Skip to content

Commit dadd5b4

Browse files
sprioriellosprioriello
committed
test: add unit tests for expand functions in util_security_configuration
Adds table-driven tests for expandCodeSecurityConfigurationCommon and expandSecretScanningDelegatedBypass, covering minimal input, all string fields, nested block options, and delegated bypass with reviewers.
1 parent f8abb8f commit dadd5b4

1 file changed

Lines changed: 245 additions & 0 deletions

File tree

‎github/util_security_configuration_test.go‎

Lines changed: 245 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"testing"
55

66
"github.com/google/go-github/v84/github"
7+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
78
)
89

910
func TestFlattenDependencyGraphAutosubmitActionOptions(t *testing.T) {
@@ -261,3 +262,247 @@ func TestFlattenCodeScanningDefaultSetupOptions(t *testing.T) {
261262
})
262263
}
263264
}
265+
266+
func TestExpandCodeSecurityConfigurationCommon(t *testing.T) {
267+
resourceSchema := resourceGithubOrganizationSecurityConfiguration().Schema
268+
269+
tests := []struct {
270+
name string
271+
input map[string]any
272+
expect func(t *testing.T, config github.CodeSecurityConfiguration)
273+
}{
274+
{
275+
name: "minimal input sets only name",
276+
input: map[string]any{
277+
"name": "my-config",
278+
},
279+
expect: func(t *testing.T, config github.CodeSecurityConfiguration) {
280+
if config.Name != "my-config" {
281+
t.Errorf("expected name %q, got %q", "my-config", config.Name)
282+
}
283+
if config.AdvancedSecurity != nil {
284+
t.Errorf("expected AdvancedSecurity nil, got %v", *config.AdvancedSecurity)
285+
}
286+
if config.DependencyGraph != nil {
287+
t.Errorf("expected DependencyGraph nil, got %v", *config.DependencyGraph)
288+
}
289+
if config.Enforcement != nil {
290+
t.Errorf("expected Enforcement nil, got %v", *config.Enforcement)
291+
}
292+
},
293+
},
294+
{
295+
name: "sets all string fields",
296+
input: map[string]any{
297+
"name": "full-config",
298+
"description": "A test config",
299+
"advanced_security": "enabled",
300+
"dependency_graph": "enabled",
301+
"dependency_graph_autosubmit_action": "enabled",
302+
"dependabot_alerts": "enabled",
303+
"dependabot_security_updates": "disabled",
304+
"code_scanning_default_setup": "enabled",
305+
"code_scanning_delegated_alert_dismissal": "not_set",
306+
"code_security": "enabled",
307+
"secret_scanning": "enabled",
308+
"secret_scanning_push_protection": "enabled",
309+
"secret_scanning_validity_checks": "disabled",
310+
"secret_scanning_non_provider_patterns": "not_set",
311+
"secret_scanning_generic_secrets": "disabled",
312+
"secret_scanning_delegated_alert_dismissal": "not_set",
313+
"secret_protection": "enabled",
314+
"private_vulnerability_reporting": "enabled",
315+
"enforcement": "enforced",
316+
},
317+
expect: func(t *testing.T, config github.CodeSecurityConfiguration) {
318+
if config.Name != "full-config" {
319+
t.Errorf("expected name %q, got %q", "full-config", config.Name)
320+
}
321+
if config.Description != "A test config" {
322+
t.Errorf("expected description %q, got %q", "A test config", config.Description)
323+
}
324+
if config.GetAdvancedSecurity() != "enabled" {
325+
t.Errorf("expected AdvancedSecurity %q, got %q", "enabled", config.GetAdvancedSecurity())
326+
}
327+
