Skip to content

fix(rules): finish the external rules file follow-ups - #97

Merged
Muawiya-contact merged 2 commits into
mainfrom
fix/rules-file-followup
Sep 7, 2026
Merged

fix(rules): finish the external rules file follow-ups#97
Muawiya-contact merged 2 commits into
mainfrom
fix/rules-file-followup

Conversation

@Muawiya-contact

Copy link
Copy Markdown
Member

What & why

Two leftovers from #78, raised in review and small enough that they'd
have cost another round trip on a first-time contributor's PR. #78 is
merged; this lands the remainder.

  • --help told the old story. --rules no longer replaces the whole
    database — with_embedded_protected_rules prepends the embedded
    protected rules so a supplied file can't shadow them. The flag
    description still said "instead of the embedded database", and after
    the README row was corrected it was the only place left claiming it.
  • validate() missed the other way to write a rule that never fires.
    It rejects a pattern that isn't a valid glob, but an empty
    "patterns": [] builds a GlobSet that matches nothing and passed
    validation. That fails exactly the way a bad glob does: silently, and
    only for the rule whose author cared about it. Now rejected, with a
    test.

Validation

  • cargo fmt --all -- --check
  • cargo clippy -p diskern-core -p diskern-cli --all-targets -- -D warnings
  • cargo test -p diskern-core -p diskern-cli — 66 pass, 0 fail

Checklist

  • cargo fmt --all and the required core/CLI clippy validation are clean
  • The required core/CLI test suite passes
  • Commits are small and focused (one logical change each)
  • Doesn't weaken a safety principle (read-only scans, quarantine over deletion, deterministic verdicts)

The flag no longer replaces the whole database: the embedded protected
rules are prepended, so a supplied file cannot shadow them. --help still
promised the old behaviour, and it was the only place left saying so
after the README row was fixed.
An empty pattern list builds a GlobSet that matches nothing, so it fails
exactly the way an invalid glob does — silently, and only for the rule
whose author cared about it. validate() exists to stop a supplied file
from reporting success for a rule that can never fire, and this was the
other way to write one.
@Muawiya-contact Muawiya-contact added rules The safety rules database cli diskern-cli: the terminal frontend labels Sep 7, 2026

@Muawiya-contact Muawiya-contact left a comment

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok

@Muawiya-contact
Muawiya-contact merged commit 3997872 into main Sep 7, 2026
12 checks passed
@Muawiya-contact
Muawiya-contact deleted the fix/rules-file-followup branch September 7, 2026 05:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cli diskern-cli: the terminal frontend rules The safety rules database

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant