chore: seeded fixture DB for deterministic e2e tests#833
Merged
Conversation
Adds build-fixture-db.mjs script and wires it into Jest globalSetup so the seeded advisory DB is rebuilt automatically whenever any scenario.json changes. Exports SEEDED_DB and SCENARIOS constants from the harness. Gitignores the generated seeded.db and overrides output JSON files. Adds a build:fixture-db npm script for manual rebuilds.
…734) Three scenarios covering the core finding shapes: direct-high (one direct dep, fix available), transitive-only (transitive dep, no fix), and no-findings (clean project). Each uses fictional package names so results never drift when live OSV advisories change.
Network-free e2e tests backed by the seeded advisory DB. Covers: direct high-severity detection, fail-on exit code, transitive medium-severity detection, clean project exit 0, and synthetic harness projects. All tests use --offline-db so results are deterministic and never drift with live OSV data.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #734
Adds a small seeded advisory DB and scenario library so e2e tests run deterministically without a live OSV network sync. A fresh checkout now passes all seeded tests out of the box.
What's included:
scripts/build-fixture-db.mjs- buildstests/fixtures/advisories/seeded.dbfrom the advisory entries in each scenario directorytests/e2e/global-setup.mjs- extended to rebuild the seeded DB automatically when anyscenario.jsonis newer than the DBtests/e2e/harness.ts- exportsSEEDED_DBandSCENARIOSconstantsexamples/scenarios/- three scenario directories with fictional package names (cve-lite-scenario-*) that will never match live OSV advisories:direct-high,transitive-only,no-findingstests/e2e/seeded-db.test.ts- network-free e2e suite covering direct detection, fail-on exit codes, transitive detection, clean exit 0, and synthetic harness projects via--offline-db.gitignore- addstests/fixtures/advisories/seeded.db(generated binary) andcve-lite-overrides-*.json(overrides command output)package.json- addsbuild:fixture-dbscript for manual rebuildsThe seeded DB is git-ignored and rebuilt automatically by Jest globalSetup, so no binary is committed. Adding a new scenario is just adding a directory with
scenario.json- no manual DB editing required.