Include enforcement date in warnings for future effective_on violations

internal/evaluator/conftest_evaluator_unit_core_test.go

@@ -221,7 +221,7 @@ func TestConftestEvaluatorEvaluateSeverity(t *testing.T) {
 				},
 
 				{
-					Message: "not yet effective",
+					Message: "not yet effective. This will become a failure starting on 3021-01-01T00:00:00Z",
 					Metadata: map[string]any{
 						"effective_on": "3021-01-01T00:00:00Z",
 					},

internal/evaluator/filters.go

@@ -997,7 +997,14 @@ func (f *LegacyPostEvaluationFilter) CategorizeResults(
 			}
 		case "failure":
 			if getSeverity(result) == severityWarning || !isResultEffective(result, effectiveTime) {
-				warnings = append(warnings, result)
+				// If being demoted due to future effective_on, enhance the message
+				if !isResultEffective(result, effectiveTime) {
+					enhancedResult := result
+					enhancedResult.Message = formatFutureEnforcementMessage(result)
+					warnings = append(warnings, enhancedResult)
+				} else {
+					warnings = append(warnings, result)
+				}
 			} else {
 				failures = append(failures, result)
 			}
@@ -1120,7 +1127,14 @@ func (f *UnifiedPostEvaluationFilter) CategorizeResults(
 			}
 		case "failure":
 			if getSeverity(filteredResult) == severityWarning || !isResultEffective(filteredResult, effectiveTime) {
-				warnings = append(warnings, filteredResult)
+				// If being demoted due to future effective_on, enhance the message
+				if !isResultEffective(filteredResult, effectiveTime) {
+					enhancedResult := filteredResult
+					enhancedResult.Message = formatFutureEnforcementMessage(filteredResult)
+					warnings = append(warnings, enhancedResult)
+				} else {
+					warnings = append(warnings, filteredResult)
+				}
 			} else {
 				failures = append(failures, filteredResult)
 			}
@@ -1204,3 +1218,21 @@ func (f *UnifiedPostEvaluationFilter) determineOriginalType(filteredResult Resul
 
 	return "unknown"
 }
+
+// formatFutureEnforcementMessage enhances a result message to indicate when
+// a future effective_on date will cause enforcement to begin.
+// Returns the enhanced message if effective_on is present, otherwise returns
+// the original message unchanged.
+func formatFutureEnforcementMessage(result Result) string {
+	originalMessage := result.Message
+
+	// Check if this result has an effective_on date
+	effectiveOnStr, ok := result.Metadata[metadataEffectiveOn].(string)
+	if !ok || effectiveOnStr == "" {
+		return originalMessage
+	}
+
+	// Append enforcement notice with the effective_on date as-is
+	return fmt.Sprintf("%s. This will become a failure starting on %s",
+		strings.TrimRight(originalMessage, "."), effectiveOnStr)
+}

internal/evaluator/filters_test.go

@@ -1796,3 +1796,79 @@ func TestPipelineIntentionWithMultipleValues(t *testing.T) {
 			"security package should be included (has included rules)")
 	})
 }
+
+//////////////////////////////////////////////////////////////////////////////
+// formatFutureEnforcementMessage tests
+//////////////////////////////////////////////////////////////////////////////
+
+func TestFormatFutureEnforcementMessage(t *testing.T) {
+	tests := []struct {
+		name     string
+		result   Result
+		expected string
+	}{
+		{
+			name: "with effective_on string",
+			result: Result{
+				Message: "The required 'cpe' label is missing",
+				Metadata: map[string]interface{}{
+					metadataEffectiveOn: "2024-12-01T00:00:00Z",
+				},
+			},
+			expected: "The required 'cpe' label is missing. This will become a failure starting on 2024-12-01T00:00:00Z",
+		},
+		{
+			name: "missing effective_on metadata",
+			result: Result{
+				Message:  "Some error message",
+				Metadata: map[string]interface{}{},
+			},
+			expected: "Some error message",
+		},
+		{
+			name: "non-string effective_on",
+			result: Result{
+				Message: "Some error message",
+				Metadata: map[string]interface{}{
+					metadataEffectiveOn: 12345,
+				},
+			},
+			expected: "Some error message",
+		},
+		{
+			name: "empty string effective_on",
+			result: Result{
+				Message: "Some error message",
+				Metadata: map[string]interface{}{
+					metadataEffectiveOn: "",
+				},
+			},
+			expected: "Some error message",
+		},
+		{
+			name: "nil metadata",
+			result: Result{
+				Message:  "Some error message",
+				Metadata: nil,
+			},
+			expected: "Some error message",
+		},
+		{
+			name: "message already ends with period",
+			result: Result{
+				Message: "The required 'cpe' label is missing.",
+				Metadata: map[string]interface{}{
+					metadataEffectiveOn: "2025-01-15T00:00:00Z",
+				},
+			},
+			expected: "The required 'cpe' label is missing. This will become a failure starting on 2025-01-15T00:00:00Z",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := formatFutureEnforcementMessage(tc.result)
+			assert.Equal(t, tc.expected, got)
+		})
+	}
+}