PassiveRulesUpdater

Default location for the image-baked ruleset. Resolves via bundled_rules_path so specs (and adventurous packagers) can point at a different prefix with NOIR_BUNDLED_RULES_PATH.

Force git into non-interactive mode so a missing/expired credential never drops the scan into an invisible username/password prompt that blocks forever (CI, automation). git exits with an error instead.

True when the image-baked ruleset is available and the user hasn't provided their own. Callers use this to skip the git-clone fallback (which costs network + a git binary the image doesn't ship).

Image-baked rules location. The official Docker image clones noir-passive-rules at build time and drops the result here so noir scan -P Just Works without network or git. Bare installs (homebrew / snap / source) won't have this path — user_rules_path wins on those.

Check if the passive rules directory is a git repository and needs updates

Where noir scan -P should actually read rules from. Preference order: user-managed path (so user-added rules and rules update both win) → bundled image path → user path (gives the clone fallback in initialize_rules something concrete to populate).

Initialize passive rules if they don't exist

The user-managed rules path: where noir rules update clones to, where noir rules path reports, and the canonical writable location an end-user owns. Kept out of effective_rules_path so the CLI rules subcommand has a stable single answer.