Make lint exit non-zero on invalid rules, and validate rules in CI

.github/workflows/lint-rules.yml

@@ -0,0 +1,44 @@
+---
+name: lint-rules
+
+on:
+  pull_request:
+    paths:
+      - 'rules/**'
+      - 'src/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - '.github/workflows/lint-rules.yml'
+  push:
+    branches: [master]
+    paths:
+      - 'rules/**'
+      - 'src/**'
+
+jobs:
+  lint-rules:
+    name: Validate detection rules
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Install Rust
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+          profile: minimal
+          override: true
+
+      - name: Cache cargo build
+        uses: Swatinem/rust-cache@v2
+
+      - name: Build chainsaw
+        run: cargo build --release
+
+      # Lints against the binary built from this PR, so a rule relying on a
+      # schema change in the same PR is validated against that change.
+      - name: Lint detection rules
+        run: ./target/release/chainsaw --no-banner lint --kind chainsaw rules/

src/main.rs

@@ -927,6 +927,9 @@ fn run() -> Result<()> {
                 count,
                 count + failed
             );
+            if failed > 0 {
+                anyhow::bail!("{} detection rule(s) failed to validate", failed);
+            }
         }
         Command::Search {
             path,