allow to specify absolute paths with conftest pull

[sebhoss]

When calling conftest pull oci://... --policy <DIR> conftest always assumes that <DIR> is a relative path to the current working directory. This is troubling because conftest test --policy <DIR> just takes the <DIR> as-is and thus cannot find the downloaded policies.

Reproduce with:

$ SOME_DIR=$(mktemp -d)
$ conftest pull oci://... --policy $SOME_DIR/conftest
$ helm template ... | conftest test --policy $SOME_DIR/conftest -
Error: running test: load: loading policies: load: 1 error occurred during loading: stat /tmp/tmp.feEnr57lWT/conftest: no such file or directory

$ tree ./tmp
./tmp
└── tmp.feEnr57lWT
    └── conftest
        └── ...

Notice that I've used ./tmp in the last shell command and not /tmp.

[boranx]

I think it's doable but you'd need the same feature for conftest test as well to be able to run them for the next step, right?

[sebhoss]

conftest test already loads policies from absolute paths just fine, e.g. this works:

conftest test --policy /absolute/path/to/my/policies ...`

this does not:

conftest pull oci://... --policy /absolute/path/to/my/policies
conftest test --policy /absolute/path/to/my/policies ...`

The second example does not work because conftest pull writes the downloaded policies into $(pwd)/absolute/path/to/my/policies instead of /absolute/path/to/my/policies.

[synack-badamson]

+1 to this. I can use absolute paths when I use conftest test but not conftest pull.
https://github.com/open-policy-agent/conftest/blob/master/internal/commands/pull.go#L69
The . forces it to be relative.

[boranx]

then yeah +1 from me to implement it for conftest pull to have a similar experience with test.
Still, it might be nice to put this behind a flag for pull to keep the default behavior, instead of a breaking change
We'd welcome a PR anyways, thanks