# =============================================================================
# L0 STATIC — the five scanner alerts exist and are unit-tested, including the absent-metric cases
# (R-VULN-06, docs/17 "Acceptance gates"). Offline, no cluster.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: vuln-alerts-unit-tested
  labels:
    conformance.home.k3s/R-VULN-06: "true"
  annotations:
    conformance.home.k3s/requirements: "R-VULN-06"
    conformance.home.k3s/layer: "L0"
    conformance.home.k3s/scope: "whole-repo"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/executable: "true"
    conformance.home.k3s/intent: >-
      VulnScanStale, VulnDatabaseStale, VulnCoverageGap, VulnCriticalFixAvailable and
      VulnTriageBotSilent exist, each promtool-tested firing, and the two absent-metric rules fire
      in a test with no such series. Proven by mutation.
spec:
  steps:
    - name: assert-alert-unit-tests
      description: >-
        Parse alerts.yaml and alerts.promtool-test.yaml, assert every alert and the two absent cases
        are pinned, run the harness when promtool is present, and run the evaluator on mutated copies.
      try:
        - script:
            content: bash ./check.sh