allow {
 input.owner == true
}

# All other users may do anything other than call PutObject
allow {
 input.action != "s3:PutObject"
 input.owner == false
}
EOF
```

Then load the policy via OPA's REST API.

```
curl -X PUT --data-binary @example.rego \
  localhost:8181/v1/policies/putobject
```

### 4. Setup MinIO with OPA

          # repo_token: ${{ secrets.SCORECARD_TOKEN }}

          # Public repositories:
          #   - Publish results to OpenSSF REST API for easy access by consumers
          #   - Allows the repository to include the Scorecard badge.
          #   - See https://github.com/ossf/scorecard-action#publishing-results.
          # For private repositories:

          script: |
            const output = `
            Some bad merge is found:
            \`\`\`
            ${{ env.OUTPUT }}
            \`\`\`
            `;
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })

	res, err := s3.client.PutObject(ctx, s3.Bucket, s3.getDest(object), r, length, minio.PutObjectOptions{
		SendContentMd5: true,
		StorageClass:   s3.StorageClass,
		UserMetadata:   meta,
	})
	return remoteVersionID(res.VersionID), s3.ToObjectError(err, object)
}

                                final BulkItemResponse resp = items[i];
                                if (resp.isFailed() && resp.getFailure() != null) {
                                    final Map<String, Object> req = docList.get(i);
                                    final Failure failure = resp.getFailure();

func (d *dataUsageCache) findChildrenCopy(h dataUsageHash) dataUsageHashMap {
	ch := d.Cache[h.String()].Children
	res := make(dataUsageHashMap, len(ch))
	for k := range ch {
		res[k] = struct{}{}
	}
	return res
}

// searchParent will search for the parent of h.
// This is an O(N*N) operation if there is no parent or it cannot be guessed.

	VZEXTVF2	V2, V0, V3, V4			// ERROR "expected no register in rs3"
	VZEXTVF2	X10, V3				// ERROR "expected vector register in vs2 position"
	VSEXTVF2	V2, V0, V3, V4			// ERROR "expected no register in rs3"
	VSEXTVF2	X10, V3				// ERROR "expected vector register in vs2 position"
	VZEXTVF4	V2, V0, V3, V4			// ERROR "expected no register in rs3"
	VZEXTVF4	X10, V3				// ERROR "expected vector register in vs2 position"

	var res []auth.Credentials
	for _, u := range cache.iamUsersMap {
		cred := u.Credentials
		if cred.IsServiceAccount() {
			res = append(res, cred)
		}
	}
	for _, u := range cache.iamSTSAccountsMap {
		res = append(res, u.Credentials)
	}

	return res
}

// UpdateUserIdentity - updates a user credential.

  # $TF_VER_FULL will resolve to e.g. "2.15.0-rc2". Since $TF_VER_FULL comes
  # from get_versions.sh, which must be run *after* update_version.py, FINAL_URI
  # can't be set inside the rest of the _upload envs.
  FINAL_URI="$TFCI_ARTIFACT_FINAL_GCS_URI/$TF_VER_FULL"
  gsutil -m rsync -d -r "$DOWNLOADS" "$FINAL_URI"

  # Also mirror the latest-uploaded folder to the "latest" directory.

            return null;
        }

        List<MetadataGraphEdge> res = new ArrayList<>(edges.size());

        for (MetadataGraphEdge e : edges) {
            if (e.getSource().equals(vFrom)) {
                res.add(e);
            }
        }

        return res;
    }
    // ------------------------------------------------------------------------