Added sca resolver sbom first integration tests into their own CI matrix group(AST-159215) - #1541
Open
cx-sumit-morchhale wants to merge 8 commits into
Open
Added sca resolver sbom first integration tests into their own CI matrix group(AST-159215)#1541cx-sumit-morchhale wants to merge 8 commits into
cx-sumit-morchhale wants to merge 8 commits into
Conversation
Download the real ScaResolver executable once (sync.Once, isolated working dir) and share it across tests, then clean it up as the last test in the file, so the ~114MB binary is fetched a single time per run instead of per test. Covers a successful --sca-resolver run (asserting the resolver's own success log line) and the --no-scan without --sbom-first validation error. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Cover --no-scan + --sbom-first at the default location, --no-scan with custom --sbom-output-path/--sbom-output-name, --sbom-first without --no-scan (scan still submitted), and the --no-scan-without --sbom-first validation error, all using the real downloaded ScaResolver executable. Drop the end-of-file cleanup test in favor of letting the cached executable persist across runs, matching how the sca-realtime tests already handle their own download cache. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…matrix group The 5 sca-resolver tests in sca_resolver_test.go were being swept into the heavy "Scan Creation" matrix group because their names started with TestCreateScan*, adding the real ~114MB ScaResolver download and real scans to that group's already-long runtime. Renamed them to a unique TestIntegrationScaResolver* prefix and added a dedicated "SCA Resolver" matrix group so they run once, in parallel with the rest, with their own coverage profile picked up by the existing merge-coverage job. Also fixes a pre-existing compile error: osinstaller.InstallOrUpgrade was missing its required ascaWrapper argument, which broke the entire test/integration package build under -tags integration.
cx-sumit-morchhale
requested review from
cx-anjali-deore,
cx-anurag-dalke and
cx-umesh-waghode
as code owners
August 18, 2026 13:26
Contributor
Original alert (resolved)Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-sumit-morchhale) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
cx-sumit-morchhale
changed the title
These tests only need SCA results to assert on ScaResolver behavior. Removing iac-security cuts one engine out of the synchronous scan wait, reducing the chance of the 5-minute test context deadline being hit.
# Please enter a commit message to explain why this merge is necessary, # especially if it merges an updated upstream into a topic branch. # # Lines starting with '#' will be ignored, and an empty message aborts # the commit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--sca-resolverflow (test/integration/sca_resolver_test.go).TestIntegrationScaResolver*prefix and added a dedicated SCA Resolver matrix group inci-tests.ymlso they no longer get swept into the heavy "Scan Creation" group (they previously matched itsTestCreateScanpattern by accident, adding the real ~114MB ScaResolver download + real scans to that group's runtime).osinstaller.InstallOrUpgradewas missing its requiredascaWrapperargument, which broke thetest/integrationpackage build under-tags integration.Test plan
go vet -tags integration ./test/integration/...passes forsca_resolver_test.goTestIntegrationScaResolverpattern doesn't collide with any other matrix group's-runtoken (TestCreateScan,TestScaResolver, etc.)merge-coveragejob (globscoverage-*artifacts)