Possible issue with --skip-files on folders containing symlinks in 6.2.1

[schinery]

Background

Brakeman version: 6.2.1 Rails version: 7.1.4 Ruby version: 3.3.4

Issue

I'm using a mono repo with a couple of Rails app and engine shared between them with the code symlinked, so looks like this:

|- app1
|-- engines/my-engine (my-engine is a symlink)
|- app2
|-- engines/my-engine (my-engine is a symlink)
|- my-engine

There are some warnings in the my-engine code, which we are ignored in its own brakeman.ignore file, so when running brakeman in the apps we are using --skip-files /engines/ to ignore checking my-engine again.

Since upgrading to 6.2.1, I'm now seeing warnings for the symlinked engine when running the same brakeman command in the app with the file path in the warnings being File: ../my-engine/app/models/path/to/file.rb.

I can stop the warnings by using --skip-files ../my-engine/ but wanted to check if this is now expected behaviour or is there an issue because the original --skip-files /engines/ should have meant that the symlink wasn't processed.

[presidentbeef]

This was not intentional but I'm not sure how to address it. Open to suggestions.

@lubert ?