Temporarily bulk-sync all DLP discovery rules to test-rules - #5297
Open
aidenmitchell wants to merge 1 commit into
Open
aidenmitchell wants to merge 1 commit into
aidenmitchell wants to merge 1 commit into
Conversation
github-actions
Bot
added
shared-samples:excluded:bulk_rules
test-rules:excluded:bulk_rules
Copies every rule in dlp-discovery-rules/ to the test-rules branch directly, bypassing the normal per-PR sync flow (which only watches detection-rules/ and caps at 10 rules per PR). Needed to test all DLP rules against live messages at once. testing_pr: 0 marks these files as bulk-synced so clear-old-test-rules.yml does not delete them. This is temporary and will be reverted once DLP live testing is done. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
aidenmitchell
force-pushed
the
bulk-sync-dlp-rules-test-rules
branch
from
September 8, 2026 19:22
0e451d4 to
b1db457
Compare
github-actions
Bot
removed
test-rules:excluded:bulk_rules
Contributor
There was a problem hiding this comment.
Pull request overview
Temporarily bulk-syncs all DLP discovery rules into test-rules for live-message testing.
Changes:
- Adds bulk DLP synchronization with
testing_pr: 0metadata. - Preserves bulk-synced files during stale-rule cleanup.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Summary |
|---|---|
.github/workflows/clear-old-test-rules.yml |
Exempts bulk-synced rules from cleanup. |
.github/scripts/sync_test_rules.py |
Bulk-syncs DLP rules; workflow handling for bulk_dlp_* filenames requires updating. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| entry['path'], 'main' | ||
| ) | ||
|
|
||
| target_save_filename = f"bulk_dlp_{entry['name']}" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
handle_dlp_bulk_sync()tosync_test_rules.py. This copies every rule indlp-discovery-rules/straight to thetest-rulesbranch, outside the normal per-PR flow (which only watchesdetection-rules/and caps at 10 rules per PR).testing_pr: 0.clear-old-test-rules.ymlso it does not delete files withtesting_pr: 0.Why
We need to test all DLP rules against live messages at once. The normal PR-based sync path does not fit this: DLP rules live outside
detection-rules/, and there are far more than the 10-rule-per-PR cap.Revert plan
This is temporary. Once DLP live testing is done, revert this PR. A follow-up cleanup pass on
test-rulesmay be needed to remove thebulk_dlp_*files (the normal cleanup jobs will no longer exempt them once reverted).Test plan
python3 -m py_compile .github/scripts/sync_test_rules.pypasses (done locally)Sync Test Rulesworkflow run addsbulk_dlp_*.ymlfiles to thetest-rulesbranchRemove Stale from test-rules Branchdoes not delete thebulk_dlp_*.ymlfiles on its next run🤖 Generated with Claude Code