Function TestRunnerGuardPathTraversalGuard

pkg/cli/runner_guard_test.go:290–353

(t *testing.T)

}

func TestRunnerGuardPathTraversalGuard(t *testing.T) {
	tests := []struct {
		name     string
		filePath string
		skip     bool // whether the finding should be skipped (outside git root)
	}{
		{
			name:     "normal workflow file",
			filePath: ".github/workflows/test.lock.yml",
			skip:     false,
		},
		{
			name:     "file outside git root via ..",
			filePath: "../outside/file.yml",
			skip:     true,
		},
		{
			name:     "file with .. prefix but inside root",
			filePath: "..foo/file.yml", // should NOT be skipped — not a parent traversal
			skip:     false,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			tmpDir := t.TempDir()

			stdout := `{"findings":[{"rule_id":"RGS-TEST","name":"Test","severity":"high","file":"` +
				tt.filePath + `","line":1}]}`

			oldStderr := os.Stderr
			r, w, _ := os.Pipe()
			os.Stderr = w

			count, err := parseAndDisplayRunnerGuardOutput(stdout, false, tmpDir)

			w.Close()
			os.Stderr = oldStderr

			var buf bytes.Buffer
			buf.ReadFrom(r)
			output := buf.String()

			if err != nil {
				t.Errorf("Unexpected error: %v", err)
			}

			if tt.skip {
				// Skipped findings still count toward totalFindings but won't appear in output
				// The finding is parsed (count=1) but display is skipped
				if count != 1 {
					t.Errorf("Expected count 1 (finding parsed even if skipped for display), got %d", count)
				}
				if strings.Contains(output, "RGS-TEST") {
					t.Errorf("Expected skipped finding not to appear in output, got:\n%s", output)
				}
			} else {
				if count != 1 {