if config.GetDependencyGraph() != "enabled" {
328+
t.Errorf("expected DependencyGraph %q, got %q", "enabled", config.GetDependencyGraph())
329+
}
330+
if config.GetDependabotSecurityUpdates() != "disabled" {
331+
t.Errorf("expected DependabotSecurityUpdates %q, got %q", "disabled", config.GetDependabotSecurityUpdates())
332+
}
333+
if config.GetEnforcement() != "enforced" {
334+
t.Errorf("expected Enforcement %q, got %q", "enforced", config.GetEnforcement())
335+
}
336+
if config.GetSecretScanning() != "enabled" {
337+
t.Errorf("expected SecretScanning %q, got %q", "enabled", config.GetSecretScanning())
338+
}
339+
if config.GetPrivateVulnerabilityReporting() != "enabled" {
340+
t.Errorf("expected PrivateVulnerabilityReporting %q, got %q", "enabled", config.GetPrivateVulnerabilityReporting())
341+
}
342+
},
343+
},
344+
{
345+
name: "sets dependency_graph_autosubmit_action_options",
346+
input: map[string]any{
347+
"name": "with-autosubmit-opts",
348+
"dependency_graph_autosubmit_action_options": []any{
349+
map[string]any{
350+
"labeled_runners": true,
351+
},
352+
},
353+
},
354+
expect: func(t *testing.T, config github.CodeSecurityConfiguration) {
355+
if config.DependencyGraphAutosubmitActionOptions == nil {
356+
t.Fatal("expected DependencyGraphAutosubmitActionOptions to be set")
357+
}
358+
if !config.DependencyGraphAutosubmitActionOptions.GetLabeledRunners() {
359+
t.Errorf("expected LabeledRunners true, got false")
360+
}
361+
},
362+
},
363+
{
364+
name: "sets code_scanning_default_setup_options with runner_label",
365+
input: map[string]any{
366+
"name": "with-setup-opts",
367+
"code_scanning_default_setup_options": []any{
368+
map[string]any{
369+
"runner_type": "labeled",
370+
"runner_label": "my-runner",
371+
},
372+
},
373+
},
374+
expect: func(t *testing.T, config github.CodeSecurityConfiguration) {
375+
if config.CodeScanningDefaultSetupOptions == nil {
376+
t.Fatal("expected CodeScanningDefaultSetupOptions to be set")
377+
}
378+
if config.CodeScanningDefaultSetupOptions.RunnerType != "labeled" {
379+
t.Errorf("expected RunnerType %q, got %q", "labeled", config.CodeScanningDefaultSetupOptions.RunnerType)
380+
}
381+
if config.CodeScanningDefaultSetupOptions.GetRunnerLabel() != "my-runner" {
382+
t.Errorf("expected RunnerLabel %q, got %q", "my-runner", config.CodeScanningDefaultSetupOptions.GetRunnerLabel())
383+
}
384+
},
385+
},
386+
{
387+
name: "sets code_scanning_options",
388+
input: map[string]any{
389+
"name": "with-scan-opts",
390+
"code_scanning_options": []any{
391+
map[string]any{
392+
"allow_advanced": true,
393+
},
394+
},
395+
},
396+
expect: func(t *testing.T, config github.CodeSecurityConfiguration) {
397+
if config.CodeScanningOptions == nil {
398+
t.Fatal("expected CodeScanningOptions to be set")
399+
}
400+
if !config.CodeScanningOptions.GetAllowAdvanced() {
401+
t.Errorf("expected AllowAdvanced true, got false")
402+
}
403+
},
404+
},
405+
}
406+
407+
for _, tt := range tests {
408+
t.Run(tt.name, func(t *testing.T) {
409+
d := schema.TestResourceDataRaw(t, resourceSchema, tt.input)
410+
result := expandCodeSecurityConfigurationCommon(d)
411+
tt.expect(t, result)
412+
})
413+
}
414+
}
415+
416+
func TestExpandSecretScanningDelegatedBypass(t *testing.T) {
417+
resourceSchema := resourceGithubOrganizationSecurityConfiguration().Schema
418+
419+
