From 7740e96cb1c3b5299c62fc7aadac98dcb8cf9d6c Mon Sep 17 00:00:00 2001 From: ghartuv Date: Tue, 14 Jul 2026 18:13:36 +0300 Subject: [PATCH] feat: include enforcement date in warnings for future effective_on violations When the CLI demotes a deny result to a warning due to a future effective_on date, the warning message is now enhanced to indicate when enforcement begins. Before: "The required 'cpe' label is missing" After: "The required 'cpe' label is missing. This will become a failure starting on 2025-01-01T00:00:00Z" This applies to both sources of effective_on: rule annotations and rule_data items. The effective_on date is included as-is (RFC3339 format). Ref: https://redhat.atlassian.net/browse/EC-1901 Assisted-by: Claude Opus 4.6 --- .../conftest_evaluator_unit_core_test.go | 2 +- internal/evaluator/filters.go | 36 ++++++++- internal/evaluator/filters_test.go | 76 +++++++++++++++++++ 3 files changed, 111 insertions(+), 3 deletions(-) diff --git a/internal/evaluator/conftest_evaluator_unit_core_test.go b/internal/evaluator/conftest_evaluator_unit_core_test.go index 9793ccd16..41e66a7e2 100644 --- a/internal/evaluator/conftest_evaluator_unit_core_test.go +++ b/internal/evaluator/conftest_evaluator_unit_core_test.go @@ -221,7 +221,7 @@ func TestConftestEvaluatorEvaluateSeverity(t *testing.T) { }, { - Message: "not yet effective", + Message: "not yet effective. This will become a failure starting on 3021-01-01T00:00:00Z", Metadata: map[string]any{ "effective_on": "3021-01-01T00:00:00Z", }, diff --git a/internal/evaluator/filters.go b/internal/evaluator/filters.go index d6d2d9448..52f717666 100644 --- a/internal/evaluator/filters.go +++ b/internal/evaluator/filters.go @@ -997,7 +997,14 @@ func (f *LegacyPostEvaluationFilter) CategorizeResults( } case "failure": if getSeverity(result) == severityWarning || !isResultEffective(result, effectiveTime) { - warnings = append(warnings, result) + // If being demoted due to future effective_on, enhance the message + if !isResultEffective(result, effectiveTime) { + enhancedResult := result + enhancedResult.Message = formatFutureEnforcementMessage(result) + warnings = append(warnings, enhancedResult) + } else { + warnings = append(warnings, result) + } } else { failures = append(failures, result) } @@ -1120,7 +1127,14 @@ func (f *UnifiedPostEvaluationFilter) CategorizeResults( } case "failure": if getSeverity(filteredResult) == severityWarning || !isResultEffective(filteredResult, effectiveTime) { - warnings = append(warnings, filteredResult) + // If being demoted due to future effective_on, enhance the message + if !isResultEffective(filteredResult, effectiveTime) { + enhancedResult := filteredResult + enhancedResult.Message = formatFutureEnforcementMessage(filteredResult) + warnings = append(warnings, enhancedResult) + } else { + warnings = append(warnings, filteredResult) + } } else { failures = append(failures, filteredResult) } @@ -1204,3 +1218,21 @@ func (f *UnifiedPostEvaluationFilter) determineOriginalType(filteredResult Resul return "unknown" } + +// formatFutureEnforcementMessage enhances a result message to indicate when +// a future effective_on date will cause enforcement to begin. +// Returns the enhanced message if effective_on is present, otherwise returns +// the original message unchanged. +func formatFutureEnforcementMessage(result Result) string { + originalMessage := result.Message + + // Check if this result has an effective_on date + effectiveOnStr, ok := result.Metadata[metadataEffectiveOn].(string) + if !ok || effectiveOnStr == "" { + return originalMessage + } + + // Append enforcement notice with the effective_on date as-is + return fmt.Sprintf("%s. This will become a failure starting on %s", + strings.TrimRight(originalMessage, "."), effectiveOnStr) +} diff --git a/internal/evaluator/filters_test.go b/internal/evaluator/filters_test.go index 293b2eb59..15f3b95cc 100644 --- a/internal/evaluator/filters_test.go +++ b/internal/evaluator/filters_test.go @@ -1796,3 +1796,79 @@ func TestPipelineIntentionWithMultipleValues(t *testing.T) { "security package should be included (has included rules)") }) } + +////////////////////////////////////////////////////////////////////////////// +// formatFutureEnforcementMessage tests +////////////////////////////////////////////////////////////////////////////// + +func TestFormatFutureEnforcementMessage(t *testing.T) { + tests := []struct { + name string + result Result + expected string + }{ + { + name: "with effective_on string", + result: Result{ + Message: "The required 'cpe' label is missing", + Metadata: map[string]interface{}{ + metadataEffectiveOn: "2024-12-01T00:00:00Z", + }, + }, + expected: "The required 'cpe' label is missing. This will become a failure starting on 2024-12-01T00:00:00Z", + }, + { + name: "missing effective_on metadata", + result: Result{ + Message: "Some error message", + Metadata: map[string]interface{}{}, + }, + expected: "Some error message", + }, + { + name: "non-string effective_on", + result: Result{ + Message: "Some error message", + Metadata: map[string]interface{}{ + metadataEffectiveOn: 12345, + }, + }, + expected: "Some error message", + }, + { + name: "empty string effective_on", + result: Result{ + Message: "Some error message", + Metadata: map[string]interface{}{ + metadataEffectiveOn: "", + }, + }, + expected: "Some error message", + }, + { + name: "nil metadata", + result: Result{ + Message: "Some error message", + Metadata: nil, + }, + expected: "Some error message", + }, + { + name: "message already ends with period", + result: Result{ + Message: "The required 'cpe' label is missing.", + Metadata: map[string]interface{}{ + metadataEffectiveOn: "2025-01-15T00:00:00Z", + }, + }, + expected: "The required 'cpe' label is missing. This will become a failure starting on 2025-01-15T00:00:00Z", + }, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + got := formatFutureEnforcementMessage(tc.result) + assert.Equal(t, tc.expected, got) + }) + } +}