propose an alternative, cleaner configuration for appsec-config

[buixor]

Allow this format of configuration:

name: test-config
inband:
  rules:
    - crowdsecurity/vpatch-*
  on_match:
    - apply:
        - SetReturnCode(413)
outofband:
  rules:
    - something/smth
  pre_eval:
    - filter: "1==1"
      apply:
        - RemoveInBandRuleByID(123)

The goal is to avoid the user to have to prepand all their filter by IsInBand or OutBand conditions

[github-actions]

@buixor: There are no 'kind' label on this PR. You need a 'kind' label to generate the release automatically.

• /kind feature
• /kind enhancement
• /kind refactoring
• /kind fix
• /kind chore
• /kind dependencies

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[github-actions]

@buixor: There are no area labels on this PR. You can add as many areas as you see fit.

• /area agent
• /area local-api
• /area cscli
• /area appsec
• /area security
• /area configuration

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[buixor]

/area appsec
/kind enhancement

[codecov]

Codecov Report

❌ Patch coverage is 69.29134% with 39 lines in your changes missing coverage. Please review.
✅ Project coverage is 63.55%. Comparing base (fc1677b) to head (beed770).
⚠️ Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
pkg/appsec/appsec.go	68.37%	24 Missing and 13 partials ⚠️
pkg/acquisition/modules/appsec/appsec_runner.go	80.00%	0 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4397      +/-   ##
==========================================
+ Coverage   63.31%   63.55%   +0.24%     
==========================================
  Files         476      476              
  Lines       33796    33799       +3     
==========================================
+ Hits        21398    21482      +84     
+ Misses      10262    10182      -80     
+ Partials     2136     2135       -1     

Flag	Coverage Δ
bats	46.77% <40.15%> (+0.15%)	⬆️
unit-linux	36.50% <67.71%> (+0.31%)	⬆️
unit-windows	25.34% <42.51%> (+0.42%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR introduces a cleaner YAML configuration format for appsec-config by allowing phase-scoped sections (inband: / outofband:) that contain rules and hooks which are automatically dispatched only in the corresponding phase, reducing the need for users to manually add IsInBand / IsOutBand conditions.

Changes:

• Added phase-scoped configuration support (inband / outofband) with normalization into existing flat rule/option fields.
• Refactored hook compilation/execution to support common hooks + per-phase hooks (in-band vs out-of-band).
• Added/updated tests to validate new config parsing and phase-scoped hook dispatch behavior.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
pkg/appsec/appsec.go	Adds phase-scoped config structs, normalizes new YAML format, and compiles/dispatches hooks by phase.
pkg/appsec/appsec_config_test.go	New unit tests validating LoadByPath behavior for new/old/mixed formats.
pkg/acquisition/modules/appsec/appsec_test.go	Extends test harness to inject phase-scoped hooks into AppsecConfig.
pkg/acquisition/modules/appsec/appsec_runner.go	Updates early-return logic to reference new compiled hook locations.
pkg/acquisition/modules/appsec/appsec_hooks_test.go	Adds integration-style tests ensuring phase-scoped hooks execute as expected.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.