jakman85andClaude Opus 5.5
50ec2297ee
Stdlib-only scanner per docs/17: Kubernetes API inventory, Trivy runner, persisted state, schema-validated report.json, strict acceptances parser, server-rendered page, aggregate metrics, internal API, and a scan loop that stays live while scanning. L1 tests under conformance/tests/l1-rendering/vuln-scanner-* run the actual modules against recorded fixtures with a fake Trivy runner. Co-Authored-By: Claude Opus 5.5 <[email protected]>
26 lines
1.1 KiB
YAML
26 lines
1.1 KiB
YAML
# L1 fixture test: runs check.py (python3 stdlib, source imported from platform/vuln-scanner/src,
|
|
# no cluster, no network beyond loopback). conformance/run.sh --layer l1 runs check.sh offline;
|
|
# this Chainsaw Test wraps the same script so an in-cluster run executes identical assertions.
|
|
apiVersion: chainsaw.kyverno.io/v1alpha1
|
|
kind: Test
|
|
metadata:
|
|
name: vuln-scanner-inventory
|
|
labels:
|
|
conformance.home.k3s/R-VULN-01: "true"
|
|
annotations:
|
|
conformance.home.k3s/requirements: "R-VULN-01"
|
|
conformance.home.k3s/layer: "L1"
|
|
conformance.home.k3s/safety-critical: "false"
|
|
# Whole-repo scope: the touched-path map keys nothing to platform/vuln-scanner, so without this
|
|
# a change to the scanner would select no vuln-scanner test.
|
|
conformance.home.k3s/scope: "whole-repo"
|
|
conformance.home.k3s/intent: >-
|
|
Given recorded API lists, When the inventory is built, Then owner chains, digests, by-tag CronJobs and not-covered targets resolve per R-VULN-01.
|
|
spec:
|
|
steps:
|
|
- name: run-offline-check
|
|
description: Run check.sh, the same assertions the offline harness runs.
|
|
try:
|
|
- script:
|
|
content: bash ./check.sh
|