From fa5c89c55a0ac549c9442d28d1c4f8d86904672a Mon Sep 17 00:00:00 2001
From: Matthias Bertschy <matthias.bertschy@gmail.com>
Date: Tue, 2 Jun 2026 12:47:55 +0200
Subject: [PATCH] test: make version-check test a robust live canary

TestVersionCheckHandler_getLatestVersion probed the live version-check
service with an empty clientVersion and asserted the response equaled
exactly v3.0.15. That was brittle on two axes: it broke whenever the
latest kubescape release bumped past 3.0.15 (version-sync auto-updates the
reference from GitHub releases), and a regression that dropped clientUpdate
entirely produced a confusing "want v3.0.15, got empty" diff rather than a
clear signal.

Assert the actual contract instead: the response is for the kubescape
client and ClientUpdate is a non-empty, valid semantic version. This keeps
the test useful as a live canary for the ksgf1v1 version-check function
(an empty clientVersion must be told the latest version) while surviving
routine release bumps. Reuses the package's existing golang.org/x/mod/semver
and normalizeVersion helper; no new dependency.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
---
 pkg/versioncheck/versioncheck_test.go | 88 ++++++++++-----------------
 1 file changed, 31 insertions(+), 57 deletions(-)

diff --git a/pkg/versioncheck/versioncheck_test.go b/pkg/versioncheck/versioncheck_test.go
index 83a9dbf..9740983 100644
--- a/pkg/versioncheck/versioncheck_test.go
+++ b/pkg/versioncheck/versioncheck_test.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"os"
-	"reflect"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -83,62 +82,37 @@ func TestCheckLatestVersion(t *testing.T) {
 }
 
 func TestVersionCheckHandler_getLatestVersion(t *testing.T) {
-	type fields struct {
-		versionURL string
-	}
-	type args struct {
-		versionData *VersionCheckRequest
-	}
-	tests := []struct {
-		name    string
-		fields  fields
-		args    args
-		want    *VersionCheckResponse
-		wantErr bool
-	}{
-		{
-			name: "Get latest version",
-			fields: fields{
-				versionURL: "https://version-check.ks-services.co",
-			},
-			args: args{
-				versionData: &VersionCheckRequest{
-					Client: "kubescape",
-				},
-			},
-			want: &VersionCheckResponse{
-				Client:       "kubescape",
-				ClientUpdate: "v3.0.15",
-			},
-			wantErr: false,
-		},
-		{
-			name: "Failed to get latest version",
-			fields: fields{
-				versionURL: "https://example.com",
-			},
-			args: args{
-				versionData: &VersionCheckRequest{},
-			},
-			want:    nil,
-			wantErr: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			v := &VersionCheckHandler{
-				versionURL: tt.fields.versionURL,
-			}
-			got, err := v.getLatestVersion(tt.args.versionData)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("VersionCheckHandler.getLatestVersion() error = %v, wantErr %v", err, tt.wantErr)
-				return
-			}
-			if !reflect.DeepEqual(got, tt.want) {
-				t.Errorf("VersionCheckHandler.getLatestVersion() = %v, want %v", got, tt.want)
-			}
-		})
-	}
+	t.Run("Get latest version", func(t *testing.T) {
+		// Live canary against the deployed version-check service. A request
+		// with an empty clientVersion MUST be told the latest version -- this
+		// guards the ksgf1v1 regression where empty/unparseable client
+		// versions silently received no clientUpdate. We assert a *valid*
+		// version rather than a hardcoded one so routine kubescape releases
+		// (which bump the reference) don't break this test.
+		v := &VersionCheckHandler{
+			versionURL: "https://version-check.ks-services.co",
+		}
+		got, err := v.getLatestVersion(&VersionCheckRequest{Client: "kubescape"})
+		if err != nil {
+			t.Fatalf("getLatestVersion() unexpected error = %v", err)
+		}
+		if got == nil {
+			t.Fatal("getLatestVersion() returned a nil response")
+		}
+		assert.Equal(t, "kubescape", got.Client)
+		assert.NotEmpty(t, got.ClientUpdate, "empty clientVersion must be told the latest version")
+		assert.True(t, semver.IsValid(normalizeVersion(got.ClientUpdate)),
+			"ClientUpdate %q must be a valid semantic version", got.ClientUpdate)
+	})
+
+	t.Run("Failed to get latest version", func(t *testing.T) {
+		v := &VersionCheckHandler{
+			versionURL: "https://example.com",
+		}
+		got, err := v.getLatestVersion(&VersionCheckRequest{})
+		assert.Error(t, err)
+		assert.Nil(t, got)
+	})
 }
 
 func TestGetTriggerSource(t *testing.T) {