Function TestGetDIFCProxyPolicyJSON

pkg/workflow/compiler_difc_proxy_test.go:236–317

TestGetDIFCProxyPolicyJSON verifies that the proxy policy JSON contains only the static fields (min-integrity and repos) without dynamic expressions.

(t *testing.T)

// TestGetDIFCProxyPolicyJSON verifies that the proxy policy JSON contains
// only the static fields (min-integrity and repos) without dynamic expressions.
func TestGetDIFCProxyPolicyJSON(t *testing.T) {
	tests := []struct {
		name             string
		githubTool       map[string]any
		expectedContains []string
		expectedAbsent   []string
		expectEmpty      bool
	}{
		{
			name:        "nil tool",
			githubTool:  nil,
			expectEmpty: true,
		},
		{
			name:        "empty map tool",
			githubTool:  map[string]any{},
			expectEmpty: true,
		},
		{
			name: "min-integrity only",
			githubTool: map[string]any{
				"min-integrity": "approved",
			},
			expectedContains: []string{`"allow-only"`, `"min-integrity":"approved"`, `"repos":"all"`},
			expectedAbsent:   []string{"blocked-users", "approval-labels", "steps.parse-guard-vars", "__GH_AW_GUARD_EXPR"},
		},
		{
			name: "min-integrity and repos",
			githubTool: map[string]any{
				"min-integrity": "merged",
				"repos":         "all",
			},
			expectedContains: []string{`"allow-only"`, `"min-integrity":"merged"`, `"repos":"all"`},
			expectedAbsent:   []string{"blocked-users", "approval-labels"},
		},
		{
			name: "allowed-repos (preferred field name)",
			githubTool: map[string]any{
				"min-integrity": "unapproved",
				"allowed-repos": "owner/*",
			},
			expectedContains: []string{`"min-integrity":"unapproved"`, `"repos":"owner/*"`},
			expectedAbsent:   []string{"blocked-users", "approval-labels"},
		},
		{
			name: "allowed-repos github.repository expression",
			githubTool: map[string]any{
				"min-integrity": "approved",
				"allowed-repos": "${{ github.repository }}",
			},
			expectedContains: []string{`"min-integrity":"approved"`, `"repos":"${{ github.repository }}"`},
			expectedAbsent:   []string{"blocked-users", "approval-labels"},
		},
		{
			name: "tool without guard policy fields",
			githubTool: map[string]any{
				"toolsets": []string{"default"},
			},