From 4056b95207bbbbfd4d73651ba930d09ede87f3d1 Mon Sep 17 00:00:00 2001 From: Fede Barcelona Date: Thu, 9 Jul 2026 13:18:18 +0200 Subject: [PATCH 1/2] chore: address scanner-version-testing review feedback MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Make the newest and oldest fixture parse tests symmetric: both fixtures are committed, so the oldest test no longer skips via assumeTrue while the newest hard-fails — a missing fixture is a real failure for both. Document that the scanner recipes assume GNU sed/date and that regenerating fixtures (and thus `just update`) needs network access and SECURE_API_TOKEN, while normal builds and the test suite run against the committed fixtures without either. --- CONTRIBUTING.md | 8 ++++++++ .../com/sysdig/jenkins/plugins/sysdig/TestMother.java | 8 -------- .../scanner/report/v1/JsonScanResultTest.java | 5 ----- 3 files changed, 8 insertions(+), 13 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index cc2cf4b..f7966bd 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -66,6 +66,14 @@ The project includes a `justfile` with useful commands: just verify ``` +> **Note:** The `scanner` recipes (`just --list`) assume the GNU versions of `sed`/`date` +> (provided by the Nix devshell — run them from `nix develop`). Bumping the scanner testing +> window with `just update-cli-scanner` / `just update-oldest-cli-scanner` only rewrites the +> version markers; regenerating the checked-in fixtures with `just generate-scanner-fixtures` +> (also pulled in by `just update`) runs a real scan, so it requires network access and a +> valid `SECURE_API_TOKEN` (optionally `SECURE_API_URL`). A plain `mvn`/`just` build and the +> test suite run against the committed fixtures and need neither. + ## Making Changes - The project follows the **Ports and Adapters (Hexagonal) Architecture**. Please ensure that your contributions respect this design pattern to maintain modularity and separation of concerns. diff --git a/src/test/java/com/sysdig/jenkins/plugins/sysdig/TestMother.java b/src/test/java/com/sysdig/jenkins/plugins/sysdig/TestMother.java index eef6522..74861b9 100644 --- a/src/test/java/com/sysdig/jenkins/plugins/sysdig/TestMother.java +++ b/src/test/java/com/sysdig/jenkins/plugins/sysdig/TestMother.java @@ -128,14 +128,6 @@ public static JsonScanResultV1 scanResultFromOldestScanner() { return loadGzippedScanResult(OLDEST_FIXTURE); } - /** - * @return whether the oldest-version fixture has been generated and checked in. Tests use this - * to skip (rather than fail) until a developer runs {@code just generate-scanner-fixtures}. - */ - public static boolean oldestScannerFixtureAvailable() { - return TestMother.class.getClassLoader().getResource(OLDEST_FIXTURE) != null; - } - private static JsonScanResultV1 loadGzippedScanResult(String resourcePath) { InputStream imageStream = TestMother.class.getClassLoader().getResourceAsStream(resourcePath); assertNotNull(imageStream, "Missing fixture: " + resourcePath + " (run `just generate-scanner-fixtures`)"); diff --git a/src/test/java/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/report/v1/JsonScanResultTest.java b/src/test/java/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/report/v1/JsonScanResultTest.java index 469c3a1..03316b8 100644 --- a/src/test/java/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/report/v1/JsonScanResultTest.java +++ b/src/test/java/com/sysdig/jenkins/plugins/sysdig/infrastructure/scanner/report/v1/JsonScanResultTest.java @@ -1,7 +1,6 @@ package com.sysdig.jenkins.plugins.sysdig.infrastructure.scanner.report.v1; import static org.junit.jupiter.api.Assertions.*; -import static org.junit.jupiter.api.Assumptions.assumeTrue; import com.sysdig.jenkins.plugins.sysdig.TestMother; import com.sysdig.jenkins.plugins.sysdig.domain.vm.scanresult.*; @@ -214,10 +213,6 @@ void whenParsingNewestScannerOutputThePluginProducesAValidPopulatedResult() { @Test void whenParsingOldestMaintainedScannerOutputThePluginProducesAValidPopulatedResult() { - assumeTrue( - TestMother.oldestScannerFixtureAvailable(), - "oldest-version fixture not generated yet; run `just generate-scanner-fixtures`"); - // Recorded raw output from the oldest still-maintained CLI scanner (TestMother.OLDEST_FIXTURE_VERSION). // Proves the plugin keeps working against an older output format. ScanResult result = TestMother.scanResultFromOldestScanner().toDomain().orElseThrow(); From baf4a2502d448e717fc74c49dd004b873597a82c Mon Sep 17 00:00:00 2001 From: Fede Barcelona Date: Thu, 9 Jul 2026 13:20:37 +0200 Subject: [PATCH 2/2] build: provide the scanner recipe tooling via the Nix devshell The justfile `scanner` recipes need GNU sed/date/grep plus curl, jq and gzip; rather than just documenting the assumption, add them to the devShell so they are available out of the box (notably GNU sed/date on macOS, where the system defaults are BSD). --- CONTRIBUTING.md | 14 +++++++------- flake.nix | 7 +++++++ 2 files changed, 14 insertions(+), 7 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index f7966bd..c38b643 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -66,13 +66,13 @@ The project includes a `justfile` with useful commands: just verify ``` -> **Note:** The `scanner` recipes (`just --list`) assume the GNU versions of `sed`/`date` -> (provided by the Nix devshell — run them from `nix develop`). Bumping the scanner testing -> window with `just update-cli-scanner` / `just update-oldest-cli-scanner` only rewrites the -> version markers; regenerating the checked-in fixtures with `just generate-scanner-fixtures` -> (also pulled in by `just update`) runs a real scan, so it requires network access and a -> valid `SECURE_API_TOKEN` (optionally `SECURE_API_URL`). A plain `mvn`/`just` build and the -> test suite run against the committed fixtures and need neither. +> **Note:** The `scanner` recipes (`just --list`) rely on GNU `sed`/`date`/`grep`, `curl`, +> `jq` and `gzip`, all provided by the Nix devshell — run them from `nix develop`. Bumping the +> scanner testing window with `just update-cli-scanner` / `just update-oldest-cli-scanner` only +> rewrites the version markers; regenerating the checked-in fixtures with +> `just generate-scanner-fixtures` (also pulled in by `just update`) runs a real scan, so it +> requires network access and a valid `SECURE_API_TOKEN` (optionally `SECURE_API_URL`). A plain +> `mvn`/`just` build and the test suite run against the committed fixtures and need neither. ## Making Changes diff --git a/flake.nix b/flake.nix index 6a40248..fc284a8 100644 --- a/flake.nix +++ b/flake.nix @@ -35,6 +35,13 @@ jdk prek just + # Tooling the justfile `scanner` recipes rely on (GNU sed/date/grep, curl, jq, gzip). + coreutils + gnused + gnugrep + curl + jq + gzip ]; shellHook = ''