Testing

Quick Start

# Run all tests
cd backend && go test ./... -count=1

# Run with verbose output
go test ./... -v -count=1

# Run tests for a specific package
go test ./internal/vex/ -v -count=1

# Run a single test by name
go test ./internal/vex/ -run TestNormalizeVulnID -v

# Run with race detection (used in CI)
go test ./... -count=1 -race

# Check coverage
go test ./... -coverprofile=coverage.out
go tool cover -html=coverage.out

Test Structure

Tests live next to the code they test, using Go’s _test.go convention:

backend/
├── cmd/
│   └── api-gateway/
│       ├── main.go
│       └── main_test.go            ← auth middleware, input validation
├── internal/
│   ├── clickhouse/
│   │   ├── client.go
│   │   └── client_test.go          ← query method signatures, cluster helpers
│   ├── config/
│   │   ├── config.go
│   │   └── config_test.go          ← Load(), S3 buckets, auth, ignore prefix, shared settings
│   ├── cyclonedx/
│   │   ├── parser.go
│   │   └── parser_test.go          ← CycloneDX parsing
│   ├── github/
│   │   ├── purl.go
│   │   ├── purl_test.go
│   │   ├── resolver.go
│   │   └── resolver_test.go
│   ├── license/
│   │   ├── checker.go
│   │   └── checker_test.go
│   ├── osv/
│   │   ├── client.go
│   │   └── client_test.go
│   ├── osvutil/
│   │   ├── osvutil.go
│   │   └── osvutil_test.go
│   ├── protobomparser/
│   │   ├── parser.go
│   │   └── parser_test.go          ← protobom backend detection
│   ├── repo/
│   │   ├── scanner.go
│   │   └── scanner_test.go         ← file scanning, ignore prefix, generic JSON
│   ├── s3/
│   │   ├── client.go
│   │   └── client_test.go
│   ├── sbom/
│   │   ├── dispatch.go
│   │   └── dispatch_test.go        ← multi-format detection
│   ├── spdx/
│   │   ├── parser.go
│   │   └── parser_test.go
│   └── vex/
│       ├── parser.go
│       └── parser_test.go
├── pkg/
│   ├── dto/
│   │   └── dto_test.go             ← JSON serialization, fields
│   └── models/
│       └── models_test.go          ← cluster fields, omitempty

Current Test Inventory

Counted on 2026-10-04 with CLICKHOUSE_HOST=localhost go test ./... -count=1 -race -json against make dev-up (top-level tests and t.Run subtests that ran). Without CLICKHOUSE_HOST, the four query smoke tests in internal/clickhouse/queries_integration_test.go are skipped — run them whenever you add or change a query, and add new queries to TestQueriesExecute.

License resolution: golden and docs-sync tests

Every license heuristic is a documented decision (see License Resolution). Two tests keep code, behaviour and documentation together:

• TestLicensePipelineGolden (cmd/parsing-worker/golden_test.go) runs testdata/license_golden.spdx.json — one synthetic package per path through the pipeline — through the real parser, resolvePackageLicenses (with offline registry fakes that implement Explain), the real policy and the compliance exclusion, and pins license, source, category and exclusion per package in licenseGolden.
• TestDocsLicenseResolutionInSync (cmd/parsing-worker/docs_sync_test.go) parses the tables between <!-- name:start --> / <!-- name:end --> markers on the docs page and asserts: the source vocabulary equals the code’s origins (in resolver order), modifiers and license.UnresolvedReasons; each normalization example matches license.Recover and the default policy; the worked examples equal licenseGolden row for row.

A new rule therefore needs a fixture package, a golden row, a docs row and a decision-log entry; any one missing fails go test.

Test Patterns

Table-Driven Tests

func TestCategorize(t *testing.T) {
    tests := []struct {
        input    string
        expected Category
    }{
        {"MIT", CategoryPermissive},
        {"GPL-3.0-only", CategoryCopyleft},
    }
    for _, tt := range tests {
        t.Run(tt.input, func(t *testing.T) {
            got := Categorize(tt.input)
            if got != tt.expected {
                t.Errorf("Categorize(%q) = %q, want %q", tt.input, got, tt.expected)
            }
        })
    }
}

httptest Mock Server

func TestQueryBatch_MockServer(t *testing.T) {
    server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        w.WriteHeader(http.StatusOK)
        w.Write([]byte(`{"results": [{"vulns": [...]}]}`))
    }))
    defer server.Close()
    // Use server.URL as base URL...
}

t.TempDir() for Filesystem Tests

func TestScanner_Scan(t *testing.T) {
    tmpDir := t.TempDir()
    os.WriteFile(filepath.Join(tmpDir, "test.spdx.json"), []byte(`{...}`), 0644)
    scanner := NewScanner(tmpDir)
    files, err := scanner.Scan()
    // Assert...
}

Test Requirements

• No external dependencies. No running ClickHouse, network, or Docker needed.
• No test order dependency. Each test is self-contained.
• Race-safe. All tests must pass with -race flag.
• Use subtests (t.Run()) for table-driven tests.

CI Integration

Tests run automatically on every push/PR:

- name: Test
  working-directory: backend
  run: go test ./... -count=1 -race

Angular (Frontend) Tests

The Angular frontend uses Vitest (not Karma/Jasmine). Tests live alongside components as *.spec.ts files.

Quick Start

cd ui

# Run all tests
npx ng test

# Run once (no watch)
npx ng test --watch=false

Current Test Inventory (Frontend)

UI end-to-end tests (Playwright)

The unit specs mock HTTP; the e2e suite in ui/e2e/ drives the built UI through nginx against a live stack, so the /api proxy, security headers, ui-config.json, custom-theme.css and the real API contract are all under test. It is the parity gate for any frontend refactor: the suite must stay green and unchanged.

make dev-up && make demo-fleet && make ui-e2e-wait   # seed examples/fleet, wait for the queue to drain
make ui-e2e                                          # or: cd ui && npm run e2e / npm run e2e:ui
E2E_BASE_URL=http://localhost:4200 npm run e2e       # against `make ui-dev` instead of nginx

Every test fails on a browser console error or a failed /api response (fixture expectApiErrors opts a not-found test out). Tests read their expectations from the API, not from hard-coded demo names. The suite runs with one worker: the gateway rate limit (100 req/10 s per IP) trips with parallel workers.

Performance gate: npm run e2e:bundle-size compares the production build with ui/e2e/bundle-size.baseline.json (initial and total JS, +10 % tolerance). Update it deliberately with node e2e/bundle-size.mjs --update when a size change is intended.

CI runs both in the frontend-e2e job (.github/workflows/ci.yml), uploading the Playwright report and compose logs on failure.

Test Patterns (Angular)

• Model tests — Verify TypeScript interfaces match API shapes (no HTTP mocking needed)
• Component tests — Use TestBed with provideHttpClientTesting() for HTTP mocking
• OnPush strategy — Tests call fixture.detectChanges() and verify DOM output