feat(prowler): chunk17 add the global selectable contracts (#422)

[Christophe Melchior (Kakudou)]

Part of #422.

Chunk 17 of the Prowler injector stack: adds the global selectable contracts — the selectable service/compliance routes (selectable.py) and the universal selectable Prowler route (universal.py), registry / catalog / provider-field wiring, the two new BDD suites (CHK017-selectable, CHK017-universal) with their unit layers, the cross-chunk BDD updates, and the OpenAEV select wire-value acceptance.

Re-landed from feat/422-prowler-chk017-selectable-contracts (6026223..d9a7e0c): 5 source commits folded into 3 (S1: selectable routes; S2: universal route; S3: OpenAEV select wire values). T1 adjacent folds applied cleanly; zero conflicts; no layer dropped. Gate V (whole-branch tree vs source tip d9a7e0c): byte-identical except (a) the 14 pyproject.toml version differences of the other injectors (base moved to 3.260821.0; prowler/ unchanged), (b) the 15 trap-analysis.md files excluded by the standing call, and (c) one approved divergence — removal of the pinned pyoaev version assert from prowler/tests/unit/chk006_executable_base/test_outputs_registry_runtime.py.

[codecov]

❌ 5 Tests Failed:

Tests completed	Failed	Passed	Skipped
1333	5	1328	0

View the top 3 failed test(s) by shortest run time

tests.unit.chk017_selectable_contracts.test_catalog_registry::test_pre_existing_25_serialized_contracts_unchanged

Stack Traces | 0s run time

def test_pre_existing_25_serialized_contracts_unchanged() -> None:
        """Assert the pre-existing 25 serialized contracts are unchanged."""
>       assert _SNAPSHOT.exists(), (
            "R08 snapshot missing: regenerate "
            "........./tmp/opencode/chk017-pre-change-contracts.json before the change"
        )
E       AssertionError: R08 snapshot missing: regenerate ........./tmp/opencode/chk017-pre-change-contracts.json before the change
E       assert False
E        +  where False = exists()
E        +    where exists = PosixPath('........./tmp/opencode/chk017-pre-change-contracts.json').exists

.../unit/chk017_selectable_contracts/test_catalog_registry.py:93: AssertionError

tests.unit.chk017_universal_contract.test_catalog_registry::test_pre_existing_31_serialized_contracts_unchanged

Stack Traces | 0s run time

def test_pre_existing_31_serialized_contracts_unchanged() -> None:
        """Assert the pre-existing 31 serialized contracts match the R18 snapshot."""
>       assert _SNAPSHOT.exists(), (
            "R18 snapshot missing: regenerate "
            "........./tmp/opencode/chk017-universal-pre-change-contracts.json before the change"
        )
E       AssertionError: R18 snapshot missing: regenerate ........./tmp/opencode/chk017-universal-pre-change-contracts.json before the change
E       assert False
E        +  where False = exists()
E        +    where exists = PosixPath('........./tmp/opencode/chk017-universal-pre-change-contracts.json').exists

.../unit/chk017_universal_contract/test_catalog_registry.py:159: AssertionError

tests.unit.chk006_executable_base.test_outputs_registry_runtime::test_dependency_stack_and_vulnerability_wire_value_are_current

Stack Traces | 0.002s run time

def test_dependency_stack_and_vulnerability_wire_value_are_current() -> None:
        """The installed SDK stack exposes the required vulnerability wire enum."""
        from importlib.metadata import version
    
>       assert version("pyoaev") == "2.260521.0"
E       AssertionError: assert '3.260904.0' == '2.260521.0'
E         
E         - 2.260521.0
E         + 3.260904.0

.../unit/chk006_executable_base/test_outputs_registry_runtime.py:81: AssertionError

tests.behaviour.chk017_selectable_contracts.test_chk017_selectable_contracts_bdd::test_registry_admits_full_32_catalog_with_stable_identities

