Skip to content

feat: add Asset Scan Status integration tests to sanity suite#567

Open
aniket-shikhare-cstk wants to merge 7 commits into
developmentfrom
feat/asset-scan-status-sanity-tests
Open

feat: add Asset Scan Status integration tests to sanity suite#567
aniket-shikhare-cstk wants to merge 7 commits into
developmentfrom
feat/asset-scan-status-sanity-tests

Conversation

@aniket-shikhare-cstk

Copy link
Copy Markdown
Contributor

Summary

  • Adds a new Asset Scan Status describe block to test/sanity-check/api/asset-test.js — the only missing integration test that can be added to development now (the other two feature branches need SDK changes merged first).
  • 3 live-stack tests covering include_asset_scan_status query param behaviour.

Tests added

Test What it verifies
Single fetch with include_asset_scan_status=true _asset_scan_status field, when present, is one of pending|clean|quarantined|not_scanned
List query with include_asset_scan_status=true Same opt-in validation on first item in list response
Fetch without param _asset_scan_status key is absent from response

All three tests are soft on the scan-status field itself (asset scanning may not be enabled on every test stack) but hard on structure and absence-when-not-requested.

Gap analysis (other feature branches)

Branch Feature Tests on branch? Can add to dev now?
feat/DX-8752-asset-scan Asset scan status ✅ (this PR)
enh/dx-7264 Entry variants branch arg + .publish()/.unpublish() on Variants ✅ on branch ❌ — needs SDK changes merged
enh/api_version_management Auto-applied api_version via serviceVersion module ✅ on branch ❌ — needs SDK module merged

Test plan

  • Run sdk-js-cma-daily-sanity pipeline — Asset Scan Status block should show 3 passing tests (fields may be absent on stacks where scanning is disabled — tests handle that gracefully).

🤖 Generated with Claude Code

Add 3 integration tests under a new 'Asset Scan Status' describe block
in asset-test.js:

- Single fetch with include_asset_scan_status=true: validates the
  _asset_scan_status field (pending|clean|quarantined|not_scanned) when
  present; skips assertion when feature is not enabled for the stack.
- List query with include_asset_scan_status=true: same opt-in validation
  on the first item returned.
- Fetch without param: asserts _asset_scan_status is absent from response.

Reuses the image asset uploaded by the Asset Upload block via
testData.assets.image.uid to avoid extra uploads. Falls back to creating
a fresh asset only if the upload block did not run.

Related branch: feat/DX-8752-asset-scan
@aniket-shikhare-cstk aniket-shikhare-cstk requested a review from a team as a code owner June 25, 2026 22:50
@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

