Skip to content

test: add acceptance suite verifying unified test API equivalence#6846

Open
JamesPatrickGill wants to merge 1 commit into
mainfrom
test/acceptance-test-for-unified-scanner-test
Open

test: add acceptance suite verifying unified test API equivalence#6846
JamesPatrickGill wants to merge 1 commit into
mainfrom
test/acceptance-test-for-unified-scanner-test

Conversation

@JamesPatrickGill
Copy link
Copy Markdown
Member

@JamesPatrickGill JamesPatrickGill commented May 27, 2026

Pull Request Submission Checklist

  • Follows CONTRIBUTING guidelines
  • Commit messages
    are release-note ready, emphasizing
    what was changed, not how.
  • Includes detailed description of changes
  • Contains risk assessment (Low | Medium | High)
  • Highlights breaking API changes (if applicable)
  • Links to automated tests covering new functionality
  • Includes manual testing instructions (if necessary)
  • Updates relevant GitBook documentation (PR link: ___)
  • Includes product update to be announced in the next stable release notes

What does this PR do?

Add acceptance tests for the new unified scanner flow. This add the framework and the first few tests that compare the current test flow to the new test flow to make sure we return matching results.
To get behaviours to match needed to push a change to os-flows to make sure when the --all-project flag is enabled it handles errors in the same way.

What's the product update that needs to be communicated to CLI users?

None this is just adding tests.

@JamesPatrickGill JamesPatrickGill requested review from a team as code owners May 27, 2026 08:59
@snyk-io
Copy link
Copy Markdown

snyk-io Bot commented May 27, 2026

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@snyk-pr-review-bot

This comment has been minimized.

@JamesPatrickGill JamesPatrickGill marked this pull request as draft May 27, 2026 09:04
@james-snyk james-snyk force-pushed the test/acceptance-test-for-unified-scanner-test branch 7 times, most recently from b0104d0 to 8e6701e Compare June 2, 2026 17:15
Adds equivalence harness that runs `snyk test` twice against the same
fakeServer — once with the FF `internal_snyk_cli_use_unified_test_api_for_os_cli_test`
off (legacy TS path → /test-dep-graph) and once with it on (os-flows
path → /rest/orgs/:orgId/tests) — and asserts the dep graphs submitted,
project counts, and exit codes match. Output presentation is
intentionally not compared; only the structural data the backend sees.

Starter corpus covers four fixtures (npm-package, maven-app,
mono-repo-project --all-projects, no-supported-target-files). Helpers
in equivalenceHelpers.ts are reusable for an extended sweep across
sibling plugin/parser repos.

# Conflicts:
#	cliv2-private/go.mod
#	cliv2-private/go.sum
#	cliv2/go.mod
#	cliv2/go.sum
@james-snyk james-snyk force-pushed the test/acceptance-test-for-unified-scanner-test branch from 8e6701e to 7c89fa0 Compare June 2, 2026 17:15
Copy link
Copy Markdown
Member Author

@JamesPatrickGill JamesPatrickGill left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGYM

@james-snyk james-snyk marked this pull request as ready for review June 3, 2026 09:00
@snyk-pr-review-bot
Copy link
Copy Markdown

PR Reviewer Guide 🔍

🧪 PR contains tests
🔒 No security concerns identified
⚡ Recommended focus areas for review

Brittle Request Matching 🟡 [minor]

The captureFlow function differentiates between 'legacy' and 'unified' flows by filtering requests based on URL substrings (/test-dep-graph) and regex (/rest/orgs/.../tests). If the CLI extensions or GAF layer update their routing or API versions (e.g., changing from /v1/test-dep-graph to a newer version), these acceptance tests will silently report 0 submissions and potentially pass incorrectly or fail with 'inconclusive' errors.

const submissionCount =
  mode === 'legacy'
    ? requests.filter(
        (r) =>
          r.method === 'POST' &&
          typeof r.url === 'string' &&
          r.url.includes('/test-dep-graph'),
      ).length
    : requests.filter(
        (r) =>
          r.method === 'POST' &&
          typeof r.path === 'string' &&
          /^\/rest\/orgs\/[^/]+\/tests$/.test(r.path),
      ).length;
Manual Flag Mapping 🟡 [minor]

The batchNameToConfigKey map in the new feature flag evaluation endpoint requires manual maintenance. If a developer adds a new acceptance test for a feature gated by a flag where the API name differs from the internal GAF config key, the test will default to false unless this map is updated. This creates a synchronization burden between the Go implementation and the TS test harness.

const batchNameToConfigKey: Record<string, string> = {
  'unified-test-api-os-cli':
    'internal_snyk_cli_use_unified_test_api_for_os_cli_test',
};
📚 Repository Context Analyzed

This review considered 11 relevant code sections from 6 files (average relevance: 1.00)

🤖 Repository instructions applied (from AGENTS.md)

@james-snyk james-snyk enabled auto-merge June 3, 2026 10:05
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

small suggestion: I think this ties a bit more to the OSS product line, so I might suggest we move somewhere under test/jest/acceptance/snyk-test. I think it's a bit more suitable than having this under the Jest utils which are command/product line agnostic.

* FF off — TS CLI posts dep graphs to /test-dep-graph (legacy path)
* FF on — Go binary's os-flows extension posts to /rest/orgs/:orgId/tests
*
* The flag under test is `internal_snyk_cli_use_test_shim_for_os_cli_test`
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

question: I can't wrap my head around this: The ..._use_test_shim_... is the one we are looking to test, but the helpers use the ..._use_unified_test_api_.... Is this correct? Should this comment be adapted?

}))
.sort((a, b) => a.displayTargetFile.localeCompare(b.displayTargetFile));
} catch {
return [];
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

small nit: Maybe logging the error would be better to avoid silent failures.


// Use a clean HOME for both runs so the Go binary's GAF reads from a fresh
// configstore with no locally-stored OAuth token that would override SNYK_API.
const cleanEnv = { ...env, HOME: os.tmpdir() };
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

super small nit: I think the os.tmpdir() calls resolves the same location, so I'm not sure it's working as advertised by the comment above.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants