Ensure unused-output-variable actually is output variable (#925)

Found when testing this against some policies in the wild

Signed-off-by: Anders Eknert <anders@styra.com>

Author: anderseknert

README.md

@@ -703,7 +703,7 @@ in the near future:
 
 - [ ] Make "Check on save" unnecessary by allowing diagnostics to include
       [compilation errors](https://github.com/StyraInc/regal/issues/745)
-- [ ] Add Code Lens to "Evaluate" any rule or package
+- [ ] Add Code Lens to "Evaluate" any rule or package (VS Code only, initially)
 - [ ] Implement [Signature Help](https://github.com/StyraInc/regal/issues/695) feature
 
 The roadmap is updated when all the current items have been completed.

bundle/regal/rules/bugs/unused_output_variable.rego

@@ -33,6 +33,10 @@ report contains violation if {
 	not _var_in_head(input.rules[to_number(rule_index)].head, var.value)
 	not _var_in_call(ast.function_calls, rule_index, var.value)
 
+	# this is by far the most expensive condition to check, so only do
+	# so when all other conditions apply
+	ast.is_output_var(input.rules[to_number(rule_index)], var, var.location)
+
 	violation := result.fail(rego.metadata.chain(), result.ranged_location_from_text(var))
 }
 

bundle/regal/rules/bugs/unused_output_variable_test.rego

@@ -107,3 +107,27 @@ test_success_not_unused_output_variable_other_ref if {
 	r := rule.report with input as module
 	r == set()
 }
+
+test_success_not_output_variable_rule if {
+	module := ast.with_rego_v1(`
+	x := 1
+
+	success := x if {
+		input[x]
+	}
+	`)
+
+	r := rule.report with input as module
+	r == set()
+}
+
+test_success_not_output_variable_argument if {
+	module := ast.with_rego_v1(`
+	success(x) if {
+		input[x]
+	}
+	`)
+
+	r := rule.report with input as module
+	r == set()
+}