@github-actions

github-actions Bot commented Jun 25, 2026

Copy link
Copy Markdown

Coverage report for commit: e2f43f3
File: coverage/clover.xml

Cover ┌─────────────────────────┐ Freq.
   0% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  10% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  20% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  30% │ ██░░░░░░░░░░░░░░░░░░░░░ │  2.1%
  40% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  50% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  60% │ ░░░░░░░░░░░░░░░░░░░░░░░ │  0.0%
  70% │ █████░░░░░░░░░░░░░░░░░░ │  6.4%
  80% │ ███████████████████████ │ 36.2%
  90% │ ██████████████████░░░░░ │ 27.7%
 100% │ ██████████████████░░░░░ │ 27.7%
      └─────────────────────────┘
 *Legend:* █ = Current Distribution 
Summary - Lines: 82.73% | Methods: 95.87% | Branches: 65.85%
FilesLinesMethodsBranches
lib
   contentstack.js100.00%100.00%100.00%
   contentstackClient.js83.02%92.86%69.49%
   contentstackCollection.js94.12%100.00%86.96%
   entity.js76.22%100.00%61.34%
lib/core
   Util.js77.68%94.44%61.65%
   concurrency-queue.js71.84%72.22%62.02%
   contentstackError.js100.00%100.00%100.00%
   contentstackHTTPClient.js83.05%84.62%75.00%
   errorMessages.js100.00%100.00%71.43%
   moduleHeaderSupport.js89.71%100.00%83.67%
   oauthHandler.js90.85%100.00%67.14%
   pkceStorage.js100.00%100.00%94.12%
lib/organization
   index.js72.73%100.00%48.68%
lib/organization/teams
   index.js89.47%100.00%61.11%
lib/organization/teams/stackRoleMappings
   index.js78.57%100.00%47.50%
lib/organization/teams/teamUsers
   index.js100.00%100.00%87.50%
lib/query
   index.js75.51%100.00%59.62%
lib/stack/asset/folders
   index.js100.00%100.00%94.74%
lib/stack/asset
   index.js86.75%100.00%72.63%
lib/stack/auditlog
   index.js92.31%100.00%70.59%
lib/stack/branch
   compare.js70.83%100.00%60.00%
   index.js91.49%100.00%68.89%
   mergeQueue.js85.71%100.00%63.16%
lib/stack/branchAlias
   index.js80.65%100.00%59.52%
lib/stack/contentType/entry
   index.js83.33%100.00%57.84%
lib/stack/contentType/entry/variants
   index.js80.65%100.00%60.00%
lib/stack/contentType
   index.js85.29%100.00%68.00%
lib/stack/deliveryToken
   index.js95.65%80.00%85.71%
lib/stack/deliveryToken/previewToken
   index.js25.00%25.00%6.67%
lib/stack/environment
   index.js100.00%100.00%95.00%
lib/stack/extension
   index.js94.12%100.00%81.40%
lib/stack/globalField
   index.js92.11%100.00%81.13%
lib/stack
   index.js81.31%92.86%68.27%
lib/stack/label
   index.js100.00%100.00%93.75%
lib/stack/locale
   index.js100.00%100.00%95.00%
lib/stack/managementToken
   index.js100.00%100.00%90.00%
lib/stack/release
   index.js80.70%100.00%59.02%
lib/stack/roles
   index.js100.00%100.00%94.44%
lib/stack/taxonomy
   index.js78.35%100.00%52.07%
lib/stack/taxonomy/terms
   index.js79.31%100.00%56.96%
lib/stack/variantGroup
   index.js82.50%100.00%58.14%
lib/stack/variantGroup/variants
   index.js78.57%100.00%52.94%
lib/stack/variants
   index.js77.50%100.00%51.06%
lib/stack/webhook
   index.js85.00%100.00%64.29%
lib/stack/workflow
   index.js84.21%100.00%66.67%
lib/stack/workflow/publishRules
   index.js100.00%100.00%95.00%
lib/user
   index.js91.43%100.00%73.08%

🤖 comment via lucassabreu/comment-coverage-clover

…org)

Add assetScanStatus-test.js (Phase 6.5) covering 12 test cases on the
non-AM org stack and 7 test cases on the AM/DAM org stack:

Non-AM Org (ORGANIZATION, scan enabled):
1. Freshly uploaded asset returns _asset_scan_status (pending/clean)
2. Status value is a valid enum (pending|clean|quarantined|not_scanned)
3. Status ABSENT from single fetch when param is omitted
4. ALL file items in list carry status when param is passed
5. NO list items carry status when param is omitted
6. Status consistent between single-fetch and list-query for same asset
7. Status present when combined with version=1 param
8. Status present when combined with locale=en-us param
9. Status resets to pending after asset file is replaced
10. Folder entries do NOT get _asset_scan_status
11. Status present across multiple pages of paginated list
12. Status absent when include_asset_scan_status=false

AM Org (AM_API_KEY required, DAM + scan enabled):
AM-1..7: same coverage for DAM asset upload pipeline

Also:
- Registers the suite in sanity.js as Phase 6.5 (after asset-test.js)
- Adds AM_API_KEY placeholder to .env with setup instructions
- Updates .talismanrc for false-positive secret scan patterns
@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

Based on 'Asset Scanning Support – SDK Design Document'.

