fix(scan): check user include patterns before the extension allowlist#6
Open
chethanuk wants to merge 1 commit into
Open
fix(scan): check user include patterns before the extension allowlist#6chethanuk wants to merge 1 commit into
chethanuk wants to merge 1 commit into
Conversation
codeant-ai
Bot
added
the
size:S
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
The scan path evaluated the built-in extension allowlist before user include globs, so an explicit include (e.g. **/*.ftl) could never force a non-allowlisted extension into a scan — while the preview/diff path already checks user includes first. The two paths disagreed about which files the same include selects. Reorders whyExcluded in scan/agent.go to match preview.go exactly: binary, user-exclude, user-include, extension allowlist, default excluded paths. User excludes still take precedence over includes, and binary/size guards still run regardless. Adds a regression test: a .ftl file with a matching include glob now yields ExcludeNone (fails on the previous ordering). Related to alibaba#371
chethanuk
force-pushed
the
fix/issue-371-scan-include-order
branch
from
July 15, 2026 09:14
a7c3cd2 to
3eb7150
Compare
chethanuk
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
In the full-scan path, user
--includepatterns were evaluated after the built-in extension allowlist, so a file with a non-allowlisted extension could never be force-included into a scan — even when the user explicitly asked for it. The preview path already evaluates user includes first, soocr previewand the actual scan disagreed about which files a given--includeselects.This change moves the user-include check ahead of the extension-allowlist check in the scan path (
internal/scan/agent.go), matching the preview path's decision order. Explicit user intent now wins over the built-in default in both places.This also provides the "let users extend the allowlist themselves" escape hatch discussed in alibaba#371:
--include "**/*.ftl"(or any other extension) now works for scans without a code change.Type of Change
How Has This Been Tested?
make testpasses locallyCoverage tests extended: a non-allowlisted extension matched by a user
--includeis now included in the scan (this case fails on the previous ordering), and existing exclusion behavior without--includeis unchanged.make check(tidy + fmt + vet) passes.Checklist
go fmt,go vet)Related Issues
Related to alibaba#371 (complements the FreeMarker rules PR; makes the allowlist user-extensible via
--include)