fix(rules:if): evaluate expressions via jsep AST, fix null !~ and reject \${VAR}

- Replace regex-based string manipulation in evaluateRuleIf with jsep AST
  parsing for correct operator precedence and cleaner expression handling
- Fix: null !~ /pattern/ now returns true (undefined variable does not match,
  so negated check passes) instead of always returning false
- Fix: reject \${VAR} curly-bracket syntax in the new evaluator, matching
  the guard already present in the legacy _evaluateRuleIf path

Author: ticapix

bun.lock

@@ -24,6 +24,7 @@
     "fetch-schema": "curl https://gitlab.com/gitlab-org/gitlab/-/raw/master/app/assets/javascripts/editor/schema/ci.json -sf > src/schema.json"
   },
   "dependencies": {
+    "@jsep-plugin/regex": "^1.0.4",
     "ajv": "8.x.x",
     "axios": "1.x.x",
     "base64url": "3.x.x",
@@ -37,6 +38,7 @@
     "fs-extra": "11.x.x",
     "globby": "16.x.x",
     "js-yaml": "4.x.x",
+    "jsep": "^1.4.0",
     "jsonpointer": "5.x.x",
     "micromatch": "4.x.x",
     "object-traversal": "1.x.x",

package.json

@@ -1,6 +1,8 @@
 import "./global.js";
 import {RE2JS} from "re2js";
 import chalk from "chalk-template";
+import jsep from "jsep";
+import jsepRegex from "@jsep-plugin/regex";
 import {Job, JobRule, Need, Service} from "./job.js";
 import {needsComplex} from "./data-expander.js";
 import fs from "fs-extra";
@@ -16,6 +18,10 @@ import {AxiosRequestConfig} from "axios";
 import path from "node:path";
 import {Argv} from "./argv.js";
 
+jsep.plugins.register(jsepRegex);   // /pattern/flags literals
+jsep.addBinaryOp("=~", 10); // regex match operator
+jsep.addBinaryOp("!~", 10); // regex non-match operator
+
 type RuleResultOpt = {
     argv: Argv;
     cwd: string;
@@ -213,10 +219,122 @@ export class Utils {
         return {when, allowFailure, variables: ruleVariable, needs: ruleNeeds};
     }
 
