feat: add oneOf set-membership matcher to rate-limit rules

Sankalprequested to merge
sankalp/rate-limit-oneof-matcher into master

What does this MR do and why?

Adds a oneOf set-membership matcher to Labkit::RateLimit::Matcher, alongside the existing eq and re matchers. Canonical, YAML-compatible form:

match: { requester_id: { oneOf: ["7", "42"] } }

GitLab's rack rate limiting needs one skip rule that matches a list of allowlisted user IDs (gitlab-com/gl-infra/production-engineering#29320 (closed)), to model the RackAttack user allowlist as an explicit skip rule. A regex union of IDs would break the 200-char cap on the {re: "..."} string form, and per-ID eq rules multiply with the allowlist size.

oneOf follows the PromQL selector convention used in the runbooks (libsonnet/promql/selectors.libsonnet in gitlab-com/runbooks) instead of in, since in is a keyword in other languages labkit targets, such as Python. Naming chosen by @reprazent in the work item discussion.

Semantics

  • Source must be an Array; anything else raises ArgumentError.
  • Members are stored as a frozen Set.
  • Matching is equality-based membership, no type coercion, same as eq ("99" does not match member 99).
  • An empty array matches nothing.
  • A bare Array as a match value is still rejected, so it fails loudly instead of silently becoming a membership test.

Matcher spec covers build and match behavior. Full rate_limit suite passes (340 examples). Extending the matcher vocabulary further is the anticipated follow-up, tracked in gitlab-com/gl-infra/production-engineering#28853. This is a feat: commit, so merging auto-releases a minor version via semantic-release.

References

Merge request reports