Gate rule type engine construction on provider_traits (#6702)

* Gate rule type engine construction on provider_traits

Reject rule types at construction time when the provider does not
implement all traits listed in the rule type's provider_traits, the
same way entity-type mismatches are already handled up front rather
than via a runtime ErrEvaluationSkipped.

The trait check is declared as a package-local interface in rtengine
rather than added to interfaces.Provider: that package cannot import
minderv1 without creating an import cycle (minderv1 transitively
imports pkg/datasources/v1, which imports pkg/engine/v1/interfaces).
Every concrete provider already implements CanImplement with this
exact signature, so they satisfy the interface structurally with no
provider-side changes.

* Add tests for provider_traits gating in rtengine

Extend TestKit with a configurable CanImplement (via WithCanImplement),
defaulting to true so existing callers are unaffected, and add cases
to engine_test.go covering: no provider_traits (unaffected), all
required traits satisfied (succeeds), and a missing trait (fails with
a clear error).

* Skip (not abort) rule types with unsatisfied provider_traits

* Move DataSourceDriver constants to minderv1 to break import cycle

* Widen interfaces.Provider with CanImplement, simplify provider_traits loop

* Add provider_traits coverage to mindev integration tests

* Replace provider_traits sentinel error with SupportedByProvider

RuleTypeEngine now computes whether the provider satisfies the rule
type's provider_traits once at construction time and exposes it via
SupportedByProvider(), instead of NewRuleTypeEngine returning a
wrapped sentinel error that callers had to unwrap with errors.Is.

The rule engine cache no longer excludes unsatisfied rule types from
its population loop, so every rule type in the hierarchy is cached
regardless of applicability. The executor checks
SupportedByProvider() before evaluating a rule and, if false, returns
early ahead of createOrUpdateEvalStatus so no eval status row is
written for a rule type that isn't applicable to the entity's
provider.

An unrecognized trait name (e.g. a typo, or a rule type stored before
provider_traits validation existed) is treated as unsupported and
logs a warning, distinguishing it from a provider that simply doesn't
implement a valid trait.

* Change provider_traits to a list of strings in the proto

RuleType.Definition.provider_traits was `repeated ProviderType`,
requiring the numeric enum value in JSON/YAML rule type definitions.
Change it to `repeated string`, using the same short trait names
("github", "git", "rest", "oci", "repo-lister", "image-lister")
already used elsewhere for provider class definitions.

Field 8 (the old enum field) is reserved rather than reused, since
the two field types have different wire encodings and reusing the
number would let old serialized data misparse instead of failing
loudly. The new field is 9. proto/buf.yaml gains a narrowly scoped
buf breaking exception: WIRE_JSON requires the field *name* to also
be reserved on deletion, which conflicts with intentionally reusing
"provider_traits" for the new field. This is called out as a
deliberate, sanctioned break, since the field has never been
documented or used.

ProviderTypeFromString, backed by the same (name) option lookup
ToString already uses, converts a trait string to its ProviderType.
Rule type validation now rejects unknown trait strings at
creation/update time, naming the valid values in the error - this is
the only safeguard against a typo silently making a rule type never
evaluate.

* Use a positive provider trait list in the ruletest harness

Rename eval()'s provider_missing_traits argument to
provider_traits_present and invert its semantics: it now lists the
traits the test provider does implement, rather than the ones it
doesn't. The default when the argument is omitted is unchanged - all
traits are present.

parseProviderTraitsList now accepts the same short trait names used
in rule type YAML (e.g. "github") via ProviderTypeFromString, instead
of full enum names like "PROVIDER_TYPE_GITHUB", and its error on an
unrecognized value lists the valid trait names.

eval() now checks the rule type engine's SupportedByProvider() before
evaluating and reports a "skip" result if the provider doesn't
implement a required trait, mirroring - but distinct from - the
production executor's zero-footprint no-op for the same case: a test
still needs eval() to return something a test author can assert on.

