fix a bug where failed expressions would recompile on every event

[YakirOren]

Summary by CodeRabbit

• Bug Fixes
  • Improved robustness of expression evaluation by caching failed compilations to avoid repeated work and noisy errors.
  • Added safeguards so failed or missing expressions are skipped safely and return empty results instead of causing failures.
  • Improved logging for compilation/evaluation issues to aid diagnosis without affecting runtime behavior.

[coderabbitai]

📝 Walkthrough

Walkthrough

Added logging and caching of nil on compile/program-creation failures and introduced nil-program guards across CEL evaluation paths; evaluation skips expressions cached as nil and returns empty string on nil evaluation output. Event-type pre-filtering removal from map-based evaluation is retained.

Changes

Cohort / File(s)	Summary
CEL rule evaluation pkg/rulemanager/cel/cel.go	Cache nil for expressions on compile or program-creation failure and log warnings; add nil-program guards in program retrieval/evaluation paths (EvaluateRule, EvaluateRuleByMap, EvaluateExpression, EvaluateExpressionByMap, evaluateProgramWithContext); skip or return empty results when program/evaluation output is nil; retain removal of event-type pre-filtering in map-based evaluation.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 I hopped through code with careful paws,
Caching nil where compilers pause,
Guards in place, no crash or scream,
Empty outputs kept serene,
Quiet thumps for safer laws.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding nil-caching for failed expression compilations to prevent recompilation on subsequent events.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/failed-rule-recompilation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@pkg/rulemanager/cel/cel.go`:
- Around line 131-142: The code currently unconditionally sets
c.programCache[expression.Expression] = nil on any evaluation error from
program.Eval, which can permanently disable a valid expression; instead, remove
the unconditional cache invalidation and only invalidate the cache for
permanent/compilation errors by checking the error type (e.g., perform a type
assertion against known permanent error types from the CEL/xcel package such as
compile/static-check errors) before acquiring c.cacheMutex and setting
c.programCache[expression.Expression] = nil; for all other runtime/transient
errors return the error without mutating the cache and add a brief comment near
program.Eval explaining the rationale.

♻️ Duplicate comments (3)

pkg/rulemanager/cel/cel.go (3)

169-178: Nil check is correct; same eval-error caching concern applies.

The nil program guard is appropriate. The cache invalidation on evaluation error (lines 175-177) has the same concern as noted in EvaluateRule.

---

194-214: Nil check is correct; same eval-error caching concern applies.

The nil program guard is appropriate for EvaluateExpressionByMap. The cache invalidation on evaluation error has the same concern as noted earlier.

---

225-235: Nil check is correct; same eval-error caching concern applies.

The nil program guard is appropriate for EvaluateExpression. The cache invalidation on evaluation error has the same concern as noted earlier.

[matthyx]

please check https://github.com/kubescape/node-agent/pull/690/changes#r2709290176