Skip to content

fix: type hinting fixes and additional code checks #4790

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 30 commits into
base: main
Choose a base branch
from
Open

fix: type hinting fixes and additional code checks #4790

wants to merge 30 commits into from
+6,616 −5,222

Conversation

traut
Copy link
Contributor

@traut traut commented Jun 11, 2025

Pull Request

Issue link(s):

Summary - What I changed

  • adding ruff and pyright checks in CI workflow
  • making sure pyright has no complains

How To Test

Checklist

  • Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
  • Added the meta:rapid-merge label if planning to merge within 24 hours
  • Secret and sensitive material has been managed correctly
  • Automated testing was updated or added to match the most common scenarios
  • Documentation and comments were added for features that require explanation

Contributor checklist

@traut traut changed the title [WIP] Type hint fixes and adding code checks [WIP] fix: type hint fixes and adding code checks Jun 11, 2025
@traut traut added python Internal python for the repository ci/cd maintenance Internal changes minor labels Jun 17, 2025
@traut traut marked this pull request as ready for review June 17, 2025 16:32
@github-actions GitHub Actions
Copy link
Contributor

Enhancement - Guidelines

These guidelines serve as a reminder set of considerations when addressing adding a new schema feature to the code.

Documentation and Context

  • Describe the feature enhancement in detail (alternative solutions, description of the solution, etc.) if not already documented in an issue.
  • Include additional context or screenshots.
  • Ensure the enhancement includes necessary updates to the documentation and versioning.

Code Standards and Practices

  • Code follows established design patterns within the repo and avoids duplication.
  • Code changes do not introduce new warnings or errors.
  • Variables and functions are well-named and descriptive.
  • Any unnecessary / commented-out code is removed.
  • Ensure that the code is modular and reusable where applicable.
  • Check for proper exception handling and messaging.

Testing

  • New unit tests have been added to cover the enhancement.
  • Existing unit tests have been updated to reflect the changes.
  • Provide evidence of testing and validating the enhancement (e.g., test logs, screenshots).
  • Validate that any rules affected by the enhancement are correctly updated.
  • Ensure that performance is not negatively impacted by the changes.
  • Verify that any release artifacts are properly generated and tested.

Additional Schema Related Checks

  • Ensure that the enhancement does not break existing functionality. (e.g., run make test-cli)
  • Review the enhancement with a peer or team member for additional insights.
  • Verify that the enhancement works across all relevant environments (e.g., different OS versions).
  • Confirm that all dependencies are up-to-date and compatible with the changes.
  • Link to the relevant Kibana PR or issue provided
  • Exported detection rule(s) from Kibana to showcase the feature(s)
  • Converted the exported ndjson file(s) to toml in the detection-rules repo
  • Re-exported the toml rule(s) to ndjson and re-imported into Kibana
  • Updated necessary unit tests to accommodate the feature
  • Applied min_compat restrictions to limit the feature to a specified minimum stack version
  • Executed all unit tests locally with a test toml rule to confirm passing
  • Included Kibana PR implementer as an optional reviewer for insights on the feature
  • Implemented requisite downgrade functionality
  • Cross-referenced the feature with product documentation for consistency
  • Incorporated a comprehensive test rule in unit tests for full schema coverage
  • Conducted system testing, including fleet, import, and create APIs (e.g., run make test-remote-cli)
  • Confirm that the proper version label is applied to the PR patch, minor, major.

@traut traut changed the title [WIP] fix: type hint fixes and adding code checks fix: type hinting fixes and additional code checks Jun 17, 2025
Mikaayenson
Mikaayenson reviewed Jun 17, 2025
View reviewed changes
Mikaayenson
Mikaayenson reviewed Jun 17, 2025
View reviewed changes
Mikaayenson
Mikaayenson reviewed Jun 17, 2025
View reviewed changes
Mikaayenson
Mikaayenson reviewed Jun 17, 2025
View reviewed changes
Mikaayenson
Mikaayenson reviewed Jun 17, 2025
View reviewed changes
tests/test_all_rules.py
Comment on lines +1418 to +1395
osquery_note_pattern = (
"> **Note**:\n> This investigation guide uses the [Osquery Markdown Plugin]"
"(https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html) "
"introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display "
"unrendered Markdown in this guide."
)
invest_note_pattern = (
'> This investigation guide uses the [Investigate Markdown Plugin]'
'(https://www.elastic.co/guide/en/security/current/interactive-investigation-guides.html)'
' introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display '
'unrendered Markdown in this guide.')
"> This investigation guide uses the [Investigate Markdown Plugin]"
"(https://www.elastic.co/guide/en/security/current/interactive-investigation-guides.html)"
" introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display "
"unrendered Markdown in this guide."
)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should double check that when the transform occurs, its still formatted correctly.

