Member collisions policies: id, value, const name

[lmolkova]

Fixes #2448

Related to #2455

Blocked on open-telemetry/weaver#812

[lmolkova]

I can never understand the difference between not obj.prop vs obj.prop == null vs this hack. For whatever reason this works and not obj.prop, obj.prop == null don't 😿

[Copilot]

Pull Request Overview

This PR extends the registry policy to catch duplicate definitions and adds tests for those collision scenarios.

• Adds Rego rules to enforce unique attribute names and unique member IDs, values (excluding deprecated), and constant names
• Introduces to_const_name and is_property_set helpers and corresponding tests in registry_test.rego

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
policies/registry.rego	New deny rules for duplicate attribute names and member ID/value/const-name collisions; helper functions added
policies_test/registry_test.rego	Tests covering member ID, member value (with/without deprecated), and const-name collision cases

Comments suppressed due to low confidence (2)

policies_test/registry_test.rego:61

• [nitpick] We’ve added a rule to detect duplicate attribute names, but there’s no test covering this case. Please add a registry_test that defines the same attribute twice and asserts before_resolution.deny catches it.

test_attribute_requirement_levels if {

policies/registry.rego:97

• The attr.name field is not defined on attributes. You should use attr.id or derive the full name via get_attribute_name(attr, group).

    name := attr.name

[Copilot]

The attribute-duplicate rule applies to every group. To match other member-collision rules, add a filter like startswith(group.id, "registry.") so non-registry groups aren’t inadvertently flagged.

Suggested change

	group := input.groups[_]
	group := input.groups[_]
	startswith(group.id, "registry.")

[lmolkova]

replaced by #2477