* Build provider trait name lookup as a map at init

Replaces per-call descriptor iteration in ProviderTypeFromString and the
duplicated valid-name lists in ruletypes and ruletest.

* Report unknown provider_traits entries as an evaluation error

An unrecognized trait name is a rule type authoring problem the user can
fix, so it now surfaces as an eval status error naming every offending
trait. A known trait the provider doesn't implement still produces no
eval status row at all.

* Document ProviderType names as a stable interface

Also removes the pkg/datasources/v1 driver constants outright rather than
leaving deprecated aliases, and notes the buf exception is removable once
this merges.

* Regenerate GitHub provider mocks for CanImplement

* Simplify ProviderTypeFromString to return a bare ProviderType

PROVIDER_TYPE_UNSPECIFIED is the zero value and absent from the lookup
table, so it already signals a miss and the bool was redundant.

* Add a gitlab provider trait

Lets a rule type declare [rest, gitlab] for the GitLab API, the
counterpart to [rest, github]. The GitLab provider client implements it;
there is deliberately no matching provider_type database enum value,
since trait gating happens through CanImplement rather than the
providers table.

Author: intelligent-ears

docs/docs/ref/proto.mdx

@@ -13,7 +13,6 @@ import (
 
 	"github.com/mindersec/minder/internal/db"
 	minderv1 "github.com/mindersec/minder/pkg/api/protobuf/go/minder/v1"
-	v1datasources "github.com/mindersec/minder/pkg/datasources/v1"
 )
 
 // DataSourceMetadata is used to serialize additional datasource-level fields
@@ -47,12 +46,12 @@ func dataSourceDBToProtobuf(ds db.DataSource, dsfuncs []db.DataSourcesFunction)
 	// If we didn't record the type in metadata, use the first function to guess.
 	dsfType := cmp.Or(metadata.Type, dsfuncs[0].Type)
 	switch dsfType {
-	case v1datasources.DataSourceDriverStruct:
+	case minderv1.DataSourceDriverStruct:
 		outds.Driver = &minderv1.DataSource_Structured{
 			Structured: &minderv1.StructDataSource{},
 		}
 		return dataSourceStructDBToProtobuf(outds, dsfuncs)
-	case v1datasources.DataSourceDriverRest:
+	case minderv1.DataSourceDriverRest:
 		outds.Driver = &minderv1.DataSource_Rest{
 			Rest: &minderv1.RestDataSource{},
 		}
@@ -100,14 +99,14 @@ func dataSourceStructDBToProtobuf(ds *minderv1.DataSource, dsfuncs []db.DataSour
 
 func metadataForDataSource(ds *minderv1.DataSource) (json.RawMessage, error) {
 	metadata := DataSourceMetadata{
-		Type: v1datasources.DataSourceDriverStruct,
+		Type: minderv1.DataSourceDriverStruct,
 	}
 	switch ds.Driver.(type) {
 	case *minderv1.DataSource_Rest:
-		metadata.Type = v1datasources.DataSourceDriverRest
+		metadata.Type = minderv1.DataSourceDriverRest
 		metadata.ProviderAuth = ds.GetRest().GetProviderAuth()
 	case *minderv1.DataSource_Structured:
-		metadata.Type = v1datasources.DataSourceDriverStruct
+		metadata.Type = minderv1.DataSourceDriverStruct
 	default:
 		return nil, fmt.Errorf("unknown datasource driver %T", ds.Driver)
 	}

