What causes "regexp `%s` in file %q doesn't compile: %w" in kubernetes/kubernetes?

Test the regex with an RE2 tester or a tiny Go regexp.Compile scratch program.

regexp `%s` in file %q doesn't compile: %w

Error message

regexp `%s` in file %q doesn't compile: %w

What it means

Thrown in verifyRules (main.go:337-341) when regexp.Compile(rule.SelectorRegexp) fails for a Rule in the Rules list of a .import-restrictions file. import-boss aborts rule evaluation for that package because it cannot match imports against an uncompiled selector. The offending regex and the file path are both in the message.

Source

Thrown at cmd/import-boss/main.go:340

// unchanged. It returns the new path and the removed directory. So:
// "a/b/c/file" -> ("a/b/file", "c")
func removeLastDir(path string) (newPath, removedDir string) {
	dir, file := filepath.Split(path)
	dir = strings.TrimSuffix(dir, string(filepath.Separator))
	return filepath.Join(filepath.Dir(dir), file), filepath.Base(dir)
}

func (boss *ImportBoss) verifyRules(pkg *packages.Package, restrictionFiles []*FileFormat) []error {
	klog.V(3).Infof("verifying pkg %q rules", pkg.PkgPath)

	// compile all Selector regex in all restriction files
	selectors := make([][]*regexp.Regexp, len(restrictionFiles))
	for i, restrictionFile := range restrictionFiles {
		for _, r := range restrictionFile.Rules {
			re, err := regexp.Compile(r.SelectorRegexp)
			if err != nil {
				return []error{
					fmt.Errorf("regexp `%s` in file %q doesn't compile: %w", r.SelectorRegexp, restrictionFile.path, err),
				}
			}

			selectors[i] = append(selectors[i], re)
		}
	}

	realPkgPath := unmassage(pkg.PkgPath)

	direct, indirect := transitiveImports(pkg)
	isDirect := map[string]bool{}
	for _, imp := range direct {
		isDirect[imp] = true
	}
	relate := func(imp string) string {
		if isDirect[imp] {
			return "->"
		}

View on GitHub (pinned to b882c60b40)

Solutions

Test the regex with an RE2 tester or a tiny Go regexp.Compile scratch program.
Use RE2 syntax: balance parens, escape literal dots (k8s[.]io), drop lookahead/lookbehind and backreferences.
Re-run import-boss after fixing.

Example fix

# before -- RE2 rejects lookahead / unclosed class
selectorRegexp: "^(?!safe)k8s.io(.*"
# after
selectorRegexp: "^k8s[.]io/"

Defensive patterns

Strategy: validation

Validate before calling

for _, r := range ff.Rules {
    if _, err := regexp.Compile(r.SelectorRegexp); err != nil {
        return fmt.Errorf("%s: bad selectorRegexp %q: %w", ff.path, r.SelectorRegexp, err)
    }
}

Try / catch

re, err := regexp.Compile(r.SelectorRegexp)
if err != nil {
    return []error{fmt.Errorf("regexp `%s` in file %q doesn't compile: %w", r.SelectorRegexp, restrictionFile.path, err)}
}

Prevention

Validate all selectorRegexp values in a pre-commit hook before import-boss runs.
Remember import-boss uses Go's RE2: no backreferences, no lookahead.
Escape literal dots and parens in selectors.

When it happens

Trigger: A selectorRegexp field contains invalid Go regexp (RE2) syntax: unescaped `(`, a dangling `*`, `[` without `]`, unsupported lookahead, etc. sigs.k8s.io/yaml accepted the string fine, but regexp.Compile rejects it.

Common situations: Copying a grep/PCRE regex with lookahead into selectorRegexp (RE2 has none); an unclosed character class like `[a-z`; a stray unbalanced parenthesis.

Related errors

AI-assisted analysis of kubernetes/kubernetes@b882c60b40 (2026-08-07). Data as JSON: /api/errors/73b723a14a88c7ca. Report an issue: GitHub.