Repository navigation
feat(testing): tag audit findings with test project kind and whether CI runs it #6041
Description
Part of #6038
Problem
testing:audit findings say nothing about the project a test lives in. In a mixed .NET tree (unit, integration, smoke against live cloud resources, provisioning or operational runners that reset shared environments, architecture tests, functional/BDD), a finding in a project CI never runs, or in one that touches live environments, ranks the same as one in the unit suite, and nothing warns before someone runs those tests.
Evidence
Verified on origin/main (testing 0.21.3): the findings table written by plugins/testing/skills/audit/scripts/cant-fail-scan.sh --findings carries rank, tier, confidence, location, surface, finding and action, with no project or CI field. Reported by the producing session: only some test projects ran in CI (CI built one unit-test solution, and some test lines in the workflow were commented out), and operational projects were mixed into the same tree.
Proposed approach
Decision needed on how far to go; recommended minimal version first:
- Per finding, resolve the owning project (nearest
.csprojfor C#) and whether it is a member of any solution CI builds (parse.github/workflows/*.ymlfordotnet test/dotnet buildtargets, then the.sln/.slnxmembership). Reportci: yes|no|unknown. - Classify project kind from evidence that is cheap and explicit: project and folder name tokens (
Integration,Smoke,Functional,Architecture,Provisioning), package references (Reqnroll, Playwright, ArchUnitNET, Testcontainers), and an optional repo config override. Reportunknownrather than guess. - Rank findings in CI-run unit projects first, and print a warning on any finding in a project classed operational or live.
Alternative: let the repo declare project kinds only in config. Simpler and exact, but nothing works until someone writes it.
Files: plugins/testing/skills/audit/scripts/cant-fail-scan.sh, plugins/testing/skills/audit/SKILL.md, plugins/testing/scripts/resolve-config.sh (for an override), tests beside them.
Acceptance criteria
- On a fixture with two test projects, one listed in a workflow's
dotnet testsolution and one not, findings carryci: yesandci: norespectively. - A project named
*.Provisioning.Tests(or configured as operational) gets kindoperationaland its findings carry a warning not to run them. - Unclassifiable projects report
unknown, never a guessed kind.
Constraints and gotchas
- The audit must stay read-only and run no tests; it must never execute an operational project to learn its kind.
- Workflow YAML parsing should fail soft to
unknown. - Version bump and CHANGELOG entry for testing.
Context
Source: local handoff item 20261003-024929-testing-cleanup-and-audit-full-dotnet-support.md, gap 3 (project-kind awareness).
Activity
kyle-sexton commentedon Oct 13, 2026
Decision recorded. The owner approved applying independently verified recommendations on 2026-10-12.
Basis: plugins/testing/skills/audit/scripts/ (git grep for csproj/project kind on origin/main: no hits, so nothing exists yet); issue feat(testing): tag audit findings with test project kind and whether CI runs it #6041 Proposed approach; judgment
Wants testing:audit findings to carry the owning test project, whether CI runs it, and a project kind (unit, integration, operational) so live or CI-skipped projects rank differently and warn. Nothing has shipped; the findings table on main still has no project or CI field.
Verified by an independent fresh-context check (confirmed, risk low): gh issue view 6041 (OPEN, no comments); git grep csproj|project_kind|ci_run in plugins/testing/skills/audit/scripts and plugins/testing/scripts: no hits (hits only in eval fixtures); git log since 2026-10-03 on testing audit (#7049, #6840, #6471: none adds project kind); #6038 OPEN; gh pr list search 6041: none
Admission to an agent lane stays with the work-class rules and owner ratification.
kyle-sexton commentedon Oct 13, 2026
Owner batch-ratified this admission in an attended session on 2026-10-12: work-class: scoped. Rule: class C1-C3, no trust surface, the independent check confirmed the recorded decision, and no owner step remains.
kyle-sexton commentedon Oct 13, 2026
Correction: this issue already carried work-class: structural, which batch ratification never admits. The admission above is reverted; it stays escalated for an attended decision.
kyle-sexton commentedon Oct 17, 2026
Owner decision 2026-10-17: work classes are being retired (Q505); the recorded decision stands, so the structural hold is removed and this issue joins a later admission wave.
kyle-sexton commentedon Oct 18, 2026
Agent Brief
Type: Feature
Summary: testing:audit findings carry the owning test project, whether CI runs it, and the project's kind, and warn on operational or live projects.
Current behavior:
The findings table written by the cannot-fail scanner carries rank, tier, confidence, location, surface, finding and action. Nothing says which test project a finding lives in, whether CI builds that project, or whether the project touches live environments.
Desired behavior:
.csprojabove the test file).ci: yes|no|unknown: yes when the project belongs to a solution or project a repository workflow'sdotnet testordotnet buildtargets, no when workflows were read and none targets it, unknown when no workflow can be read or parsing fails.unknown, never a guess.Key interfaces:
project,ciandkindfields.Acceptance criteria:
dotnet testsolution and one not, findings carryci: yesandci: no.*.Provisioning.Testsgets kindoperationaland its findings carry the warning.unknown.ci: unknown, not an error exit.scripts/run-test-file.shwith these cases.scripts/check-changelog-fragments.shpasses with a testing fragment.Out of scope:
This was generated by AI during backlog shaping. The owner approved this in an attended backlog-shaping session on 2026-10-17.