Skip to content

Conversation

@aidenmitchell
Copy link
Owner

Testing the sync workflow with a phishing detection rule.

aidenmitchell and others added 8 commits January 16, 2026 10:56
- Extract monolithic sync_detection_rules.py into shared library modules
- Create separate sync_test_rules.py and sync_shared_samples.py scripts
- Move helper scripts to .github/scripts/
- Add PR commenting for exclusions (membership, bulk, link_analysis)
- Add do-not-merge label check to skip PRs from syncing
- Update rule-validate.yml to use local scripts
- Rename update-test-rules.yml to sync-test-rules.yml
- Add new sync-shared-samples.yml workflow

New directory structure:
.github/scripts/
  lib/           - Shared library modules
  sync_test_rules.py
  sync_shared_samples.py
  mql_format.py
  check_invisible_chars.py
  generate_rule_ids/

Co-Authored-By: Claude Opus 4.5 <[email protected]>
Introduces a caching layer that reduces API calls by 50-70%:
- Labels: fetched once per PR instead of 8-16 times
- Comments: fetched once per PR instead of twice
- Org membership: cached per user across all PRs

Co-Authored-By: Claude Opus 4.5 <[email protected]>
- Add prefetch_labels(), prefetch_pr_files(), prefetch_file_contents()
  methods to PRCache using ThreadPoolExecutor
- Update sync_shared_samples.py to prefetch all data in parallel before
  processing (93s -> 11s, ~88% faster)
- Update sync_test_rules.py with same parallel prefetching pattern

Co-Authored-By: Claude Opus 4.5 <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants