kubernetes/kubernetes · error

%q %s %q did not match any rule

Error message

%q %s %q did not match any rule

What it means

Emitted in verifyRules (main.go:399-401) when an import matched at least one rule's selectorRegexp (matched) but no rule produced a definitive DepAllowed or DepForbidden (!decided). Rule.Evaluate returned DepUnknown because the import matched neither any AllowedPrefixes nor any ForbiddenPrefixes (main.go:263-270). This is a rule-coverage gap: the selector targeted the import but the prefixes didn't classify it, so import-boss fails safe.

Source

Thrown at cmd/import-boss/main.go:401

				klog.V(6).Infof("selector %v matches %q", rule.SelectorRegexp, imp)

				disp := rule.Evaluate(imp)
				if disp == DepAllowed {
					decided = true
					break // no further rules, next file
				} else if disp == DepForbidden {
					errs = append(errs, fmt.Errorf("%q %s %q is forbidden by %s", pkg.PkgPath, relate(imp), imp, file.path))
					decided = true
					break // no further rules, next file
				}
			}
			if decided {
				break // no further files, next import
			}
		}
		if matched && !decided {
			klog.V(5).Infof("%q %s %q did not match any rule", pkg, relate(imp), imp)
			errs = append(errs, fmt.Errorf("%q %s %q did not match any rule", pkg.PkgPath, relate(imp), imp))
		}
	}

	if len(errs) > 0 {
		return errs
	}

	return nil
}

func uniq(slices ...[]string) []string {
	m := map[string]bool{}
	for _, sl := range slices {
		for _, str := range sl {
			m[str] = true
		}
	}
	ret := []string{}

View on GitHub (pinned to b882c60b40)

Solutions

1. Inspect the named import: add it to AllowedPrefixes (if ok) or ForbiddenPrefixes (if not) of the matching rule.
2. Tighten the selectorRegexp so it only matches imports the prefixes can classify.
3. If the import shouldn't be governed at all, narrow the selector to exclude it.

Example fix

# before -- selector matches client-go but neither prefix covers it
- selectorRegexp: k8s[.]io
  allowedPrefixes:
    - k8s.io/api          # client-go matches selector, undecided -> error

# after -- explicitly allow or forbid
- selectorRegexp: k8s[.]io
  allowedPrefixes:
    - k8s.io/api
    - k8s.io/client-go    # now decided DepAllowed

// Detect coverage gaps before import-boss fails: every import the selector
// matches must hit an allowed or forbidden prefix.
for _, imp := range allImports {
    if !ruleSel.MatchString(imp) { continue }
    if rule.Evaluate(imp) == DepUnknown {
        fmt.Printf("undecided import: %s\n", imp)
    }
}

When it happens

Trigger: A selectorRegexp matches an import path, but the rule's AllowedPrefixes/ForbiddenPrefixes don't cover that path. E.g. selector `k8s.io` matches `k8s.io/client-go`, but the rule only lists allowedPrefixes: [k8s.io/api] with no forbidden prefix, leaving client-go undecided.

Common situations: Adding a broad selector without covering all imports it sweeps in; renaming a package so it falls out of both prefix lists; a new import under an existing selector nobody classified.

Related errors

• error finding rules file: %w
• couldn't unmarshal %v: %w
• regexp `%s` in file %q doesn't compile: %w
• %q %s %q is forbidden by %s
• error(s) in %q: %w

AI-assisted analysis of kubernetes/kubernetes@b882c60b40 (2026-08-07). Data as JSON: /api/errors/3b06d43849e80c28. Report an issue: GitHub.