feat(pipeline): add dynamic source detection and parsing

.github/workflows/ci.yml

@@ -153,15 +153,3 @@ jobs:
         run: git clone --depth 1 https://github.com/SigmaHQ/sigma.git /tmp/sigma
       - name: Validate and compile all Sigma rules
         run: ./target/release/rsigma validate /tmp/sigma/rules/ --verbose
-
-  semver:
-    name: Semver Checks (informational)
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read # read repo
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-      - uses: obi1kenobi/cargo-semver-checks-action@6b69fcf40e9b5fb17adeb57e4b6ecd020649a239 # v2.9
-    continue-on-error: true

crates/rsigma-cli/src/daemon/server.rs

@@ -107,6 +107,21 @@ pub async fn run_daemon(config: DaemonConfig) {
         config.include_event,
     );
     engine.set_pipeline_paths(config.pipeline_paths.clone());
+
+    for pipeline in &config.pipelines {
+        if pipeline.is_dynamic() {
+            for source in &pipeline.sources {
+                tracing::warn!(
+                    pipeline = %pipeline.name,
+                    source_id = %source.id,
+                    refresh = ?source.refresh,
+                    required = source.required,
+                    "Dynamic source detected -- source resolution not yet supported"
+                );
+            }
+        }
+    }
+
     let processor = Arc::new(LogProcessor::new(engine, metrics.clone()));
 
     // Initial rule load

crates/rsigma-cli/src/main.rs

@@ -869,6 +869,17 @@ pub(crate) fn load_pipelines(paths: &[PathBuf]) -> Vec<Pipeline> {
             match parse_pipeline_file(path) {
                 Ok(p) => {
                     eprintln!("Loaded pipeline: {} (priority {})", p.name, p.priority);
+                    if p.is_dynamic() {
+                        let source_ids: Vec<&str> =
+                            p.sources.iter().map(|s| s.id.as_str()).collect();
+                        eprintln!(
+                            "  warn: pipeline '{}' has {} dynamic source(s) ({}) \
+                             -- source resolution not yet supported",
+                            p.name,
+                            p.sources.len(),
+                            source_ids.join(", ")
+                        );
+                    }
                     pipelines.push(p);
                 }
                 Err(e) => {

crates/rsigma-eval/src/pipeline/mod.rs

@@ -39,6 +39,7 @@ pub mod builtin;
 pub mod conditions;
 pub mod finalizers;
 mod parsing;
+pub mod sources;
 pub mod state;
 pub mod transformations;
 
@@ -77,6 +78,10 @@ pub struct Pipeline {
     pub transformations: Vec<TransformationItem>,
     /// Finalizers (stored for YAML compat; eval-mode ignores them).
     pub finalizers: Vec<Finalizer>,
+    /// Dynamic source declarations from the `sources` section.
+    pub sources: Vec<sources::DynamicSource>,
+    /// Template references (`${source.*}`) found during parsing.
+    pub source_refs: Vec<sources::SourceRef>,
 }
 
 /// A single transformation with its gating conditions.
@@ -210,6 +215,17 @@ impl Pipeline {
         Ok(())
     }
 
+    /// Returns `true` if this pipeline declares any dynamic sources or contains
+    /// `${source.*}` template references.
+    pub fn is_dynamic(&self) -> bool {
+        !self.sources.is_empty() || !self.source_refs.is_empty()
+    }
+
+    /// Returns a slice of all source references found during parsing.
+    pub fn dynamic_references(&self) -> &[sources::SourceRef] {
+        &self.source_refs
+    }
+
     fn check_correlation_conditions(
         &self,
         corr: &CorrelationRule,