Documentation
¶
Overview ¶
Package testsuite detects whether a source-code finding lives in a project's test suite, and identifies the testing framework responsible.
Unlike a pure backend heuristic that only sees a file path, this runs inside the repository during a scan, so it corroborates the path-name guess with two stronger, repo-local signals: test-runner configuration files present on disk (jest.config.js, pytest.ini, phpunit.xml, …) and test frameworks declared as dev-dependencies in package-manager manifests. A path match plus a present config or a declared dependency is a confirmed attribution, not a coincidence.
detect.go carries the path-name heuristic. It is an exhaustive, ordered table of patterns spanning every language in the Wikipedia "List of unit testing frameworks", ported from and extended beyond the backend's TypeScript TEST_PATTERNS. Order matters: more specific patterns come first, and the best (highest-confidence, framework-naming) match wins.
Index ¶
Constants ¶
const ( ConfidenceConfirmed = "confirmed" ConfidenceHigh = "high" ConfidenceMedium = "medium" ConfidenceLow = "low" )
Confidence levels for a path-name match. `confirmed` is never produced by the path heuristic alone — attribute.go elevates a high/medium path match to confirmed when a config file or declared dependency corroborates it.
Variables ¶
This section is empty.
Functions ¶
func Annotate ¶
Annotate stamps each SAST finding with test-suite attribution derived from its file path, upgrading confidence and attaching corroborating evidence when the repo scan found a matching config file or declared dependency. Returns the number of findings marked as test code.
func SupportedFrameworks ¶
func SupportedFrameworks() []string
SupportedFrameworks returns the sorted set of frameworks the path table can name. Used by docs generation and tests.
Types ¶
type Active ¶
type Active struct {
Configs []Config
Present map[string]bool // framework → true
Evidence map[string]string // framework → human evidence string
AnyConfig bool
}
Active is the corroborating evidence a repo scan produced: the set of test frameworks with a config file and/or a declared dependency, plus the config files themselves and a framework→evidence map used to annotate findings.
func Scan ¶
Scan walks rootPath for test-runner configuration files and test frameworks declared in package-manager manifests, returning the combined corroborating evidence. It is self-contained (does not depend on the SCA pass having run), so `vulnetix sast` in isolation still gets config-file evidence.
type Config ¶
type Config struct {
Path string `json:"path"`
Framework string `json:"framework"`
Language string `json:"language,omitempty"`
ContentType string `json:"contentType,omitempty"`
SHA256 string `json:"sha256,omitempty"`
Size int64 `json:"size,omitempty"`
}
Config is a test-runner configuration file detected on disk. It is metadata only — the raw body is never carried off the host (test configs are low-sensitivity but there is no need to archive them). Mirrors the shape of the SCA manifest metadata so the backend can persist it the same way.
type Detection ¶
type Detection struct {
IsTestSuite bool `json:"isTestSuite"`
Framework string `json:"testFramework,omitempty"`
Language string `json:"testLanguage,omitempty"`
Confidence string `json:"testConfidence,omitempty"`
MatchedPattern string `json:"testMatchedPattern,omitempty"`
Evidence []string `json:"testEvidence,omitempty"`
}
Detection is the result of classifying a single file path.
func DetectPath ¶
DetectPath classifies a single file path by naming convention alone. It keeps the highest-confidence match; on a confidence tie it prefers a match that names a framework over one that leaves it ambiguous. A path matching nothing is production code (IsTestSuite false).
Source Files