What's missing or awkward today?
All detection rules are hardcoded Java (src/main/java/io/sprig/rule/rules/*). Anyone with an org-specific pattern to catch (e.g. an internal insecure API, a banned annotation) has to fork sprig and write a new Rule implementation.
Proposed change
Support a declarative rule format in YAML (path/AST pattern + message + severity) that sprig loads at runtime alongside the built-in rules, without requiring a rebuild. Roadmap item from README; format/scope (source-only vs. config-only vs. both) not yet decided.
What's missing or awkward today?
All detection rules are hardcoded Java (
src/main/java/io/sprig/rule/rules/*). Anyone with an org-specific pattern to catch (e.g. an internal insecure API, a banned annotation) has to fork sprig and write a newRuleimplementation.Proposed change
Support a declarative rule format in YAML (path/AST pattern + message + severity) that sprig loads at runtime alongside the built-in rules, without requiring a rebuild. Roadmap item from README; format/scope (source-only vs. config-only vs. both) not yet decided.