[haimbj1]

The async-poll deny rule never applies. GCP rejects its regex:

Error parsing Cloud Armor rule matcher expression: Invalid regular expression:
(?i)^/+v2/+(decrypt|sealoutput)/, Capture Groups are not allowed.

Found on the staging roll. The template and the MIG roll applied. The policy update failed as a whole, so the policy still has only its old rules.

Fix: make the group non-capturing, (?:decrypt|sealoutput). The paths it matches do not change.

Test:

• GCP accepts the new expression on a temporary policy in fhenix-dev (deleted after).
• Staging plan from this branch: 0 to add, 1 to change, 0 to destroy (the policy only).

Summary by CodeRabbit

• Bug Fixes
  • Improved matching for deprecated async decrypt and seal-output polling endpoints. Requests to these paths continue to receive an HTTP 404.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The deprecated-poll Cloud Armor rule now uses a non-capturing regex group. Its endpoint prefixes and HTTP 404 deny action remain unchanged.

Changes: Cloud Armor rule

Layer / File(s)	Summary
Deprecated-poll regex update compute/main.tf	The rule's path regex changes to use a non-capturing group. The matched endpoint prefixes and deny action remain unchanged.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Possibly related PRs

• FhenixProtocol/teecryptor#15: Adds the priority-100 Cloud Armor deny rule that this change updates.

Suggested reviewers: liorbond

Merge Risk: Minimal · up to 3c101

No actionable merge-blocking risk is evident in this focused regex-only change.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the main change: fixing the Cloud Armor rejection of the async-poll deny regex.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Team
• Run ID: d61f905f-e015-44d8-8200-4b33f4106de4

Commits

Reviewing files that changed from the base of the PR and between 9503f2c and 3c101f7.

Files selected for processing: 1

• compute/main.tf

Included review availability: This review used your included allowance. 7 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 8 reviews per hour.