+    // Reconstruct the source string for an atomic (non-logical) jsep node.
+    // Identifiers keep their name ($VAR), literals use their raw form so that
+    // strings retain quotes and regexes retain slashes and flags.
+    private static _nodeToAtom (node: jsep.Expression, envs: {[key: string]: string}): string {
+        switch (node.type) {
+            case "Identifier": {
+                const n = node as jsep.Identifier;
+                return n.name;
+                // return this.expandTextWith(n.name, {
+                //     unescape: JSON.stringify("$"),
+                //     variable: (name) => JSON.stringify(envs[name] ?? null).replaceAll("\\\\", "\\"),
+                // });
+            }
+            case "Literal": return (node as jsep.Literal).raw;
+            case "BinaryExpression": {
+                const n = node as jsep.BinaryExpression;
+                return `${Utils._nodeToAtom(n.left, envs)} ${n.operator} ${Utils._nodeToAtom(n.right, envs)}`;
+            }
+            default: return "";
+        }
+    }
+
+    static stripQuotes (str: string) {
+        if (str.length < 2) return str;
+        const first = str[0];
+        const last = str[str.length - 1];
+        if ((first === "\"" && last === "\"") || (first === "'" && last === "'")) {
+            return str.slice(1, -1);
+        }
+        return str;
+    }
+
     static evaluateRuleIf (ruleIf: string | undefined, envs: {[key: string]: string}): boolean {
         if (ruleIf === undefined) return true;
         assert(!/\$\{\w+\}/.test(ruleIf), chalk`rules:rule if invalid expression syntax: {blueBright ${ruleIf}}\nuse {green $VAR} not {red \${VAR\}} in rules:if`);
         let evalStr = ruleIf;
+        evalStr = this.expandTextWith(evalStr, {
+            unescape: JSON.stringify("$"),
+            variable: (name) => JSON.stringify(envs[name] ?? null).replaceAll("\\\\", "\\"),
+        }); // replace all $VAR by their values
+
+        const flagsToBinary = (flags: string): number => {
+            let binary = 0;
+            if (flags.includes("i")) {
+                binary |= RE2JS.CASE_INSENSITIVE;
+            }
+            if (flags.includes("s")) {
+                binary |= RE2JS.DOTALL;
+            }
+            if (flags.includes("m")) {
+                binary |= RE2JS.MULTILINE;
+            }
+            return binary;
+        };
+        // jsep parses ruleIf into an AST, handling &&, ||, () and operator precedence.
+        const walk = (node: jsep.Expression): boolean => {
+            if (node.type === "BinaryExpression") {
+                const n = node as jsep.BinaryExpression;
+                if (n.operator === "&&") return walk(n.left) && walk(n.right);
+                if (n.operator === "||") return walk(n.left) || walk(n.right);
+                if (n.operator === "=~" || n.operator === "!~") {
+                    assert(n.left.type === "Literal", `Not a Literal: ${JSON.stringify(n.left)}`);
+                    assert(n.right.type === "Literal", `Not a Literal: ${JSON.stringify(n.right)}`);
+                    const leftStr = n.left as jsep.Literal;
+                    const rightStr = n.right as jsep.Literal;
+                    if (leftStr.value === null)
+                        return n.operator === "!~"; // null =~ /p/ → false; null !~ /p/ → true
+                    if (rightStr.value === null)
+                        return false;
+                    let regexStr: string = rightStr.raw;
+                    regexStr = this.stripQuotes(regexStr);
+
+                    const regex = /\/(?<pattern>.*)\/(?<flags>[igmsuy]*)/;
+                    const _rhs = regexStr.replace(regex, (_: string, pattern: string, flags: string) => {
+                        const flagsBinary = flagsToBinary(flags);
+                        return `RE2JS.compile(${JSON.stringify(pattern)}, ${flagsBinary})`;
+                    });
+
+                    const _operator = n.operator === "=~" ? "!=" : "=="; // =~ -> !=; !~ -> ==
+
+                    const evalStr = `${leftStr.raw}.matchRE2JS(${_rhs}) ${_operator} null`;
+
+                    let res;
+                    try {
+                        (globalThis as any).RE2JS = RE2JS;
+                        res = (0, eval)(evalStr); // indirect eval
+                        delete (globalThis as any).RE2JS;
+                    } catch (error) {
+                        console.error(error);
+                        const assertMsg = [
+                            "Error attempting to evaluate the following rules:",
+                            "  rules:",
+                            `    - if: '${Utils._nodeToAtom(node, envs)}'`,
+                            "as",
+                            "```javascript",
+                            `${evalStr}`,
+                            "```",
+                        ];
+                        assert(false, assertMsg.join("\n"));
+                    }
+                    return Boolean(res);
+                }
+            }
+            // assert (node.type === "Literal", `not a Literal: ${JSON.stringify(node)}`)
+            const res = Utils._evaluateRuleIf(Utils._nodeToAtom(node, envs), envs);
+            // console.log(`${JSON.stringify(node)} -> ${res}`)
+            return res;
+        };
+
+        return walk(jsep(evalStr));
+    }
+
+    static _evaluateRuleIf (ruleIf: string | undefined, envs: {[key: string]: string}): boolean {
+        if (ruleIf === undefined) return true;
+        assert(!/\$\{\w+\}/.test(ruleIf), chalk`rules:rule if invalid expression syntax: {blueBright ${ruleIf}}\nuse {green $VAR} not {red \${VAR\}} in rules:if`);
+        let evalStr = ruleIf;
 
         const flagsToBinary = (flags: string): number => {
             let binary = 0;
@@ -232,7 +350,6 @@ export class Utils {
             return binary;
         };
 
-        // Expand all variables
         evalStr = this.expandTextWith(evalStr, {
             unescape: JSON.stringify("$"),
             variable: (name) => JSON.stringify(envs[name] ?? null).replaceAll("\\\\", "\\"),
@@ -246,10 +363,10 @@ export class Utils {
             let _operator;
             switch (operator) {
                 case "=~":
-                    _operator = "!=";
+                    _operator = "!="; // Matches are found (!= null)
                     break;
                 case "!~":
-                    _operator = "==";
+                    _operator = "=="; // Matches are not found (== null)
                     break;
                 default:
                     throw operator;
@@ -274,10 +391,10 @@ export class Utils {
             let _operator;
             switch (operator) {
                 case "=~":
-                    _operator = "!=";
+                    _operator = "!="; // Matches are found (!= null)
                     break;
                 case "!~":
-                    _operator = "==";
+                    _operator = "=="; // Matches are not found (== null)
                     break;
                 default:
                     throw operator;