Module config_rules_file 

The rulesFile option: a repository-relative name that stays inside the repository. What: The rulesFile option of security/forbidden-strings: which file in the repository holds the scanner’s private rules, written relative to the repository’s top level. Why: The user decided on 2026-10-05 that configuration names the rules file first, then FORBIDDEN_STRINGS_RULES, then the default file. A configured name is checked when the configuration is read: it must stay inside the repository by its words alone, so a configuration cannot point the scanner at a file elsewhere on the machine. A name that is missing on disk is not a configuration error; loading the rules reports it when the policy runs.

In TS you’d write (pseudocode):

// const rulesFile = parseRulesFile(option); // throws RulesFileRefusal

Enums

RulesFileRefusal

What: Why a rulesFile value was refused. #[derive(...)] generates copying, debug printing and ==. Why: The configuration error names the key and explains this one reason.

Functions

check_rules_file

What: Check one rulesFile value. Result<(), RulesFileRefusal> is “accepted” or the first reason it is not. Why: A value that is relative, uses / between non-empty components, and has no . or .. component names a file inside the repository on every platform, whatever the file system later holds. The checks run in a fixed order so the first reason reported is the same on every platform.

rules_file_refusal_reason

What: The explanation of one refusal, completing the sentence “the value …”. Why: One place owns the words, so every refusal reads the same.