SAST tests: Creation of tests for SAST tasks #1843
Conversation
jperezdealgaba
force-pushed
the
sast-tests
branch
4 times, most recently
from
d895de6 to
b472131
Compare
|
@kdudka Would you mind giving a preliminary review? There are a few discussions needed here |
| workspace: tests-workspace | ||
| params: | ||
| - name: url | ||
| value: https://github.com/jperezdealgaba/test_unicode_control |
There was a problem hiding this comment.
@kdudka This is the repo that was used to test the original task (https://gitlab.cee.redhat.com/chhan/unicode_control_test). I moved it to GitHub as the tests couldn't resolve to the internal GitLab.
This is in my personal organization, I really think this should be moved to a more "professional" org if not choosing a different repository.
There was a problem hiding this comment.
@ralphbean Could we include the test data into https://github.com/konflux-ci/testrepo or another project in the konflux-ci GitHub namespace so that the tests do not depend on 3rd party repositories?
There was a problem hiding this comment.
@avi-biton @yftacherzog and @gbenhaim, can I defer to you guys on @kdudka's question?
There was a problem hiding this comment.
I think it will make better sense to create another repo under https://github.com/konflux-ci instead.
There was a problem hiding this comment.
Sure. Who should be responsible for creating them?
There was a problem hiding this comment.
Both @gbenhaim and @ralphbean should be able to create a repo under this org.
How do you want to name it? Who should have admin privileges there?
There was a problem hiding this comment.
Maybe creating a single repo called sast-testing-examples for examples? We can later there store all sast-examples and have a very big note in the README.md saying that the repo contains insecure code.
cc/ @kdudka
There was a problem hiding this comment.
Sounds good. As for the name, I would start with the test- prefix, e.g. test-data-sast. In case other test repos need to be created later on, they would be visually separated from other repos (when sorted by names).
There was a problem hiding this comment.
@ralphbean @gbenhaim Any update on this?
|
/ok-to-test |
| value: task/init/0.2/init.yaml | ||
| params: | ||
| - name: image-url | ||
| value: "quay.io/redhat-user-workloads/jperezde-tenant/tests/tests-sast-unicode-check:latest" |
There was a problem hiding this comment.
Another aspect to discuss is the fact that this repo doesn't exist. So the upload is never done. I understand that the upload process is outside of the scope of the function.
Do we want to upload the results?
There was a problem hiding this comment.
If we have a meaningful image-url that could be used for testing, it would increase the test coverage. If not, we can modify the task to skip the upload in case an empty string is provided as image-url, which is how the sast-snyk-check task worked initially.
There was a problem hiding this comment.
Just had a chat with the team:
"for this we need the quay push secrets ..and it will be again dependent on the story that we created for enabling of secrets https://issues.redhat.com/browse/STONEBLD-3196"
So it seems that until the secrets are not incorporated into the tests, we can not upload the results
There was a problem hiding this comment.
It would be nice to have the upload step covered, too. Yesterday I was fixing a regression in the upload step of the sast-coverity-check task, which was introduced by the Renovate bot: https://gitlab.cee.redhat.com/osh/cov-sa-container/-/merge_requests/63
Of course, it does not need to be part of this pull request, which is about creating some test coverage to begin with.
jperezdealgaba
force-pushed
the
sast-tests
branch
8 times, most recently
from
0589ab9 to
36ba314
Compare
jperezdealgaba
force-pushed
the
sast-tests
branch
from
36ba314 to
027be37
Compare
Before you complete this pull request ...
Look for any open pull requests in the repository with the title "e2e-tests update" and
see if there are recent e2e-tests updates that will be applicable to your change.