Skip to content

Refuse a require_regexp that satisfies itself, which is the same accident going the other way - #74

Merged
HackingGate merged 1 commit into
mainfrom
refuse-self-satisfying-requirement
Aug 20, 2026
Merged

Refuse a require_regexp that satisfies itself, which is the same accident going the other way#74
HackingGate merged 1 commit into
mainfrom
refuse-self-satisfying-requirement

Conversation

@HackingGate

@HackingGate HackingGate commented Aug 20, 2026

Copy link
Copy Markdown
Owner

Follow-on to #73, which covered regexp and stopped there.

The same accident, going the other way

Both are content searches over a corpus that contains the rule's own declaration:

field must find a self-match is
regexp nothing a finding that is always there
require_regexp something a pass that is always there

#73 refused the first. The second is quieter and worse.

Reproduced

A rule requiring Copyright in every file, over a tree with one good file and one bad one:

policy check failed: every-file-carries-a-copyright
every file must carry a copyright line
bad.txt: required pattern not found

policy/principles.toml is not reported -- it carries the word on its own require_regexp line. It meets the requirement by naming it. It is the one file in the corpus that cannot fail this rule, whatever else it does or stops doing, and nothing ever says so.

A loud finding about the wrong file gets read. A file that has exempted itself is never mentioned again.

Now:

policy check error: rule "every-file-carries-a-copyright" has a `require_regexp`
that matches its own declaration ("require_regexp = 'Copyright'"), and it selects
the file that declaration is in. That file satisfies the requirement by naming
it, so it is exempt from this rule forever -- whatever else it does or stops
doing. Exclude the policy file [...]

The message is not shared, deliberately

The three cures are the same. The sentence before them is the opposite: a reader told the file will be reported, when what actually happens is that it is exempt, goes looking for a finding that is not there. SelfMatch carries which direction it is and composes the two halves.

Measured

Same 82 policy files: 11 require_regexp rules, none self-satisfying with the policy file in scope. Nothing that passes today starts failing; the release-binary fleet sweep confirms 0 newly refused.

Verification

  • cargo test -- 551 pass, 0 fail (549 + 2)
  • cargo clippy --all-targets, cargo fmt --check -- clean
  • Every lefthook pre-commit command run directly, including python -m unittest discover -s tests -- that suite is what caught the exit-code assumption in Refuse a rule that matches its own declaration and selects the file it is in #73 after CI did, so it is in the loop before pushing this time
  • 82 fleet policy trees, 0 newly refused

New tests: the refusal fires, names require_regexp, says "exempt" and not "violating this rule"; and a requirement whose pattern is nowhere in its own section still loads.

Summary by CodeRabbit

  • Bug Fixes
    • Improved self-match validation for regular expression rules.
    • Added clear diagnostics for permanent violations and requirement exemptions.
    • Preserved valid exclusions so configurations continue loading as expected.

…dent going the other way

`validate_no_self_match` covered `regexp` and stopped there. Both are content
searches over a corpus that contains the rule's own declaration, and the same
accident reaches them in opposite directions:

  regexp          must find nothing, so a self-match is a finding that is
                  always there
  require_regexp  must find something, so a self-match is a PASS that is
                  always there

The second is the quieter one and the worse one. Reproduced: a rule requiring
`Copyright` in every file reports `bad.txt` and never reports
`policy/principles.toml`, because that file carries the word on its own
`require_regexp` line. It meets the requirement by naming it. It is the one file
in the corpus that cannot fail the rule, whatever else it does or stops doing,
and nothing says so -- a loud finding about the wrong file gets read, and a file
that has exempted itself is never mentioned again.

The message is not shared. The three cures are the same, and the sentence before
them is the opposite: a reader told that the file will be REPORTED, when what
actually happens is that it is exempt, goes looking for a finding that is not
there.

Measured over the same 82 policy files: 11 `require_regexp` rules, none of them
self-satisfying with the policy file in scope. Nothing that passes today starts
failing, and the fleet sweep with the release binary confirms it.

551 tests pass, clippy and fmt clean, and every lefthook pre-commit command was
run directly -- including the Python suite, which is what caught the exit-code
assumption in the last change.
@coderabbitai

coderabbitai Bot commented Aug 20, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2598a9a8-042f-4f31-a475-29dd5dda0bc3

📥 Commits

Reviewing files that changed from the base of the PR and between 79b6081 and d6f2c42.

📒 Files selected for processing (1)
  • src/config.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.


📝 Walkthrough

Walkthrough

The configuration loader now detects self-matches for both regexp and require_regexp. Tests verify rejection of self-matching requirements and successful loading when the policy file is excluded.

Changes

Self-match validation

Layer / File(s) Summary
Pattern self-match detection and tests
src/config.rs
Self-match validation checks both pattern types and reports distinct diagnostics. Tests cover permanent require_regexp exemptions and exclusions that allow loading.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to d6f2c

The change adds a targeted refusal for self-satisfying require_regexp rules without evidence of a current merge-blocking issue; it is merge-ready after normal checks and review.

Possibly related issues

  • Issue 72 — The changes implement load-time self-match validation for both regexp and require_regexp declarations.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly describes the main change: refusing self-satisfying require_regexp rules.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch refuse-self-satisfying-requirement

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codecov-commenter

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.36%. Comparing base (79b6081) to head (d6f2c42).

Additional details and impacted files
@@            Coverage Diff             @@
##             main      #74      +/-   ##
==========================================
+ Coverage   90.34%   90.36%   +0.01%     
==========================================
  Files          35       35              
  Lines       11147    11168      +21     
==========================================
+ Hits        10071    10092      +21     
  Misses       1076     1076              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@HackingGate
HackingGate merged commit 84a5934 into main Aug 20, 2026
12 checks passed
@HackingGate
HackingGate deleted the refuse-self-satisfying-requirement branch August 20, 2026 15:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants