Skip to content

feat(testing): tag audit findings with test project kind and whether CI runs it #6041

Description

@kyle-sexton

Part of #6038

Problem

testing:audit findings say nothing about the project a test lives in. In a mixed .NET tree (unit, integration, smoke against live cloud resources, provisioning or operational runners that reset shared environments, architecture tests, functional/BDD), a finding in a project CI never runs, or in one that touches live environments, ranks the same as one in the unit suite, and nothing warns before someone runs those tests.

Evidence

Verified on origin/main (testing 0.21.3): the findings table written by plugins/testing/skills/audit/scripts/cant-fail-scan.sh --findings carries rank, tier, confidence, location, surface, finding and action, with no project or CI field. Reported by the producing session: only some test projects ran in CI (CI built one unit-test solution, and some test lines in the workflow were commented out), and operational projects were mixed into the same tree.

Proposed approach

Decision needed on how far to go; recommended minimal version first:

  1. Per finding, resolve the owning project (nearest .csproj for C#) and whether it is a member of any solution CI builds (parse .github/workflows/*.yml for dotnet test/dotnet build targets, then the .sln/.slnx membership). Report ci: yes|no|unknown.
  2. Classify project kind from evidence that is cheap and explicit: project and folder name tokens (Integration, Smoke, Functional, Architecture, Provisioning), package references (Reqnroll, Playwright, ArchUnitNET, Testcontainers), and an optional repo config override. Report unknown rather than guess.
  3. Rank findings in CI-run unit projects first, and print a warning on any finding in a project classed operational or live.

Alternative: let the repo declare project kinds only in config. Simpler and exact, but nothing works until someone writes it.

Files: plugins/testing/skills/audit/scripts/cant-fail-scan.sh, plugins/testing/skills/audit/SKILL.md, plugins/testing/scripts/resolve-config.sh (for an override), tests beside them.

Acceptance criteria

  • On a fixture with two test projects, one listed in a workflow's dotnet test solution and one not, findings carry ci: yes and ci: no respectively.
  • A project named *.Provisioning.Tests (or configured as operational) gets kind operational and its findings carry a warning not to run them.
  • Unclassifiable projects report unknown, never a guessed kind.

Constraints and gotchas

  • The audit must stay read-only and run no tests; it must never execute an operational project to learn its kind.
  • Workflow YAML parsing should fail soft to unknown.
  • Version bump and CHANGELOG entry for testing.

Context

Source: local handoff item 20261003-024929-testing-cleanup-and-audit-full-dotnet-support.md, gap 3 (project-kind awareness).

Activity

  1. added
    status: needs-decisionAwaiting a human or maintainer judgment call.
    priority: mediumReal value, no hard deadline; normal backlog flow.
    work-class: structuralRefactors, migrations, contract changes; cross-cutting and hard to reverse.
    on Oct 3, 2026
  2. kyle-sexton commented on Oct 13, 2026

    @kyle-sexton
    MemberAuthor

    Decision recorded. The owner approved applying independently verified recommendations on 2026-10-12.

    • How should the audit learn each test project's kind and CI membership? → Heuristic detection (nearest .csproj, workflow dotnet test targets and .sln membership, name and package tokens) with an optional config override, reporting unknown when unsure
      Basis: plugins/testing/skills/audit/scripts/ (git grep for csproj/project kind on origin/main: no hits, so nothing exists yet); issue feat(testing): tag audit findings with test project kind and whether CI runs it #6041 Proposed approach; judgment

    Wants testing:audit findings to carry the owning test project, whether CI runs it, and a project kind (unit, integration, operational) so live or CI-skipped projects rank differently and warn. Nothing has shipped; the findings table on main still has no project or CI field.

    Verified by an independent fresh-context check (confirmed, risk low): gh issue view 6041 (OPEN, no comments); git grep csproj|project_kind|ci_run in plugins/testing/skills/audit/scripts and plugins/testing/scripts: no hits (hits only in eval fixtures); git log since 2026-10-03 on testing audit (#7049, #6840, #6471: none adds project kind); #6038 OPEN; gh pr list search 6041: none

    Admission to an agent lane stays with the work-class rules and owner ratification.

