chore(deps): bump github.com/open-policy-agent/opa from 0.67.1 to 0.68.0

Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 0.67.1 to 0.68.0.
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-policy-agent/opa/compare/v0.67.1...v0.68.0)

---
updated-dependencies:
- dependency-name: github.com/open-policy-agent/opa
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

vendor/github.com/open-policy-agent/opa/ast/annotations.go

@@ -417,7 +417,7 @@ func (a *Annotations) Copy(node Node) *Annotations {
 	return &cpy
 }
 
-// toObject constructs an AST Object from a.
+// toObject constructs an AST Object from the annotation.
 func (a *Annotations) toObject() (*Object, *Error) {
 	obj := NewObject()
 
@@ -556,7 +556,11 @@ func attachAnnotationsNodes(mod *Module) Errors {
 		if a.Scope == "" {
 			switch a.node.(type) {
 			case *Rule:
-				a.Scope = annotationScopeRule
+				if a.Entrypoint {
+					a.Scope = annotationScopeDocument
+				} else {
+					a.Scope = annotationScopeRule
+				}
 			case *Package:
 				a.Scope = annotationScopePackage
 			case *Import:
@@ -596,8 +600,9 @@ func validateAnnotationScopeAttachment(a *Annotations) *Error {
 }
 
 func validateAnnotationEntrypointAttachment(a *Annotations) *Error {
-	if a.Entrypoint && !(a.Scope == annotationScopeRule || a.Scope == annotationScopePackage) {
-		return NewError(ParseErr, a.Loc(), "annotation entrypoint applied to non-rule or package scope '%v'", a.Scope)
+	if a.Entrypoint && !(a.Scope == annotationScopeDocument || a.Scope == annotationScopePackage) {
+		return NewError(
+			ParseErr, a.Loc(), "annotation entrypoint applied to non-document or package scope '%v'", a.Scope)
 	}
 	return nil
 }

vendor/github.com/open-policy-agent/opa/ast/builtins.go

@@ -1181,7 +1181,7 @@ var Split = &Builtin{
 			types.Named("x", types.S).Description("string that is split"),
 			types.Named("delimiter", types.S).Description("delimiter used for splitting"),
 		),
-		types.Named("ys", types.NewArray(nil, types.S)).Description("splitted parts"),
+		types.Named("ys", types.NewArray(nil, types.S)).Description("split parts"),
 	),
 	Categories: stringsCat,
 }
@@ -1247,7 +1247,7 @@ var Trim = &Builtin{
 
 var TrimLeft = &Builtin{
 	Name:        "trim_left",
-	Description: "Returns `value` with all leading instances of the `cutset` chartacters removed.",
+	Description: "Returns `value` with all leading instances of the `cutset` characters removed.",
 	Decl: types.NewFunction(
 		types.Args(
 			types.Named("value", types.S).Description("string to trim"),
@@ -1273,7 +1273,7 @@ var TrimPrefix = &Builtin{
 
 var TrimRight = &Builtin{
 	Name:        "trim_right",
-	Description: "Returns `value` with all trailing instances of the `cutset` chartacters removed.",
+	Description: "Returns `value` with all trailing instances of the `cutset` characters removed.",
 	Decl: types.NewFunction(
 		types.Args(
 			types.Named("value", types.S).Description("string to trim"),
@@ -1356,7 +1356,7 @@ var RenderTemplate = &Builtin{
 // Marked non-deterministic because it relies on RNG internally.
 var RandIntn = &Builtin{
 	Name:        "rand.intn",
-	Description: "Returns a random integer between `0` and `n` (`n` exlusive). If `n` is `0`, then `y` is always `0`. For any given argument pair (`str`, `n`), the output will be consistent throughout a query evaluation.",
+	Description: "Returns a random integer between `0` and `n` (`n` exclusive). If `n` is `0`, then `y` is always `0`. For any given argument pair (`str`, `n`), the output will be consistent throughout a query evaluation.",
 	Decl: types.NewFunction(
 		types.Args(
 			types.Named("str", types.S),
@@ -1750,7 +1750,7 @@ var JSONUnmarshal = &Builtin{
 		types.Args(
 			types.Named("x", types.S).Description("a JSON string"),
 		),
-		types.Named("y", types.A).Description("the term deseralized from `x`"),
+		types.Named("y", types.A).Description("the term deserialized from `x`"),
 	),
 	Categories: encoding,
 }
@@ -1914,7 +1914,7 @@ var YAMLUnmarshal = &Builtin{
 		types.Args(
 			types.Named("x", types.S).Description("a YAML string"),
 		),
-		types.Named("y", types.A).Description("the term deseralized from `x`"),
+		types.Named("y", types.A).Description("the term deserialized from `x`"),
 	),
 	Categories: encoding,
 }
@@ -1951,7 +1951,7 @@ var HexDecode = &Builtin{
 		types.Args(
 			types.Named("x", types.S).Description("a hex-encoded string"),
 		),
-		types.Named("y", types.S).Description("deseralized from `x`"),
+		types.Named("y", types.S).Description("deserialized from `x`"),
 	),
 	Categories: encoding,
 }

