`--ignore`), e.g. `[".*"]` to skip hidden files. These are name patterns, not filesystem paths. | |
| output | Yes | Output bundle path (typically `*.tar.gz`). Must be in an allowed root. | |
| target | No | Build target (default `rego`; `wasm` compiles to WebAssembly). | |
| optimize | No | Optimization level (0 = none, 2 = aggressive). | |
| revision | No | Bundle revision string written to the manifest. | |
| claimsFile | No | Path to a claims file for inline signing. | |
| signingAlg | No | Signing algorithm (e.g. RS256). | |
| signingKey | No | Path to a PEM private key for signing the built bundle (`--signing-key`). Implies `bundle: true`, which OPA requires for signing. | |
| entrypoints | No | Entrypoint refs (required when `target=wasm` or `optimize > 0`). | |
| pruneUnused | No | Exclude dependents of entrypoints that are not reachable from them (`--prune-unused`). Most useful alongside `entrypoints`. | |
| capabilities | No | Path to a capabilities JSON file. | |
| v1Compatible | No | Opt in to OPA v1.0-compatible behaviors (`--v1-compatible`). Affects the built bundle's runtime semantics. | |
| verificationKey | No | Path to a PEM public key (or HMAC secret file) used to re-verify an existing signed bundle during the build (`--verification-key`). Implies `bundle: true`, which OPA requires for verification. | |
| verificationKeyId | No | Key ID for verification (`--verification-key-id`, OPA default `default`). |