fix: Gate ignore-rule metacharacter fix behind an opt-in flag

[danskmt]

Description

Adds NewFileFilterFromConfig, which resolves feature-flag-gated FileFilter behavior (currently the ignore-rule metacharacter fix) directly from a configuration.Configuration, so future flags of this kind don't need caller changes. config may be nil, which keeps such behavior at its default.

NewFileFilter is now deprecated in favor of it. Flag keys shared across packages live in a new pkg/featureflags package (avoids an import cycle with pkg/configuration).

Checklist

• Tests added and all succeed (make test)
• Regenerated mocks, etc. (make generate)
• Linted (make lint)
• Test your changes work for the CLI
  1. Clone / pull the latest CLI main.
  2. Run go get github.com/snyk/go-application-framework@YOUR_LATEST_GAF_COMMIT in the cliv2 directory.
     • Tip: for local testing, you can uncomment the line near the bottom of the CLI's go.mod to point to your local GAF code.
  3. Run go mod tidy in the cliv2 directory.
  4. Run the CLI tests and do any required manual testing.
  5. Open a PR in the CLI repo now with the go.mod and go.sum changes.
  • Once this PR is merged, repeat these steps, but pointing to the latest GAF commit on main and update your CLI PR.

PR in CLI: snyk/cli#7039

---

Note

Medium Risk
Changes which files are excluded when paths or rules contain regex metacharacters; behavior depends on the flag and which constructor callers use, so incorrect rollout could alter scan scope.

Overview
Introduces NewFileFilterFromConfig, which reads feature-flag-gated behavior (starting with the ignore-rule metacharacter fix) from configuration via a small pkg/featureflags package, avoiding an import cycle with pkg/configuration. NewFileFilter is deprecated but still forces the metacharacter fix on for unmigrated callers.

When the flag is off (the default for newFileFilterInternal / nil config), ignore parsing uses a legacy glob path that only escapes $; when on, rules and base paths escape the full set of regex metacharacters gitignore treats as literal before matching with go-gitignore.

^{Reviewed by Cursor Bugbot for commit 820cf89. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit df40d62. Configure here.}

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Inconsistent Defaults 🟡 [minor] The deprecated NewFileFilter constructor hardcodes enableIgnoreRuleMetacharacterFix = true, while the new recommended NewFileFilterFromConfig defaults to false (via the nil config check or the underlying config provider's default for missing keys). This creates a behavioral divergence where migrating to the 'correct' constructor will silently disable the metacharacter fix unless the consumer also updates their configuration infrastructure to provide the flag. func NewFileFilter(path string, logger *zerolog.Logger, options ...FileFilterOption) *FileFilter { filter := newFileFilterInternal(path, logger, options...) // TODO: Temporary - this keeps the metacharacter // fix enabled for callers of this deprecated constructor (e.g. Preview CLI) that haven't migrated // to NewFileFilterFromConfig yet, so they keep the behavior they already rely on today. Remove // once all such callers have migrated. filter.enableIgnoreRuleMetacharacterFix = true

📚 Repository Context Analyzed This review considered 23 relevant code sections from 13 files (average relevance: 0.84) pkg/local_workflows/config_utils/feature_flag_gateway.go (lines 1-99) pkg/local_workflows/config_utils/feature_flag.go (lines 1-40) pkg/apiclients/feature_flag_gateway/client.go (lines 1-62) pkg/configuration/configuration.go (lines 1-269) pkg/local_workflows/config_utils/experimental.go (lines 1-58) pkg/apiclients/feature_flag_gateway/2024-10-15/feature_flag_gateway.go (3 segments, lines 253-501) internal/api/api.go (lines 1-245) ... and 6 more file(s)

🤖 Repository instructions applied (from AGENTS.md)

[PeterSchafer]

@danskmt please don't add more feature flags here, instead keep them close to the logic where they are used. In this case file filter.

[PeterSchafer]

Question: Why are you limiting the interface here? Why not just use configuration.Configuration? The existing Configuration interface is much richer and supports for example retrieving values with Errors. Limiting to a narrow interface does create additional cognitive and maintenance complexity.

[PeterSchafer]

Context: The design goal of the configuration package is to decouple the source and the consumption of configuration values. So that a consumer doesn't know if a value is a feature flag or a command line argument or an environment variable. It is just all configuration accessed via a name.

[PeterSchafer]

Issue: Introducing a new NewXyZ function is the opposite of what we have been doing in the GAF interface design, instead we have been shifting to the Functional Options Pattern. Why do we do both here?

[PeterSchafer]

Question: Why is this function duplicated rather then escapeIgnoreRuleMetaChars() parameterized with ruleRegexMetaChars?

[PeterSchafer]

Suggestion: Test should cover the public interface as well not just an internal one