[Copilot]

devskim analyze matched a custom rule's file regexes against the bare file name only, so a pattern that names a directory never matched:

"applies_to_file_regex": [".*"],
"exclude_file_regex": ["project/tests/"]

With this rule, project/tests/e2e/fixtures/prepare-ner.py was still reported.

This is an oversight dating from the move to the Application Inspector engine (#390), not a regression. AnalyzeCommand passed fileEntry.Name to DevSkimRuleProcessor.Analyze, which wraps it in a new FileEntry. AI matches these regexes against FileEntry.FullPath, so it only ever saw the file name. The older engine had no file-regex fields at all.

Changes

• AnalyzeCommand: passes GetPathForFileRegexes(scanPath, fileEntry) instead of fileEntry.Name:
  • Directory scan: the path relative to the scanned directory, e.g. project/tests/e2e/fixtures/prepare-ner.py.
  • Single-file scan: the file name.
  • Single archive with --crawl-archives: each entry's path inside the archive.
  • Separators: always /, on every OS, so one pattern works everywhere.
  • Output options: --base-path / --absolute-path still affect only output, not matching.
• DevSkimRuleProcessor.Analyze: XML doc comment explaining that fileName is what the file regexes are matched against. No behaviour change.
• Tests (AnalyzeTest.cs): cover the reporter's case, start-anchored patterns, a directory-scoped applies_to_file_regex, file-name patterns, and the helper's / output and single-file case.
• Changelog: 1.0.102.

Behaviour change for custom rules

Patterns now see the whole relative path:

Pattern	Before	After
project/tests/	never matches	matches everything under project/tests/
^prepare-ner\.py$	matches at any depth	matches only at the scan root
test (exclude)	file names containing test	also every file under tests/, latest/, …
.*\.config$ (default rules)	unchanged	unchanged

To match only the file name, anchor the pattern to the last segment, e.g. (^|/)prepare-ner\.py$.

Notes for reviewers

• exclude_file_regex scope: it only filters rules selected through applies_to_file_regex. A rule still runs on files matching its applies_to languages, and on every file if it sets neither field. This is existing AI behaviour, noted in the changelog but not changed here.
• Known edge case: RecursiveExtractor strips .. from FileEntry.FullPath but not from the scan path. If the scanned path contains a name like v1..2, the relative path starts with ../ and start-anchored patterns won't match. Falling back to fileEntry.Name in that case would fix it; it is left as is here.

• Fixes exclude_file_regex and applies_to_file_regex only see the file name in devskim analyze #795

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.