Thesis: On opa 1.20 the argument ./... is a path, not a walk. The CLI tries to open it, and it is not a directory. opa test . walks the tree. A deny case is still a test: it passes when the policy emits the message the test expects. A command that never evaluates the policy is not evidence.
What we tried first
The README said opa test ./..., the way a Go tree is walked. We ran it from the repository root. The error was stat ./...: no such file or directory. The policies were sitting next to the command. They were never loaded.
The working shape
opa test . from the repository root. The deny tests still run. They pass when the policy emits the message they expect.
opa test ./... → stat error, no tests ran
opa test . → walk the treeChecklist
- Do not document a Go wildcard as an opa path.
- Run opa test . and expect the deny cases to pass as tests.
The policies are in the public sample. How we deliver: methodology.
Engineering commentary only — not audit, legal, or certification advice.