scorecard/probes/hasSBOM/impl_test.go
Allen Shearin 8de90207bc
Add experimental check for published SBOM (#3903)
* Sbom check MVP

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

* PR suggestion fixes

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

* fix line length

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

* update gitlab client to check 20 latest pipelines in default branch

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

* correct issues

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

* add unit tests for sbom client code

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

* probe name alignment, updated evaluation tests

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

* consolidate probes, reuse available data sources

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

* add autogen doc update

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

* address PR comments, remove CI/CD check code

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

* update unit tests

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

* fix linting errors

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

* revert unnecessary changes, correct check documentation

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

* address PR comments

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

* move release lookback to data collection side

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

---------

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>
2024-05-17 18:16:54 +00:00

104 lines
2.5 KiB
Go

// Copyright 2024 OpenSSF Scorecard Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//nolint:stylecheck
package hasSBOM
import (
"testing"
"github.com/google/go-cmp/cmp"
"github.com/google/go-cmp/cmp/cmpopts"
"github.com/ossf/scorecard/v5/checker"
"github.com/ossf/scorecard/v5/finding"
"github.com/ossf/scorecard/v5/probes/internal/utils/test"
"github.com/ossf/scorecard/v5/probes/internal/utils/uerror"
)
func Test_Run(t *testing.T) {
t.Parallel()
//nolint:govet
tests := []struct {
name string
raw *checker.RawResults
outcomes []finding.Outcome
err error
}{
{
name: "SBOM file found and outcome should be positive",
raw: &checker.RawResults{
SBOMResults: checker.SBOMData{
SBOMFiles: []checker.SBOM{
{
File: checker.File{
Path: "SBOM.cdx.json",
},
},
},
},
},
outcomes: []finding.Outcome{
finding.OutcomeTrue,
},
},
{
name: "nil SBOM files and outcome should be negative",
raw: &checker.RawResults{
SBOMResults: checker.SBOMData{
SBOMFiles: nil,
},
},
outcomes: []finding.Outcome{
finding.OutcomeFalse,
},
},
{
name: "0 SBOM files and outcome should be negative",
raw: &checker.RawResults{
SBOMResults: checker.SBOMData{
SBOMFiles: []checker.SBOM{},
},
},
outcomes: []finding.Outcome{
finding.OutcomeFalse,
},
},
{
name: "no raw data",
raw: nil,
err: uerror.ErrNil,
outcomes: nil,
},
}
for _, tt := range tests {
tt := tt // Re-initializing variable so it is not changed while executing the closure below
t.Run(tt.name, func(t *testing.T) {
t.Parallel()
findings, s, err := Run(tt.raw)
if !cmp.Equal(tt.err, err, cmpopts.EquateErrors()) {
t.Errorf("mismatch (-want +got):\n%s", cmp.Diff(tt.err, err, cmpopts.EquateErrors()))
}
if err != nil {
return
}
if diff := cmp.Diff(Probe, s); diff != "" {
t.Errorf("mismatch (-want +got):\n%s", diff)
}
test.AssertOutcomes(t, findings, tt.outcomes)
})
}
}