Committed provider fixtures and routing expectations on golden corpus repos

Aperta
  • Qualcosa non va?
#160 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
45/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
go
Ambito
cli, testing-qa, tooling

Direzione di ricerca

Start with tests/tools/README.md and the existing fixtures under tests/tools/fixtures/, then inspect tests/map_corpus/golden_expectations.json and the provider ingesters in pkg/providerjoin/. Add pinned or inventory/fence-based fixtures and routing expectations for the seven named repositories, covering the listed tools and blind-spot reasons. Done means the golden-corpus attribution, prerequisite, routing, and SARIF expectations are validated without relying on Bifrost in the offline container.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

enhancement follow-up

Committed provider fixtures and routing expectations on golden corpus repos

Background

Issues #77, #78, #79 and #82 each require validation against real, pinned tool runs on the 7 golden corpus repositories (loki, mastodon, ruff, spring-petclinic, superset, terraform-aws-vpc, aws-sam-java-rest). On main, all four issues have been tested only on synthetic 3–5 file applications (flask-app, express-app, spring-app) in tests/tools/fixtures/. The golden corpus repos have no provider fixtures.

What 1.0 ships

  • All four provider ingesters work on synthetic fixtures: pkg/providerjoin/syft.go, sarif.go, noir.go, bifrost.go.
  • dircue map --attach KIND=PATH supports syft-json, sarif, noir-json, bifrost-code-query-json.
  • dircue map route emits inert per-component routing plans.
  • The coverage ledger reports blind spots with correct reasons on synthetic inputs.
  • Three SARIF emitter kinds (Noir, ruff, Semgrep) are tested on synthetic apps.

Remaining work (acceptance criteria from original issues)

From #77: Committed, pinned Syft fixtures on every golden corpus repo; Noir fixtures on the web-framework entries (mastodon, superset, loki); Bifrost on a subset. Attribution precision/recall measured against hand-written expectations on golden corpus entries.

From #78: On golden corpus entries with pinned tool runs, the expected blind spots are reported with the correct reasons: unsupported language, unmet build prerequisite, missing run, crashed run.

From #79: On the golden corpus, applicable tools and unmet prerequisites match hand-written expectations. Routing expectation fields added to tests/map_corpus/golden_expectations.json.

From #82: SARIF locate fixtures from at least three emitters of different kinds on golden corpus entries (not just synthetic apps).

Constraints: Bifrost is not runnable in the hermetic offline container environment. Syft on each of 7 golden repos will produce large fixtures — use the inventory/fence pattern from #88 rather than committing raw output.

Links

  • #77, #78, #79, #82 (1.0.0 issues being closed)
  • tests/tools/README.md (existing tools oracle)
  • tests/map_corpus/golden_expectations.json
Lingua principale
Go
Stelle
0
Fork
0
Merge medio
6h 18m
PR unite (30g)
16

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di war-and-code/dircue

Tutte le issue di war-and-code/dircue

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.