Add package pattern overrides for cooldown

[ksivamuthu-cei]

This pull request adds support for per-package pattern cooldown overrides in the cooldown package, allowing configuration of cooldown durations using glob patterns that match multiple packages (such as all packages in an npm scope). It updates the resolution order for cooldowns, improves documentation, and adds tests for the new functionality.

Pattern-based configuration support

• Introduced a new PackagePatterns field to Config for specifying cooldown durations using glob patterns against versionless PURLs. Patterns are parsed, validated, and sorted by specificity, with exact package matches taking precedence over patterns. [1] [2]
• Updated the cooldown resolution order in Config.For to: exact package override > package pattern override > ecosystem override > global default.
• Added a helper function to match PURLs against patterns, including decoding %40 to @ for npm scopes.

Documentation updates

• Updated README.md to describe the new PackagePatterns field, its usage, precedence rules, and pattern matching behavior. [1] [2] [3]

Testing

• Added tests to verify correct behavior of package pattern overrides, precedence over exact matches, and default fallback.
• Updated existing tests to cover the new PackagePatterns field in configuration.

[Copilot]

Pull request overview

Adds per-package glob-pattern cooldown overrides to cooldown.Config, enabling configuration of cooldown durations for groups of packages (e.g., an npm scope) and updating the cooldown resolution order accordingly.

Changes:

• Introduces Config.PackagePatterns (glob patterns over versionless PURLs), parsed and used between exact package overrides and ecosystem defaults.
• Updates cooldown resolution logic (Config.For) and Enabled() to account for pattern-based overrides.
• Extends documentation and adds tests covering pattern precedence and behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
README.md	Documents PackagePatterns, precedence, and matching semantics.
cooldown.go	Implements pattern parsing, ordering, and matching in cooldown resolution.
cooldown_test.go	Adds tests for pattern overrides and updates Enabled() coverage.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[andrew]

Thanks for this. The use case (zero cooldown for an internal npm scope) is real, but I don't think cooldown.Config is the right place for pattern matching.

The two consumers of this library are git-pkgs/proxy and git-pkgs/pin. In proxy the plan is to lift the per-version check into a general filter interface (git-pkgs/proxy#127) that cooldown, vuln blocking, and namespace patterns (git-pkgs/proxy#128) all sit behind. Putting globs inside cooldown pre-empts that and only covers the cooldown-duration case, not the block-entirely case #128 is about.

There's also an encoding mismatch: proxy and pin both pass canonical %40-encoded PURLs to IsAllowed, and proxy handles @ in config by normalising keys to canonical form via purl.Parse (see CooldownConfig.NormalizedPackages). This PR decodes the lookup value instead, so Packages and PackagePatterns would end up needing different key encodings in the same proxy config file.

I see you've already got a feat/cooldown-package-patterns branch on your proxy fork that does this as an internal/cooldownpolicy wrapper with a CooldownPolicy interface on handler.Proxy. That approach is a much better fit: it normalises @→%40 on the pattern side (consistent with the existing config handling), surfaces bad globs/durations as startup errors, doesn't change this library, and is basically the first step of #127. Please open that as a PR against git-pkgs/proxy and reference #127 — happy to review it there.

[ksivamuthu-sbs]

Thanks. I will create PR there.