internal/datasources/service/convert.go

@@ -538,7 +538,7 @@ func addDataSourceFunctions(
 				DataSourceID: dsID,
 				ProjectID:    projectID,
 				Name:         name,
-				Type:         v1datasources.DataSourceDriverStruct,
+				Type:         minderv1.DataSourceDriverStruct,
 				Definition:   defBytes,
 			}); err != nil {
 				return fmt.Errorf("failed to create data source function: %w", err)
@@ -555,7 +555,7 @@ func addDataSourceFunctions(
 				DataSourceID: dsID,
 				ProjectID:    projectID,
 				Name:         name,
-				Type:         v1datasources.DataSourceDriverRest,
+				Type:         minderv1.DataSourceDriverRest,
 				Definition:   defBytes,
 			}); err != nil {
 				return fmt.Errorf("failed to create data source function: %w", err)

internal/datasources/service/service.go

@@ -21,7 +21,6 @@ import (
 	"github.com/mindersec/minder/internal/db"
 	"github.com/mindersec/minder/internal/util/ptr"
 	minderv1 "github.com/mindersec/minder/pkg/api/protobuf/go/minder/v1"
-	v1 "github.com/mindersec/minder/pkg/datasources/v1"
 )
 
 var (
@@ -93,7 +92,7 @@ func TestGetByName(t *testing.T) {
 							ID:           uuid.New(),
 							DataSourceID: dsID,
 							Name:         "test_function",
-							Type:         string(v1.DataSourceDriverRest),
+							Type:         string(minderv1.DataSourceDriverRest),
 							Definition: restDriverToJson(t, &minderv1.RestDataSource_Def{
 								Endpoint:    "http://example.com",
 								InputSchema: is,
@@ -230,7 +229,7 @@ func TestGetByID(t *testing.T) {
 							ID:           uuid.New(),
 							DataSourceID: id,
 							Name:         "test_function",
-							Type:         string(v1.DataSourceDriverRest),
+							Type:         string(minderv1.DataSourceDriverRest),
 							Definition: restDriverToJson(t, &minderv1.RestDataSource_Def{
 								Endpoint:    "http://example.com",
 								InputSchema: is,
@@ -348,7 +347,7 @@ func TestList(t *testing.T) {
 							ID:           uuid.New(),
 							DataSourceID: dsID,
 							Name:         "test_function",
-							Type:         string(v1.DataSourceDriverRest),
+							Type:         string(minderv1.DataSourceDriverRest),
 							Definition: restDriverToJson(t, &minderv1.RestDataSource_Def{
 								Endpoint:    "http://example.com",
 								InputSchema: is,
@@ -628,7 +627,7 @@ func TestBuildDataSourceRegistry(t *testing.T) {
 							DataSourceID: dsID,
 							ProjectID:    projectID,
 							Name:         "test_function",
-							Type:         string(v1.DataSourceDriverRest),
+							Type:         string(minderv1.DataSourceDriverRest),
 							Definition: restDriverToJson(t, &minderv1.RestDataSource_Def{
 								Endpoint:    "http://example.com",
 								InputSchema: is,
@@ -1147,7 +1146,7 @@ func TestUpdate(t *testing.T) {
 							ID:           uuid.New(),
 							DataSourceID: uuid.New(),
 							Name:         "test_function",
-							Type:         string(v1.DataSourceDriverRest),
+							Type:         string(minderv1.DataSourceDriverRest),
 							Definition: restDriverToJson(t, &minderv1.RestDataSource_Def{
 								Endpoint: "http://example.com",
 								InputSchema: func() *structpb.Struct {
@@ -1221,7 +1220,7 @@ func TestUpdate(t *testing.T) {
 							ID:           uuid.New(),
 							DataSourceID: uuid.New(),
 							Name:         "test_function",
-							Type:         v1.DataSourceDriverRest,
+							Type:         minderv1.DataSourceDriverRest,
 							Definition:   restDriverToJson(t, &minderv1.RestDataSource_Def{}),
 						},
 					}, nil)
@@ -1357,7 +1356,7 @@ func TestUpdate(t *testing.T) {
 							ID:           uuid.New(),
 							DataSourceID: uuid.New(),
 							Name:         "test_function",
-							Type:         string(v1.DataSourceDriverRest),
+							Type:         string(minderv1.DataSourceDriverRest),
 							Definition: restDriverToJson(t, &minderv1.RestDataSource_Def{
 								Endpoint: "http://example.com",
 								InputSchema: func() *structpb.Struct {
@@ -1402,7 +1401,7 @@ func TestUpdate(t *testing.T) {
 							ID:           uuid.New(),
 							DataSourceID: uuid.New(),
 							Name:         "test_function",
-							Type:         string(v1.DataSourceDriverRest),
+							Type:         string(minderv1.DataSourceDriverRest),
 							Definition: restDriverToJson(t, &minderv1.RestDataSource_Def{
 								Endpoint: "http://example.com",
 								InputSchema: func() *structpb.Struct {
@@ -1496,7 +1495,7 @@ func TestUpdate(t *testing.T) {
 							ID:           uuid.New(),
 							DataSourceID: uuid.New(),
 							Name:         "test_function",
-							Type:         string(v1.DataSourceDriverRest),
+							Type:         string(minderv1.DataSourceDriverRest),
 							Definition: restDriverToJson(t, &minderv1.RestDataSource_Def{
 								Endpoint: "http://example.com",
 								InputSchema: func() *structpb.Struct {
@@ -1624,7 +1623,7 @@ func TestUpsert(t *testing.T) {
 							ID:           uuid.New(),
 							DataSourceID: dsID,
 							Name:         "test_function",
-							Type:         v1.DataSourceDriverRest,
+							Type:         minderv1.DataSourceDriverRest,
 							Definition: restDriverToJson(t, &minderv1.RestDataSource_Def{
 								Endpoint: "http://example.com/updated",
 								InputSchema: func() *structpb.Struct {