tests := []struct {
420+
name string
421+
input map[string]any
422+
expect func(t *testing.T, config github.CodeSecurityConfiguration)
423+
}{
424+
{
425+
name: "no bypass fields leaves config unchanged",
426+
input: map[string]any{
427+
"name": "no-bypass",
428+
},
429+
expect: func(t *testing.T, config github.CodeSecurityConfiguration) {
430+
if config.SecretScanningDelegatedBypass != nil {
431+
t.Errorf("expected SecretScanningDelegatedBypass nil, got %v", *config.SecretScanningDelegatedBypass)
432+
}
433+
if config.SecretScanningDelegatedBypassOptions != nil {
434+
t.Errorf("expected SecretScanningDelegatedBypassOptions nil, got %v", config.SecretScanningDelegatedBypassOptions)
435+
}
436+
},
437+
},
438+
{
439+
name: "sets bypass string without options",
440+
input: map[string]any{
441+
"name": "bypass-only",
442+
"secret_scanning_delegated_bypass": "enabled",
443+
},
444+
expect: func(t *testing.T, config github.CodeSecurityConfiguration) {
445+
if config.GetSecretScanningDelegatedBypass() != "enabled" {
446+
t.Errorf("expected SecretScanningDelegatedBypass %q, got %q", "enabled", config.GetSecretScanningDelegatedBypass())
447+
}
448+
if config.SecretScanningDelegatedBypassOptions != nil {
449+
t.Errorf("expected SecretScanningDelegatedBypassOptions nil, got %v", config.SecretScanningDelegatedBypassOptions)
450+
}
451+
},
452+
},
453+
{
454+
name: "sets bypass with reviewers",
455+
input: map[string]any{
456+
"name": "bypass-with-reviewers",
457+
"secret_scanning_delegated_bypass": "enabled",
458+
"secret_scanning_delegated_bypass_options": []any{
459+
map[string]any{
460+
"reviewers": []any{
461+
map[string]any{
462+
"reviewer_id": 42,
463+
"reviewer_type": "TEAM",
464+
},
465+
map[string]any{
466+
"reviewer_id": 99,
467+
"reviewer_type": "ROLE",
468+
},
469+
},
470+
},
471+
},
472+
},
473+
expect: func(t *testing.T, config github.CodeSecurityConfiguration) {
474+
if config.GetSecretScanningDelegatedBypass() != "enabled" {
475+
t.Errorf("expected SecretScanningDelegatedBypass %q, got %q", "enabled", config.GetSecretScanningDelegatedBypass())
476+
}
477+
if config.SecretScanningDelegatedBypassOptions == nil {
478+
t.Fatal("expected SecretScanningDelegatedBypassOptions to be set")
479+
}
480+
reviewers := config.SecretScanningDelegatedBypassOptions.Reviewers
481+
if len(reviewers) != 2 {
482+
t.Fatalf("expected 2 reviewers, got %d", len(reviewers))
483+
}
484+
if reviewers[0].ReviewerID != 42 {
485+
t.Errorf("expected first reviewer_id 42, got %d", reviewers[0].ReviewerID)
486+
}
487+
if reviewers[0].ReviewerType != "TEAM" {
488+
t.Errorf("expected first reviewer_type %q, got %q", "TEAM", reviewers[0].ReviewerType)
489+
}
490+
if reviewers[1].ReviewerID != 99 {
491+
t.Errorf("expected second reviewer_id 99, got %d", reviewers[1].ReviewerID)
492+
}
493+
if reviewers[1].ReviewerType != "ROLE" {
494+
t.Errorf("expected second reviewer_type %q, got %q", "ROLE", reviewers[1].ReviewerType)
495+
}
496+
},
497+
},
498+
}
499+
500+
for _, tt := range tests {
501+
t.Run(tt.name, func(t *testing.T) {
502+
d := schema.TestResourceDataRaw(t, resourceSchema, tt.input)
503+
config := github.CodeSecurityConfiguration{Name: d.Get("name").(string)}
504+
expandSecretScanningDelegatedBypass(d, &config)
505+
tt.expect(t, config)
506+
})
507+
}
508+
}

0 commit comments

Comments
 (0)