test(smoke): normalize volatile EPSS fields in golden comparison#176
Conversation
FIRST.org recomputes EPSS scores daily, so the model date, score, and percentile in enrich/reachability output drift every day regardless of the code under test. Left unnormalized they break smoke goldens (e.g. scan-go-reachability) on a daily cadence. Add normalizeEPSS to the normalizeJSON pipeline: scrub date, epss, and percentile on every "epss" array while keeping the CVE id so the golden still proves the EPSS payload attached to the right advisory. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthrough
EPSS Normalization in Smoke-Test Helpers
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Bomly Diff SummaryCompared Overview
Dependency Changes✅ No dependency changes. Vulnerabilities✅ No vulnerability changes. License Changes✅ No license changes. Project Posture✅ No project posture changes (or Policy Findings✅ No policy differences were identified. |
1 participant
What
The scheduled Smoke workflow has been failing daily. One root cause: EPSS data is recomputed daily by FIRST.org, so the
date,epssscore, andpercentilefields drift every day independent of any code change. There was no normalizer for them, soscan-go-reachability(and other enrich goldens carrying EPSS payloads) go stale on a daily cadence.Change
Add
normalizeEPSSto thenormalizeJSONpipeline intest/smoke/helpers_test.go. It walks the JSON tree and, for every"epss"array, scrubs the three volatile fields:date→<normalized>epss(score) →0percentile→0The
cveid is preserved so the golden still proves the EPSS payload attached to the right advisory. The<normalized>placeholder matches the escaped form (<normalized>) already used across all 50 goldens.Verification
go vet -tags smoke ./test/smoke/clean.scan-go-reachability.golden.json: driftingdate/score/percentile are scrubbed,cvepreserved.Follow-ups (not in this PR)
make smoke ARGS="-update") — this also folds in the stale GitHub Actionslocationsfield from Annotate SARIF diff output and GitHub Actions locations #168.scan-python-pip,scan-python-poetry,scan-python-pip-reachability) is a separate target-pinning issue (needs lockfiles on the example repos), addressed separately.🤖 Generated with Claude Code
Summary by CodeRabbit