fix(rulesengine): report matched sub-rules as written

[chiruu12]

Fixes #6694

_check_if_rule_apply rewrote null to "" by rebinding the loop variable, then appended that rewritten string as the sub-rule that matched. _process_event_for_history_based_rule compares those against sub-rules taken from rule.definition_cel, which still says null, so the sets could never be equal. Correlation rules with create_on: all and a null-bearing definition never reached is_all_conditions_met, so the incident was never made visible and the created event never fired.

The rewrite now happens on a separate variable, so evaluation is unchanged and the sub-rule is reported as written. The length check at line 158 was already unaffected, since it compares counts, so the single-alert case behaved correctly before and still does.

Added a regression test alongside the existing _check_if_rule_apply coercion test. It feeds two alerts to (source == "sentry") || (service != null), one satisfying each side, and asserts the matched set equals the extracted sub-rules. It fails on main and passes here.

pytest tests/test_alert_evaluation.py is green, 21 passed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[CLAassistant]

All committers have signed the CLA.

[shahargl]

Can u add tests to cover it?

[chiruu12]

Added test_rule_multiple_alerts_with_null_in_definition in tests/test_rules_engine.py. It creates a create_on=all rule whose CEL contains null, sends one alert matching each sub-rule, and asserts the incident is started. It fails on main and passes with the fix.

There was already a unit test in tests/test_alert_evaluation.py covering _check_if_rule_apply returning the sub-rule as written, but that one only pins the mechanism. This one covers the behaviour you would actually notice.

pytest tests/test_rules_engine.py tests/test_alert_evaluation.py passes, 56 tests.

[chiruu12]

Tests are pushed at f34b686 and CI is green. Ready for another look when you have time.

[chiruu12]

@shahargl tests are in. I pushed them as f34b686a about an hour after you asked, then never
replied here, so the review has been sitting on changes requested for a week. My fault.

Two of them, covering both levels:

• tests/test_rules_engine.py::test_check_if_rule_apply_returns_subrule_as_written_for_null pins
  the unit behaviour, that a sub-rule containing a null comparison is reported as written rather
  than rewritten.
• tests/test_alert_evaluation.py::test_rule_multiple_alerts_with_null_in_definition covers the
  same path end to end through incident creation, which is where the wrong text actually showed up.

Both fail on the commit before the fix and pass on it. Ready for another look.