  3. kyle-sexton commented on Oct 13, 2026

    @kyle-sexton
    MemberAuthor

    Owner batch-ratified this admission in an attended session on 2026-10-12: work-class: scoped. Rule: class C1-C3, no trust surface, the independent check confirmed the recorded decision, and no owner step remains.

  4. added
    work-class: scopedA briefed fix or small feature; blast radius bounded by the brief, tests exist.
    agent-readyFully specified and briefed; eligible for autonomous pickup from the frontier.
    needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.
    and removed
    agent-readyFully specified and briefed; eligible for autonomous pickup from the frontier.
    work-class: scopedA briefed fix or small feature; blast radius bounded by the brief, tests exist.
    on Oct 13, 2026
  5. kyle-sexton commented on Oct 13, 2026

    @kyle-sexton
    MemberAuthor

    Correction: this issue already carried work-class: structural, which batch ratification never admits. The admission above is reverted; it stays escalated for an attended decision.

  6. removed
    work-class: structuralRefactors, migrations, contract changes; cross-cutting and hard to reverse.
    on Oct 17, 2026
  7. kyle-sexton commented on Oct 17, 2026

    @kyle-sexton
    MemberAuthor

    Owner decision 2026-10-17: work classes are being retired (Q505); the recorded decision stands, so the structural hold is removed and this issue joins a later admission wave.

  8. kyle-sexton commented on Oct 18, 2026

    @kyle-sexton
    MemberAuthor

    Agent Brief

    Type: Feature
    Summary: testing:audit findings carry the owning test project, whether CI runs it, and the project's kind, and warn on operational or live projects.

    Current behavior:
    The findings table written by the cannot-fail scanner carries rank, tier, confidence, location, surface, finding and action. Nothing says which test project a finding lives in, whether CI builds that project, or whether the project touches live environments.

    Desired behavior:

    • For C#, each finding names its owning project (the nearest .csproj above the test file).
    • Each finding carries ci: yes|no|unknown: yes when the project belongs to a solution or project a repository workflow's dotnet test or dotnet build targets, no when workflows were read and none targets it, unknown when no workflow can be read or parsing fails.
    • Each finding carries a kind from cheap explicit evidence: project and folder name tokens (Integration, Smoke, Functional, Architecture, Provisioning) and package references (Reqnroll, Playwright, ArchUnitNET, Testcontainers). An optional repo config override maps a project to a kind. Anything else is unknown, never a guess.
    • Findings in CI-run unit projects rank first. A finding in a project of kind operational or live carries a warning not to run its tests.
    • The audit stays read-only and never executes a test project to learn its kind.
    • Non-C# findings show the new fields as unknown and are otherwise unchanged.

    Key interfaces:

    • The scanner's findings record: new project, ci and kind fields.
    • testing config resolution: an optional per-project kind override key.
    • The audit skill's description of the findings table.

    Acceptance criteria:

    • On a fixture with two test projects, one in a workflow's dotnet test solution and one not, findings carry ci: yes and ci: no.
    • A project named *.Provisioning.Tests gets kind operational and its findings carry the warning.
    • A config override changes a project's kind.
    • An unclassifiable project reports unknown.
    • A malformed workflow file yields ci: unknown, not an error exit.
    • The scanner's test suite passes under scripts/run-test-file.sh with these cases.
    • scripts/check-changelog-fragments.sh passes with a testing fragment.

    Out of scope:


    This was generated by AI during backlog shaping. The owner approved this in an attended backlog-shaping session on 2026-10-17.

  9. added
    agent-readyFully specified and briefed; eligible for autonomous pickup from the frontier.
    work-class: scopedA briefed fix or small feature; blast radius bounded by the brief, tests exist.
    and removed
    needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.
    on Oct 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    agent-readyFully specified and briefed; eligible for autonomous pickup from the frontier.priority: mediumReal value, no hard deadline; normal backlog flow.work-class: scopedA briefed fix or small feature; blast radius bounded by the brief, tests exist.

    Fields

    No fields configured for Feature.

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions