Add pin-policy-bundle acceptance tests for TA task

[joejstuart]

Summary

• Add pin-policy-bundle step log assertion to the existing "Golden container image with trusted artifacts" scenario (no-op path: policy uses git sources, OCI tag not found)
• Add new "Pin policy bundle digest" scenario for verify-conforma-konflux-ta task (replacement path: OCI tag replaced with digest-pinned reference)
• Add corresponding snapshot entries

These mirror the two pin-policy-bundle scenarios already covered by the verify-enterprise-contract task, closing a gap where the TA task variant had zero dedicated coverage for this step.

Test plan

• Acceptance tests pass for ta_task_validate_image feature

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 4fc34792-de54-4478-9e72-a966e5d9ac33

📥 Commits

Reviewing files that changed from the base of the PR and between ceabb47 and 5d85d39.

⛔ Files ignored due to path filters (1)

• features/__snapshots__/ta_task_validate_image.snap is excluded by !**/*.snap

📒 Files selected for processing (1)

• features/ta_task_validate_image.feature

🚧 Files skipped from review as they are similar to previous changes (1)

• features/ta_task_validate_image.feature

---

📝 Walkthrough

Walkthrough

The feature tests add snapshot coverage for the pin-policy-bundle step and introduce a scenario validating explicit policy bundle digest handling with non-strict mode.

Changes

Policy bundle validation

Layer / File(s)	Summary
Trusted-artifact snapshot assertion features/ta_task_validate_image.feature	The existing trusted-artifact scenario now checks pin-policy-bundle logs against the snapshot.
Explicit digest scenario features/ta_task_validate_image.feature	A new scenario runs with POLICY_BUNDLE_DIGEST and STRICT=false, then verifies task success and pin-policy-bundle and show-config snapshots.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding pin-policy-bundle acceptance tests for the TA task.
Description check	✅ Passed	The description accurately matches the changes by describing the new pin-policy-bundle assertions and scenario coverage.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.26% <ø> (ø)
generative	16.80% <ø> (ø)
integration	27.97% <ø> (ø)
unit	71.74% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[joejstuart]

/retest

[simonbaird]

Gave it a rebase and a conflict resolve.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:25 PM UTC · Completed 6:29 PM UTC
Commit: 87c4a29 · View workflow run →

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@features/ta_task_validate_image.feature`:
- Line 131: Update the POLICY_BUNDLE_DIGEST scenario value in the relevant
feature example to a valid digest different from the task default, then
regenerate or edit the expected snapshots to reflect that supplied digest and
verify the scenario confirms explicit parameter propagation.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 2f2c6e31-abf4-4b00-b5d8-d6a9892ca6a0

📥 Commits

Reviewing files that changed from the base of the PR and between 9587783 and ceabb47.

⛔ Files ignored due to path filters (1)

• features/__snapshots__/ta_task_validate_image.snap is excluded by !**/*.snap

📒 Files selected for processing (1)

• features/ta_task_validate_image.feature

[fullsend-ai-review]

Review — approve

Tested: pin-policy-bundle acceptance coverage for verify-conforma-konflux-ta task

Summary

This PR adds acceptance test coverage for the pin-policy-bundle step in the TA task variant, closing a gap where this task had zero dedicated coverage for that step. The change correctly mirrors the two scenarios already covered by the verify-enterprise-contract task:

1. No-op path — The existing "Golden container image with trusted artifacts" scenario now asserts the pin-policy-bundle step log. Since this scenario's policy uses git sources (not OCI), the step correctly reports 'oci::quay.io/conforma/release-policy:konflux' not found in policy configuration, nothing to do.

2. Replacement path — A new "Pin policy bundle digest" scenario uses an OCI policy source and passes POLICY_BUNDLE_DIGEST with a digest (sha256:2a851b...) that is intentionally distinct from the task's default (sha256:f9049...). This ensures the snapshot comparison confirms the supplied value is actually propagated, rather than falling through to the default.

Checks performed

Dimension	Finding
Correctness	Scenarios correctly exercise both code paths of pin-konflux-policy-bundle.sh. Snapshot content matches expected script output. All TA-specific parameters (SNAPSHOT_FILENAME, SOURCE_DATA_ARTIFACT, TRUSTED_ARTIFACTS_DEBUG, ORAS_OPTIONS) are properly included.
Security	No concerns — uses existing test public keys and golden container image references already present in the repository.
Intent & coherence	Well-scoped test-only change that fills a documented coverage gap. Follows established patterns from the non-TA task tests.
Style/conventions	Gherkin step alignment, comment style, and snapshot formatting are consistent with existing scenarios.
Documentation	No docs changes needed for test-only additions.
Cross-repo contracts	No production code or API surface changes.

No findings.

Previous run

Review

Outcome: Approve ✅

Summary

This PR adds pin-policy-bundle acceptance test coverage for the verify-conforma-konflux-ta (Trusted Artifacts) task, mirroring the two scenarios already covered by the verify-enterprise-contract task. The change is well-structured, correctly follows existing patterns, and closes a real coverage gap.

Analysis

Correctness

• The no-op path (added assertion in "Golden container image with trusted artifacts") is correct: the policy uses git:: sources, so pin-policy-bundle finds no matching oci::quay.io/conforma/release-policy:konflux reference and reports "nothing to do." This exactly mirrors the EC task's Golden scenario behavior.
• The replacement path (new "Pin policy bundle digest" scenario) correctly uses an OCI-based policy source that matches the pin target, verifying the full tag→digest replacement flow.
• Snapshots are identical to their EC task counterparts, which is expected since the underlying pin-policy-bundle step implementation is shared.
• STRICT=false is appropriate for the replacement path test — the test only needs to verify pinning mechanics, not full policy evaluation.
• TA-specific parameters (SNAPSHOT_FILENAME, SOURCE_DATA_ARTIFACT, TRUSTED_ARTIFACTS_DEBUG, ORAS_OPTIONS) are correctly included, consistent with all other TA scenarios in the file.
• The POLICY_BUNDLE_DIGEST value (sha256:f904979d...) matches the default in the task definition at tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml:174.

Security — No concerns. Test-only change using existing public test fixtures and keys.

Intent & coherence — The PR description accurately describes the changes. The diff matches the stated intent. No scope creep.

Style & conventions — Feature file structure, indentation, snapshot naming conventions, and assertion patterns all follow existing precedent exactly.

Documentation — No documentation updates needed for a test addition.

Cross-repo contracts — Pure test addition with no API, schema, or interface impact.

---

Labels: PR adds acceptance test scenarios for pin-policy-bundle coverage

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:56 PM UTC · Completed 9:00 PM UTC
Commit: 87c4a29 · View workflow run →