vendor/github.com/open-policy-agent/opa/ast/check.go

@@ -60,7 +60,10 @@ func (tc *typeChecker) copy() *typeChecker {
 		WithVarRewriter(tc.varRewriter).
 		WithSchemaSet(tc.ss).
 		WithAllowNet(tc.allowNet).
-		WithInputType(tc.input)
+		WithInputType(tc.input).
+		WithAllowUndefinedFunctionCalls(tc.allowUndefinedFuncs).
+		WithBuiltins(tc.builtins).
+		WithRequiredCapabilities(tc.required)
 }
 
 func (tc *typeChecker) WithRequiredCapabilities(c *Capabilities) *typeChecker {

vendor/github.com/open-policy-agent/opa/ast/index.go

@@ -494,7 +494,7 @@ func (node *trieNode) String() string {
 func (node *trieNode) append(prio [2]int, rule *Rule) {
 	node.rules = append(node.rules, &ruleNode{prio, rule})
 
-	if node.values != nil {
+	if node.values != nil && rule.Head.Value != nil {
 		node.values.Add(rule.Head.Value)
 		return
 	}

vendor/github.com/open-policy-agent/opa/ast/parser.go

@@ -50,6 +50,19 @@ func (v RegoVersion) Int() int {
 	return 0
 }
 
+func (v RegoVersion) String() string {
+	switch v {
+	case RegoV0:
+		return "v0"
+	case RegoV1:
+		return "v1"
+	case RegoV0CompatV1:
+		return "v0v1"
+	default:
+		return "unknown"
+	}
+}
+
 func RegoVersionFromInt(i int) RegoVersion {
 	if i == 1 {
 		return RegoV1
@@ -596,7 +609,12 @@ func (p *Parser) parseImport() *Import {
 
 	path := imp.Path.Value.(Ref)
 
-	if !RootDocumentNames.Contains(path[0]) && !FutureRootDocument.Equal(path[0]) && !RegoRootDocument.Equal(path[0]) {
+	switch {
+	case RootDocumentNames.Contains(path[0]):
+	case FutureRootDocument.Equal(path[0]):
+	case RegoRootDocument.Equal(path[0]):
+	default:
+		p.hint("if this is unexpected, try updating OPA")
 		p.errorf(imp.Path.Location, "unexpected import path, must begin with one of: %v, got: %v",
 			RootDocumentNames.Union(NewSet(FutureRootDocument, RegoRootDocument)),
 			path[0])

vendor/github.com/open-policy-agent/opa/ast/policy.go

@@ -570,7 +570,7 @@ func (pkg *Package) MarshalJSON() ([]byte, error) {
 }
 
 // IsValidImportPath returns an error indicating if the import path is invalid.
-// If the import path is invalid, err is nil.
+// If the import path is valid, err is nil.
 func IsValidImportPath(v Value) (err error) {
 	switch v := v.(type) {
 	case Var:
@@ -1034,16 +1034,22 @@ func (head *Head) setJSONOptions(opts astJSON.Options) {
 
 func (head *Head) MarshalJSON() ([]byte, error) {
 	var loc *Location
-	if head.jsonOptions.MarshalOptions.IncludeLocation.Head {
+	includeLoc := head.jsonOptions.MarshalOptions.IncludeLocation
+	if includeLoc.Head {
 		if head.Location != nil {
 			loc = head.Location
 		}
+
+		for _, term := range head.Reference {
+			if term.Location != nil {
+				term.jsonOptions.MarshalOptions.IncludeLocation.Term = includeLoc.Term
+			}
+		}
 	}
 
 	// NOTE(sr): we do this to override the rendering of `head.Reference`.
 	// It's still what'll be used via the default means of encoding/json
 	// for unmarshaling a json object into a Head struct!
-	// NOTE(charlieegan3): we also need to optionally include the location
 	type h Head
 	return json.Marshal(struct {
 		h