fix: tighten extension anonymize rules after QA

[Lena Forlin (moshimorschi)]

What changed?

These are the fixes from the QA of #1635. They're one PR into your branch, so you can take what you like.

• A broken extension config now stops the dump. Before, --anonymize silently skipped that extension, and its secrets stayed in the dump.
• Built-in rules win over extension rules. An extension could switch off customer anonymization with customer.email: email.
• JSON_REMOVE rules on the same column are combined. With Mollie and PayPal installed, PayPal's data in order_transaction.custom_fields stayed in the dump.
• Faker values inside JSON are escaped. faker.Address.Address() broke the import.
• Text around a faker template in dump.rewrite works again (qa+{{- faker.Internet.User() -}}@example.com), and faker inside SQL still works.
• Stricter config. A typo under anonymize is an error, and the schema requires key in system_config objects.
• Skill and README. The skill now validates with --only builtin, handles configs the build copies into place, sets sandbox or test mode, and covers JSON, free-text and unique columns. The README section no longer splits the environments text.

One heads-up: --only builtin needs #1627 from main, so it works once main is merged into your branch.

How was this tested?

Unit tests for each fix. End to end on MariaDB 11.8, including a restore and a storefront check, and the JSON case also on MySQL 8.4. Agents re-ran the skill on three real extensions.

Related issue or discussion

#1635, #1315

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 5435192d-4271-4537-8497-66b414f283d9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}