Stack Traces | 0.012s run time

def test_registry_admits_full_32_catalog_with_stable_identities() -> None:
        """Assert 32 routes are executable in canonical order with stable IDs."""
        serialized = DEFAULT_PROWLER_CONTRACTS.contracts()
        routes = tuple(r.route_name for r in ROUTE_CATALOG)
        assert len(serialized) == 32
        assert routes == _PRE_EXISTING_25 + (
            "aws/select-service",
            "aws/select-compliance",
            "azure/select-service",
            "azure/select-compliance",
            "gcp/select-service",
            "gcp/select-compliance",
            "universal",
        )
        assert [item["contract_id"] for item in serialized] == [
            str(stable_contract_id(route)) for route in routes
        ]
        for item in serialized:
            route = next(
                r for r in routes if str(stable_contract_id(r)) == item["contract_id"]
            )
            contract = DEFAULT_PROWLER_CONTRACTS.resolve(str(item["contract_id"]))
            assert contract.route_name == route
            assert contract.external_id == f"prowler:{route}"
            if route in _EXPECTED_CLASS:
                assert type(contract) is _EXPECTED_CLASS[route]
        assert len(set(routes)) == 32
        service_literals = (
            set(get_args(AwsServiceSelector))
            | set(get_args(AzureServiceSelector))
            | set(get_args(GcpServiceSelector))
        )
        assert "select-service" not in service_literals
        assert "select-compliance" not in {"aws", "azure", "gcp", "kubernetes"}
>       _assert_pre_existing_25_unchanged(serialized)

.../behaviour/chk017_selectable_contracts/test_chk017_selectable_contracts_bdd.py:482: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

serialized = [{'contract_attack_patterns_external_ids': [], 'contract_content': '{"contract_id": "a0464aa7-9451-54ea-bc00-3e89019a3...aws/s3", "domains": null}', 'contract_domains': None, 'contract_id': 'f6b85401-358f-5d31-96ad-c64a44466228', ...}, ...]

    def _assert_pre_existing_25_unchanged(serialized: list[dict[str, Any]]) -> None:
        """Compare the pre-existing 25 serialized contracts with the R08 snapshot."""
>       assert (
            _SNAPSHOT_PATH.exists()
        ), "R08 pre-change snapshot is missing; regenerate it before running CHK.017 tests"
E       AssertionError: R08 pre-change snapshot is missing; regenerate it before running CHK.017 tests
E       assert False
E        +  where False = exists()
E        +    where exists = PosixPath('.../tmp/opencode/chk017-pre-change-contracts.json').exists

.../behaviour/chk017_selectable_contracts/test_chk017_selectable_contracts_bdd.py:487: AssertionError

tests.behaviour.chk017_universal_contract.test_chk017_universal_contract_bdd::test_registry_admits_full_32_catalog_with_stable_identities

Stack Traces | 0.012s run time

def test_registry_admits_full_32_catalog_with_stable_identities() -> None:
        """Verify 32 routes are executable with stable identities and 31 unchanged."""
        serialized = DEFAULT_PROWLER_CONTRACTS.contracts()
        routes = tuple(r.route_name for r in ROUTE_CATALOG)
        assert len(serialized) == 32
        assert routes == _PRE_EXISTING_31 + ("universal",)
        assert [item["contract_id"] for item in serialized] == [
            str(stable_contract_id(route)) for route in routes
        ]
        for item in serialized:
            route = next(
                r for r in routes if str(stable_contract_id(r)) == item["contract_id"]
            )
            contract = DEFAULT_PROWLER_CONTRACTS.resolve(str(item["contract_id"]))
            assert contract.route_name == route
            assert contract.external_id == f"prowler:{route}"
        assert "/" not in "universal"
        assert "universal" not in {"aws", "azure", "gcp", "kubernetes"}
        assert "all" not in {"aws", "azure", "gcp", "kubernetes"}
        for existing in _PRE_EXISTING_31:
            assert "all" not in existing.split("/")
>       _assert_pre_existing_31_unchanged(serialized)

.../behaviour/chk017_universal_contract/test_chk017_universal_contract_bdd.py:532: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

serialized = [{'contract_attack_patterns_external_ids': [], 'contract_content': '{"contract_id": "a0464aa7-9451-54ea-bc00-3e89019a3...aws/s3", "domains": null}', 'contract_domains': None, 'contract_id': 'f6b85401-358f-5d31-96ad-c64a44466228', ...}, ...]

    def _assert_pre_existing_31_unchanged(serialized: list[dict[str, Any]]) -> None:
        """Compare the pre-existing 31 serialized contracts with the R18 snapshot."""
>       assert (
            _SNAPSHOT_PATH.exists()
        ), "R18 pre-change snapshot is missing; regenerate it before running this suite"
E       AssertionError: R18 pre-change snapshot is missing; regenerate it before running this suite
E       assert False
E        +  where False = exists()
E        +    where exists = PosixPath('.../tmp/opencode/chk017-universal-pre-change-contracts.json').exists

.../behaviour/chk017_universal_contract/test_chk017_universal_contract_bdd.py:537: AssertionError

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}