ci(opa): migrate to setup-opa action, pin runner and OPA version

- Replace manual wget + chmod install with the official
  open-policy-agent/setup-opa@v2.2.0 action (checksum-verified,
  cached, no hardcoded download URL)
- Bump OPA from v0.43.0 to v1.6.0 (static binary, matching prior
  behavior via `static: true`)
- Upgrade actions/checkout from v2 to v7
- Pin runner to ubuntu-24.04 instead of floating ubuntu-latest
- Add contents:read permissions and PR concurrency cancellation
- Scope trigger to argocd-helm-charts/gatekeeper/policies/** via
  paths filter, add reopened to trigger types
- Remove dead `if: github.event_name == 'pull_request'` condition
  (job already only runs on pull_request)

Note: OPA v1.x defaults to Rego v1 syntax, a breaking change from
the v0.43.0 baseline. Verify `opa test` passes against existing
.rego policies before merging; if failures are syntax-related
rather than genuine test failures, policies may need migration to
v1 Rego syntax or a temporary --v0-compatible flag.

Author: Ahmad-Faizan

.github/workflows/opa-test.yml

@@ -1,25 +1,36 @@
-name: OPA Test
+name: Test OPA Policies
 
-"on":
+on:
   pull_request:
     types:
       - opened
       - synchronize
+      - reopened
+    paths:
+      - 'argocd-helm-charts/gatekeeper/policies/**'
+
+permissions:
+  contents: read
+
+# This will only allow a single markdownlint action to run per PR.
+# Any github action running on the older commits will be aborted.
+concurrency:
+  group: test-opa-${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
 
 jobs:
-  opa-test:
-    runs-on: ubuntu-latest
+  test-opa:
+    runs-on: ubuntu-24.04
 
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v2
+      - name: Checkout code
+        uses: actions/checkout@v7
 
-    - name: Install OPA
-      run: |
-        wget https://github.com/open-policy-agent/opa/releases/download/v0.43.0/opa_linux_amd64_static -O /usr/local/bin/opa
-        chmod +x /usr/local/bin/opa
+      - name: Setup OPA
+        uses: open-policy-agent/setup-opa@v2.2.0
+        with:
+          version: "1.6.0"
+          static: true
 
-    - name: Run OPA tests
-      if: ${{ github.event_name == 'pull_request' }}
-      run: |
-        opa test ./argocd-helm-charts/gatekeeper/policies -v
+      - name: Run OPA tests
+        run: opa test ./argocd-helm-charts/gatekeeper/policies -v

argocd-helm-charts/gatekeeper/policies/K8sRequiredResources.rego

@@ -1,6 +1,7 @@
 # package k8srequiredresources handles compliance of containers and initContainers
 # having a predefined resource limits and requests of cpu and memory.
 # Objects that do not specify the resource limits and requests show up as violators of the policy.
+# Test comment
 
 package k8srequiredresources