Repository navigation
Feat/rules engine refactor - #753
Merged
Merged
Conversation
Embed built-in rules, preserve local overrides, and make external rule downloads explicit. Standardize verified confidence labels and suppress unverified TruffleHog results when verification is enabled. Update UI, documentation, and regression coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Cross-engine behavior changes need human validation, with unresolved filtering performance and dashboard compatibility issues.
2 open issues
What changed in this PR
Refactors Pipeleek’s rules engine to use embedded defaults and optional local rules, while standardizing detection levels.
Changes:
- Adds explicit rules downloads, validation, and local overrides.
- Migrates confidence levels and updates reporting, UI, and documentation.
- Adds GitLab job-status and pipeline-source filters with tests.
| File | Description |
|---|---|
| tests/e2e/rules/download_test.go | Tests download command behavior. |
| tests/e2e/gitlab/scan/scan_flags_test.go | Tests filtering and configuration precedence. |
| tests/e2e/gitlab/scan/errors_test.go | Tests inaccessible-resource handling. |
| tests/e2e/github/scan/local_rules_test.go | Tests local rules and detection levels. |
| pkg/webui/server.go | Updates confidence displays and notifications. |
| pkg/webui/server_test.go | Tests migrated UI and export levels. |
| pkg/scanner/scanner.go | Removes automatic-download alias. |
| pkg/scanner/scanner_test.go | Updates exported-function checks. |
| pkg/scanner/rules/rules.yaml | Defines embedded GitLab patterns. |
| pkg/scanner/rules/rules.go | Compiles and merges rules. |
| pkg/scanner/rules/rules_test.go | Tests loading, overrides, and boundaries. |
| pkg/scanner/rules/download.go | Implements validated explicit downloads. |
| pkg/scanner/rules/download_test.go | Tests download safety and failures. |
| pkg/scanner/engine/reporting_test.go | Tests verification and confidence filtering. |
| pkg/scanner/engine/engine.go | Centralizes filtering and TruffleHog reporting. |
| pkg/scanner/engine/engine_test.go | Updates confidence expectations. |
| pkg/scanner/engine/betterleaks.go | Migrates verified-result mapping. |
| pkg/scanner/detectors/gitlab_url_detector.go | Reuses embedded token patterns. |
| pkg/scanner/detectors/gitlab_patterns_test.go | Tests shared token matching. |
| pkg/scan/result/levels_test.go | Tests logged detection metadata. |
| pkg/gitlab/scan/pipeline.go | Applies job and pipeline filters. |
| pkg/gitlab/scan/pipeline_test.go | Tests pagination and filtered queues. |
| pkg/gitlab/scan/pipeline_source.go | Validates pipeline sources. |
| pkg/gitlab/scan/pipeline_source_test.go | Tests source parsing. |
| pkg/gitlab/scan/job_status.go | Parses job-status lists. |
| pkg/gitlab/scan/job_status_test.go | Tests status parsing. |
| pkg/config/gen/gen.go | Includes rules-download configuration. |
| internal/cmd/rules/rules.go | Adds rules-download command. |
| internal/cmd/rules/rules_test.go | Tests command wiring. |
| internal/cmd/root.go | Registers rules commands. |
| internal/cmd/gitlab/scan/scan.go | Binds filters and local options. |
| internal/cmd/gitlab/scan/scan_test.go | Tests configuration and timeout parsing. |
| docs/introduction/secrets_verification.md | Documents rules and confidence migration. |
| docs/introduction/configuration.md | Documents new configuration options. |
| docs/guides/scanning.md | Updates detection guidance. |
| docs/guides/gitlab.md | Documents GitLab scan filters. |
Review effort: Balanced
frjcomp
force-pushed
the
feat/rules-engine-refactor
branch
from
October 19, 2026 07:19
47badee to
9bbb412
Compare
Report merged GitLab CI configuration findings as cicd-yaml and link to the CI YAML file. Add the source type to the web UI and regression tests. Consolidate rules documentation and update ELK verified-confidence queries. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Skip excluded YAML patterns before scanning while preserving final cross-engine filtering. Make scan E2E tests independent of legacy downloaded rules and provider verification. Check host Renovate prerequisites and surface launch failures. Simplify verification documentation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Annotate the CI YAML source label and fixed local rules-file read. Print gosec finding details before failing the CI check. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
frjcomp
commented
Oct 19, 2026
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.