internal/datasources/service/service_test.go

@@ -6,6 +6,7 @@ package engine
 import (
 	"context"
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/google/uuid"
@@ -179,6 +180,21 @@ func (e *executor) evaluateRule(
 		return fmt.Errorf("error creating rule type engine: %w", err)
 	}
 
+	// An unknown provider_traits entry (typo, or a trait renamed since the
+	// rule type was stored) is a rule type authoring problem the user can
+	// fix, so it must surface as a loud evaluation error rather than the
+	// silent skip below. Only when every declared trait name is known, but
+	// the provider doesn't implement one of them, do we take the silent
+	// path: that's expected and not something the user can act on.
+	unknownTraits := ruleEngine.UnknownProviderTraits()
+	if len(unknownTraits) == 0 && !ruleEngine.SupportedByProvider() {
+		// This rule type doesn't apply to this entity's provider.
+		// Produce zero evaluation-status footprint: no error, no
+		// skip record, nothing — stricter than the SkipSilently
+		// path, which still logs at info level.
+		return nil
+	}
+
 	// create the action engine for this rule instance
 	// unlike the rule type engine, this cannot be cached
 	actionEngine, err := actions.NewRuleActions(ctx, ruleEngine.GetRuleType(), provider, &profile.ActionConfig)
@@ -192,9 +208,14 @@ func (e *executor) evaluateRule(
 	// Evaluate the rule
 	var evalErr error
 	var result *interfaces.EvaluationResult
-	if profileEvalStatus != nil {
+	switch {
+	case len(unknownTraits) > 0:
+		evalErr = fmt.Errorf("rule type %q declares unknown provider trait(s) %s; "+
+			"check provider_traits for a typo or a trait renamed since this rule type was stored",
+			ruleEngine.GetRuleType().Name, strings.Join(unknownTraits, ", "))
+	case profileEvalStatus != nil:
 		evalErr = profileEvalStatus
-	} else {
+	default:
 		// enrich the logger with the entity type and execution ID
 		ctx := zerolog.Ctx(ctx).With().
 			Str("entity_type", inf.Type.ToString()).