New test sections added to assetScanStatus-test.js:

§ 3.2 Upload with param:
  - Upload response includes _asset_scan_status=pending when param passed
  - Upload response does NOT include status without param

§ 3.3 Download error handling:
  - SDK must surface asset_scan_pending/quarantined error codes (not swallow)
  - Download 422 errors must expose status + message to callers

§ 3.4 Publish is always async:
  - Publish returns success notice regardless of asset scan status
  - SDK must never throw asset_scan_quarantined synchronously on publish

§ 3.6 Legacy asset null handling:
  - null is a valid _asset_scan_status for pre-scan legacy assets
  - SDK must not convert null to undefined or crash on null status
  - Updated all list-query assertions to accept null per spec

§ 4.2 api_version header isolation:
  - After bulkOperation.publish({ api_version: '3.2' }), subsequent
    asset and content-type fetches must NOT carry api_version header
  - Regression guard against global header pollution
@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

…message

chai's have.property(name, val) treats val as expected value, not error message.
This caused test 11 (pagination) to fail because chai checked
_asset_scan_status === 'Page item blt... is missing...' instead of just
verifying the property exists.

All 7 affected assertions fixed:
- 5x .not.have.property(name, msg) → .not.have.property(name)
  (false-pass bug: would pass even if property existed with any value)
- 1x .have.property(name, msg) → expect(obj, msg).to.have.property(name)
  (was the direct failure in pagination test)
- 1x api_version header check in §4.2

Verified locally: 23 passing, 0 failing, 9 pending (publish/AM skips expected)
@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

… AM_API_KEY

The AM Org test suite now follows the same pattern as the main sanity suite:
- Uses the existing authtoken from testSetup.testContext (already logged in)
- Creates a fresh stack inside AM_ORG_UID via POST /v3/stacks at test start
- Runs all 7 AM org asset scan tests against the dynamic stack
- Deletes the AM stack in the after() hook

No static AM_API_KEY needed in .env — removed from environment config.
Fallback: skip the AM suite gracefully if AM_ORG_UID is not set.

Verified locally: 30 passing, 2 pending (publish tests — expected, fresh stack has
no environments; these will run in the full suite)
The § 3.4 publish tests were pending because the fresh dynamic stack has
no environments (they're only created by Phase 5 environment tests).

Fix: before() now creates a throw-away environment when none is found,
and after() deletes it. Same self-contained pattern used by AM org stack.

Priority order:
1. Use testData.environments.development.name if Phase 5 already ran
2. Query for any existing environment
3. Create a temporary environment (scan-publish-env-XXXXX)

Verified locally: 32 passing, 0 pending, 0 failing
@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

…ICAR

Ports the pattern from the Python CMA SDK tests (test_06_asset.py,
test_31_am_assets.py) to JavaScript.

New helpers:
  - EICAR_BASE64: standard 68-byte EICAR signature stored base64-encoded
    so source file is never flagged by Talisman / repo antivirus scanners
  - createEicarFile(): decodes to a temp file at runtime, deleted in after()
  - waitForScan(stack, uid, expected, timeout=60s): polls
    fetch({include_asset_scan_status:true}) every 3s until status matches
    or times out; treats not_scanned as terminal (feature disabled on stack)

New describe: 'Asset Scan Status – Scan Lifecycle (clean + quarantined)'
  - clean image → polls until 'clean'
  - EICAR file → polls until 'quarantined'
  - quarantined download → verifies SDK surfaces 403/422 with scan error code
    (§ 3.3 re-tested with a REAL quarantined asset, not a fake URL)

AM org additions (AM-8, AM-9):
  - [AM] clean image transitions pending → clean
  - [AM] EICAR file reaches quarantined status

Also adds: import fs from 'fs' and import os from 'os'

Verified locally: 37 passing, 0 pending, 0 failing
@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant