conftest verify with 'not' always fails about conftest HOT 2 CLOSED

This looks similar to #781 (comment)

deny_deployments_without_probes will always exist. It will either contain violation messages (non-empty set) or not contain violation messages (empty set).

You need to assert against the size of the set or assert if a specific violation exists in the set.

Alternatively, and what I personally do, you could refactor out the main logic of your policy into another rule and have your deny_... block just call that rule and handle all of the messaging.

For example:

deny[msg] {
  not my_policy
  msg := "my policy violated"
}

my_policy {
  // main policy definition
}

This also enables you to focus your tests purely on the policy and allows you to test for not my_policy

from conftest.

Resolved in #801

from conftest.