Mikaayenson
Mikaayenson reviewed Jun 17, 2025
View reviewed changes
Mikaayenson
Mikaayenson reviewed Jun 17, 2025
View reviewed changes
Mikaayenson
Mikaayenson reviewed Jun 17, 2025
View reviewed changes
detection_rules/cli_utils.py
Comment on lines +250 to +251
suggested_path: Path = Path(DEFAULT_PREBUILT_RULES_DIRS[0]) / contents["name"]
path = Path(path or input(f"File path for rule [{suggested_path}]: ") or suggested_path).resolve()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems a bit odd to type hint as Path when we explicitly set as a Path object. We also dont type hint the next field path.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

contents is dict[str, Any], so there is ambiguity in the calculation of the result type

Mikaayenson
Mikaayenson reviewed Jun 17, 2025
View reviewed changes
Mikaayenson
Mikaayenson reviewed Jun 17, 2025
View reviewed changes
Mikaayenson
Mikaayenson reviewed Jun 17, 2025
View reviewed changes
Mikaayenson
Mikaayenson reviewed Jun 17, 2025
View reviewed changes
detection_rules/ecs.py
"""Get schema for KQL."""
indexes = indexes or ()
converted = flatten_multi_fields(get_schema(version, name='ecs_flat'))
indexes = indexes or []
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Curious as to why this was a tuple

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no idea. I don't think there is a risk of mutation, so we might as well simplify and have list here

@Mikaayenson
Copy link
Contributor

Mikaayenson commented Jun 17, 2025 •
edited
Loading

  • Any reason why the build didn't run? Waiting for status to be reported
  • Note, I think we need to run the lint tests locally and add to this PR (since the workflow won't run until the action is on main)
  • We'll also want to open a maintenance window and test the backporting logic.

traut and others added 27 commits June 20, 2025 12:12
@traut
linting config and python version bump
7815e09
@traut
Type hints
b074381
@traut
Drop incorrect config option
b02388a
@traut
More fixes
763a857
@traut
Style fixes
1501ffe
@traut
CI adjustments
b9d0fc8
@traut
Pyproject fixes
f8e9e93
@traut
CI & pyproject fixes
21236e3
@traut
Proper version bump
552976d
@traut
Tests formatting
11065e8
@traut
Resolve cirtular dependency
1f03075
@traut
Test fixes
5c047e5
@traut
Make sure the tests are formatted correctly
e295635
@traut
Check tweaks
2dcb69b
@traut
Bumping python version in CI images
530016f
@traut
Pin marshmallow do 3.x because 4.x is not supported
7961ac1
@traut
License fix
be43ac6
@traut
Convert path to str
1bf082b
@traut
Making myself a codeowner
5e70923
@traut
Missing kwargs param
29c4e4d
@traut
Adding a missing kwargs to set_score
a9b9472
@traut @Mikaayenson
Update .github/CODEOWNERS
38051b8 
Co-authored-by: Mika Ayenson, PhD <[email protected]>
@traut
Dropping unnecessary raise
82dd93a
@traut
Dropping skipped test
364d57c
@traut
Drop unnecessary var
a97bf0f
@traut
Drop unused commented-out func
fbc38ca
@traut
Disable typehinting for the whole func
542ab44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Mikaayenson Mikaayenson Mikaayenson left review comments

@eric-forte-elastic eric-forte-elastic Awaiting requested review from eric-forte-elastic eric-forte-elastic is a code owner

@terrancedejesus terrancedejesus Awaiting requested review from terrancedejesus terrancedejesus is a code owner

At least 2 approving reviews are required to merge this pull request.

Assignees

@traut traut

Labels
backport: auto ci/cd Hunting maintenance Internal changes minor python Internal python for the repository schema
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@traut @Mikaayenson @eric-forte-elastic @shashank-elastic