internal/engine/executor.go

@@ -248,6 +248,59 @@ func TestGetRuleEngine(t *testing.T) {
 	}
 }
 
+// TestNewRuleEngineCache_ProviderTraits verifies that NewRuleEngineCache
+// caches every rule type in the project hierarchy regardless of whether its
+// provider_traits are satisfied: unsatisfied rule types are still
+// constructed and cached, just marked as unsupported, rather than being
+// excluded from the cache or aborting the whole population loop.
+func TestNewRuleEngineCache_ProviderTraits(t *testing.T) {
+	t.Parallel()
+
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	ctx := context.Background()
+
+	noTraitsID := uuid.New()
+	satisfiedTraitsID := uuid.New()
+	unsatisfiedTraitsID := uuid.New()
+	projectID := uuid.New()
+
+	store := dbf.NewDBMock(func(mock dbf.DBMock) {
+		mock.EXPECT().GetParentProjects(gomock.Any(), gomock.Any()).
+			Return([]uuid.UUID{projectID}, nil)
+		mock.EXPECT().GetRuleTypesByEntityInHierarchy(gomock.Any(), gomock.Any()).
+			Return([]db.RuleType{
+				{ID: noTraitsID, ProjectID: projectID, Definition: []byte(ruleDefJSON)},
+				{ID: satisfiedTraitsID, ProjectID: projectID, Definition: []byte(ruleDefJSONWithGitTrait)},
+				{ID: unsatisfiedTraitsID, ProjectID: projectID, Definition: []byte(ruleDefJSONWithGithubTrait)},
+			}, nil)
+	})(ctrl)
+
+	dssvc := mockdssvc.NewMockDataSourcesService(ctrl)
+	dssvc.EXPECT().BuildDataSourceRegistry(gomock.Any(), gomock.Any(), gomock.Any()).
+		Return(v1datasources.NewDataSourceRegistry(), nil).Times(3)
+
+	cache, err := NewRuleEngineCache(
+		ctx, store, db.EntitiesRepository, projectID,
+		testproviders.NewGitProvider(nil), nil, ingestcache.NewNoopCache(),
+		dssvc)
+	require.NoError(t, err)
+	require.NotNil(t, cache)
+
+	impl, ok := cache.(*ruleEngineCache)
+	require.True(t, ok)
+	require.Len(t, impl.engines, 3)
+
+	require.Contains(t, impl.engines, noTraitsID)
+	require.True(t, impl.engines[noTraitsID].SupportedByProvider())
+
+	require.Contains(t, impl.engines, satisfiedTraitsID)
+	require.True(t, impl.engines[satisfiedTraitsID].SupportedByProvider())
+
+	require.Contains(t, impl.engines, unsatisfiedTraitsID)
+	require.False(t, impl.engines[unsatisfiedTraitsID].SupportedByProvider())
+}
+
 var (
 	ruleTypeID = uuid.New()
 	errTest    = errors.New("error in rule type engine cache test")
@@ -305,3 +358,42 @@ const brokenRuleDef = `
 	}
 }
 `
+
+// same as ruleDefJSON, but requires the "git" provider trait
+const ruleDefJSONWithGitTrait = `
+{
+	"rule_schema": {},
+	"provider_traits": ["git"],
+	"ingest": {
+		"type": "git",
+        "git": {}
+	},
+	"eval": {
+		"type": "jq",
+		"jq": [{
+			"ingested": {"def": ".abc"},
+			"profile": {"def": ".xyz"}
+		}]
+	}
+}
+`
+
+// same as ruleDefJSON, but requires the "github" provider trait, which
+// testproviders.GitProvider does not implement
+const ruleDefJSONWithGithubTrait = `
+{
+	"rule_schema": {},
+	"provider_traits": ["github"],
+	"ingest": {
+		"type": "git",
+        "git": {}
+	},
+	"eval": {
+		"type": "jq",
+		"jq": [{
+			"ingested": {"def": ".abc"},
+			"profile": {"def": ".xyz"}
+		}]
+	}
+}
+`