Function TestWorkspaceCheckoutForDetectionStep

pkg/workflow/threat_detection_test.go:1646–1691

TestWorkspaceCheckoutForDetectionStep verifies that a conditional checkout step is added to the detection job when threat detection is enabled, allowing the engine to see patches in the context of the full repository.

(t *testing.T)

// is added to the detection job when threat detection is enabled, allowing the
// engine to see patches in the context of the full repository.
func TestWorkspaceCheckoutForDetectionStep(t *testing.T) {
	compiler := NewCompiler()

	data := &WorkflowData{
		Name: "test-workflow",
		AI:   "copilot",
		SafeOutputs: &SafeOutputsConfig{
			ThreatDetection: &ThreatDetectionConfig{},
		},
	}

	job, err := compiler.buildDetectionJob(data)
	if err != nil {
		t.Fatalf("buildDetectionJob() error: %v", err)
	}
	if job == nil {
		t.Fatal("buildDetectionJob() returned nil job")
	}

	stepsString := strings.Join(job.Steps, "")

	// Workspace checkout step should be present
	if !strings.Contains(stepsString, "Checkout repository for patch context") {
		t.Error("Detection job should include workspace checkout step")
	}

	// Step should be conditional on has_patch
	expectedCondition := "if: needs." + string(constants.AgentJobName) + ".outputs.has_patch == 'true'"
	if !strings.Contains(stepsString, expectedCondition) {
		t.Errorf("Workspace checkout step should have has_patch condition, expected %q in steps", expectedCondition)
	}

	// Step should disable credential persistence
	if !strings.Contains(stepsString, "persist-credentials: false") {
		t.Error("Workspace checkout step should set persist-credentials: false")
	}

	// Step should use pinned actions/checkout
	checkoutPin := getActionPin("actions/checkout")
	if checkoutPin == "" {
		t.Fatal("Expected actions/checkout to have a pin")
	}
	if !strings.Contains(stepsString, checkoutPin) {
		t.Errorf("Workspace checkout step should use pinned action %q", checkoutPin)
	}
}

// TestDetectionJobAlwaysHasContentsRead verifies that the detection job always
// receives contents: read permission (required for the workspace checkout step),