Bump github.com/open-policy-agent/opa from 0.69.0 to 0.70.0

Bumps [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) from 0.69.0 to 0.70.0.
- [Release notes](https://github.com/open-policy-agent/opa/releases)
- [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-policy-agent/opa/compare/v0.69.0...v0.70.0)

---
updated-dependencies:
- dependency-name: github.com/open-policy-agent/opa
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

vendor/github.com/open-policy-agent/opa/ast/check.go

@@ -231,7 +231,8 @@ func (tc *typeChecker) checkRule(env *TypeEnv, as *AnnotationSet, rule *Rule) {
 		}
 
 		ref := schemaAnnot.Path
-		if ref == nil && refType == nil {
+		// if we do not have a ref or a reftype, we should not evaluate this rule.
+		if ref == nil || refType == nil {
 			continue
 		}
 

vendor/github.com/open-policy-agent/opa/ast/parser.go

@@ -17,7 +17,7 @@ import (
 	"strings"
 	"unicode/utf8"
 
-	"gopkg.in/yaml.v2"
+	"gopkg.in/yaml.v3"
 
 	"github.com/open-policy-agent/opa/ast/internal/scanner"
 	"github.com/open-policy-agent/opa/ast/internal/tokens"
@@ -780,6 +780,8 @@ func (p *Parser) parseRules() []*Rule {
 	case usesContains:
 		rule.Body = NewBody(NewExpr(BooleanTerm(true).SetLocation(rule.Location)).SetLocation(rule.Location))
 		rule.generatedBody = true
+		rule.Location = rule.Head.Location
+
 		return []*Rule{&rule}
 
 	default:
@@ -2309,12 +2311,10 @@ type rawAnnotation struct {
 	Organizations    []string               `yaml:"organizations"`
 	RelatedResources []interface{}          `yaml:"related_resources"`
 	Authors          []interface{}          `yaml:"authors"`
-	Schemas          []rawSchemaAnnotation  `yaml:"schemas"`
+	Schemas          []map[string]any       `yaml:"schemas"`
 	Custom           map[string]interface{} `yaml:"custom"`
 }
 
-type rawSchemaAnnotation map[string]interface{}
-
 type metadataParser struct {
 	buf      *bytes.Buffer
 	comments []*Comment
@@ -2345,9 +2345,8 @@ func (b *metadataParser) Parse() (*Annotations, error) {
 		var comment *Comment
 		match := yamlLineErrRegex.FindStringSubmatch(err.Error())
 		if len(match) == 2 {
-			n, err2 := strconv.Atoi(match[1])
+			index, err2 := strconv.Atoi(match[1])
 			if err2 == nil {
-				index := n - 1 // line numbering is 1-based so subtract one from row
 				if index >= len(b.comments) {
 					comment = b.comments[len(b.comments)-1]
 				} else {
@@ -2397,7 +2396,7 @@ func (b *metadataParser) Parse() (*Annotations, error) {
 			if err != nil {
 				return nil, err
 			}
-		case map[interface{}]interface{}:
+		case map[string]any:
 			w, err := convertYAMLMapKeyTypes(v, nil)
 			if err != nil {
 				return nil, fmt.Errorf("invalid schema definition: %w", err)
@@ -2446,8 +2445,9 @@ func (b *metadataParser) Parse() (*Annotations, error) {
 	return &result, nil
 }
 
-// augmentYamlError augments a YAML error with hints intended to help the user figure out the cause of an otherwise cryptic error.
-// These are hints, instead of proper errors, because they are educated guesses, and aren't guaranteed to be correct.
+// augmentYamlError augments a YAML error with hints intended to help the user figure out the cause of an otherwise
+// cryptic error. These are hints, instead of proper errors, because they are educated guesses, and aren't guaranteed
+// to be correct.
 func augmentYamlError(err error, comments []*Comment) error {
 	// Adding hints for when key/value ':' separator isn't suffixed with a legal YAML space symbol
 	for _, comment := range comments {
@@ -2601,11 +2601,11 @@ func parseAuthorString(s string) (*AuthorAnnotation, error) {
 	return &AuthorAnnotation{Name: name, Email: email}, nil
 }
 
-func convertYAMLMapKeyTypes(x interface{}, path []string) (interface{}, error) {
+func convertYAMLMapKeyTypes(x any, path []string) (any, error) {
 	var err error
 	switch x := x.(type) {
-	case map[interface{}]interface{}:
-		result := make(map[string]interface{}, len(x))
+	case map[any]any:
+		result := make(map[string]any, len(x))
 		for k, v := range x {
 			str, ok := k.(string)
 			if !ok {
@@ -2617,7 +2617,7 @@ func convertYAMLMapKeyTypes(x interface{}, path []string) (interface{}, error) {
 			}
 		}
 		return result, nil
-	case []interface{}:
+	case []any:
 		for i := range x {
 			x[i], err = convertYAMLMapKeyTypes(x[i], append(path, fmt.Sprintf("%d", i)))
 			if err != nil {

vendor/github.com/open-policy-agent/opa/ast/term.go

@@ -1293,6 +1293,11 @@ func (arr *Array) Elem(i int) *Term {
 	return arr.elems[i]
 }
 
+// Set sets the element i of arr.
+func (arr *Array) Set(i int, v *Term) {
+	arr.set(i, v)
+}
+
 // rehash updates the cached hash of arr.
 func (arr *Array) rehash() {
 	arr.hash = 0
@@ -1306,6 +1311,7 @@ func (arr *Array) set(i int, v *Term) {
 	arr.ground = arr.ground && v.IsGround()
 	arr.elems[i] = v
 	arr.hashs[i] = v.Value.Hash()
+	arr.rehash()
 }
 
 // Slice returns a slice of arr starting from i index to j. -1
@@ -2560,6 +2566,8 @@ func (obj *object) insert(k, v *Term) {
 			}
 
 			curr.value = v
+
+			obj.rehash()
 			return
 		}
 	}
@@ -2584,6 +2592,19 @@ func (obj *object) insert(k, v *Term) {
 	}
 }
 
+func (obj *object) rehash() {
+	// obj.keys is considered truth, from which obj.hash and obj.elems are recalculated.
+
+	obj.hash = 0
+	obj.elems = make(map[int]*objectElem, len(obj.keys))
+
+	for _, elem := range obj.keys {
+		hash := elem.key.Hash()
+		obj.hash += hash + elem.value.Hash()
+		obj.elems[hash] = elem
+	}
+}
+
 func filterObject(o Value, filter Value) (Value, error) {
 	if filter.Compare(Null{}) == 0 {
 		return o, nil