Rule: impossible-not

[anderseknert]

This is a mistake I see devs do every now and then — it just never struck me as something we could try and prevent.

deny contains something if {
    # ...
}

test_deny if {
    not deny with # ...
}

We should flag when not is used on anything but boolean rules / vars. This might not be possible to determine in all cases based on the AST alone, but for the cases where we can, we should.

[anderseknert]

Thinking more about this, and it's certainly an aggregate rule as we'll need to collect info from all packages to try and determine the type of refs. It's totally fine to just include simple rules here as that'll catch the most common mistake which is not being used with multi-value rules — trivial to determine even from the AST.

However, I'm also starting to realize that we'll want to consider an architectural improvement with regards to aggregate rules. The data collected for this rule would pretty much be identical to the data we need to determine unresolved-imports or unused-rules. We should look into an option where several rules are allowed to share data from a single aggregation rather than each having to do their own. Now, separation should still be the default, but not the only option.