Fix: proceed with evaluation when selector references an unknown entity property

[Copilot]

Using a property that doesn't exist in a profile selector (e.g., repository.properties.github['is_private']) caused a hard error: error evaluating rule type: error selecting entity: result is unknown. Properties are not guaranteed to be present, so evaluation should proceed rather than error.

Changes

pkg/engine/selectors/selectors.go

The Select() method now distinguishes two "unknown result" scenarios:

• WithUnknownPaths explicitly set — caller is in the first pass of a retry pattern; ErrResultUnknown is still returned to trigger a retry with complete data.
• No explicit unknown paths — property is simply absent from the entity; returns (true, "", nil) so evaluation proceeds.

if s.detailHasUnknowns(sel, details) {
    if len(opts.unknownPaths) > 0 {
        // Explicit unknown paths: signal caller to retry with more information.
        return false, "", ErrResultUnknown
    }
    // Property genuinely missing — proceed with evaluation.
    return true, "", nil
}

The same logic applies to the types.IsUnknown(out) fallback check.

pkg/engine/selectors/selectors_test.go

• Two existing test cases that expected ErrResultUnknown for missing properties (no WithUnknownPaths) updated to expect selected: true.
• TestSelectorEntityFillProperties "Fail to fetch a property" case updated: a property that can't be fetched no longer blocks evaluation (secondSucceeds: true).

Testing

Unit tests in pkg/engine/selectors/selectors_test.go cover the updated behavior directly. All selector and executor tests pass. The WithUnknownPaths retry-pattern tests remain unchanged and continue to return ErrResultUnknown as expected.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• www.google.com
  • Triggering command: /tmp/go-build3711714686/b1939/rego.test /tmp/go-build3711714686/b1939/rego.test -test.testlogfile=/tmp/go-build3711714686/b1939/testlog.txt -test.paniconexit0 -test.timeout=2m0s -o 1714686/b1867/_p-errorsas mpile ux-amd64/pkg/tool/linux_amd64/vet -p .io/otel/semconv--64 t ux-amd64/pkg/too/tmp/ccPlXZWt.o -o E1mN/pSRwwy3Gpf6wksvjE1mN t ux-amd64/pkg/tool/linux_amd64/vet -p github.com/open--quiet t ux-amd64/pkg/toox86_64-linux-gnu (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Using an unknown property in selectors gives: Error: error evaluating rule type: error selecting entity: result is unknown</issue_title>
<issue_description>I managed to use a property that does not exist in a selector and I received an error:

Error: error evaluating rule type: error selecting entity: result is unknown

This should not have happened, we should have at the very least have thrown a better error message. Ideally, though, the profile shouldn't have errored but we should have proceeded with the evaluation - the properties are not guaranteed to be there.</issue_description>

<agent_instructions>Write a test for this case, ensure it fails, and then add guarding logic to flag the incorrect property, if possible.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

@evankanderson This needs a test as well as code to cover the edge case.

• Fixes Using an unknown property in selectors gives: Error: error evaluating rule type: error selecting entity: result is unknown #4785

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[evankanderson]

I need to think about what the correct behavior here is. Some example cases:

repository.properties.github['is_private'] == true

repository.properties.github['is_private'] == false

repository.properties.github['slug'].endsWith('/.github')

[evankanderson]

There's an additional wrinkle that selectors apply to a specific type of entity (as shown in the documentation). From reading the code, it appears that all selectors for the appropriate entity type must currently succeed for the rule to be evaluated; if any selector fails or is unknown, then the rule evaluation is skipped.

It seems like a disjunctive normal form for the list (OR of ANDs) might make more sense, so an entity is selected if at least one selector passes. That's a larger change, though.

[github-actions]

This PR needs additional information before we can continue. It is now marked as stale because it has been open for 30 days with no activity. Please provide the necessary details to continue or it will be closed in 30 days.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}