Make secrets integration test robust to changes in array ordering

Author: jasonforal

misc/integration-test-secrets.sh

@@ -29,35 +29,41 @@ if [ "$RES" -ne "$EXPECTING" ]; then
   exit 1
 fi
 
-status1=`jq '.runs[0].results[0].properties.tags[1]' "${REPO_DIR}/results1.json"`
+read -r -d '' JQ_QUERY <<'EOF'
+[.runs[].results[] | select(.locations[0].physicalLocation.artifactLocation.uri == $uri)][ $idx ]
+| .properties.tags[]?
+| select(startswith("DATADOG_SECRET_VALIDATION_STATUS:"))
+EOF
+
+status1=$(jq --arg uri "datadog-keys.sh" --argjson idx 0 "$JQ_QUERY" "${REPO_DIR}/results1.json")
 
 if [ "$status1" != "\"DATADOG_SECRET_VALIDATION_STATUS:INVALID\"" ]; then
   echo "status1: did not find DATADOG_SECRET_VALIDATION_STATUS:INVALID in properties, found $status1"
   exit 1
 fi
 
-status2=`jq '.runs[0].results[1].properties.tags[1]' "${REPO_DIR}/results1.json"`
+status2=$(jq --arg uri "plop/foo_test.py" --argjson idx 0 "$JQ_QUERY" "${REPO_DIR}/results1.json")
 
 if [ "$status2" != "\"DATADOG_SECRET_VALIDATION_STATUS:NOT_VALIDATED\"" ]; then
   echo "status2: did not find DATADOG_SECRET_VALIDATION_STATUS:NOT_VALIDATED in properties, found $status2"
   exit 1
 fi
 
-status3=`jq '.runs[0].results[2].properties.tags[1]' "${REPO_DIR}/results1.json"`
+status3=$(jq --arg uri "plop/foo_test.py" --argjson idx 1 "$JQ_QUERY" "${REPO_DIR}/results1.json")
 
 if [ "$status3" != "\"DATADOG_SECRET_VALIDATION_STATUS:NOT_VALIDATED\"" ]; then
   echo "status3: did not find DATADOG_SECRET_VALIDATION_STATUS:NOT_VALIDATED in properties, found $status3"
   exit 1
 fi
 
 ## Make sure the SDS ID is added to the SARIF file
-status4=`jq '.runs[0].tool.driver.rules[0].properties.tags[1]' "${REPO_DIR}/results1.json"`
+status4=`jq '.runs[0].tool.driver.rules[0].properties.tags[] | select(startswith("DATADOG_SDS_ID:"))' "${REPO_DIR}/results1.json"`
 
-if [ "$status4" != "\"DATADOG_SDS_ID:5ef83eb0-4137-48a2-a28b-2402c185863c\"" ]; then
-  echo "status3: did not find DATADOG_SDS_ID:5ef83eb0-4137-48a2-a28b-2402c185863c in properties, found $status4"
+if [ -z "$status4" ]; then
+  echo "did not find DATADOG_SDS_ID in tags"
   exit 1
 fi
 
 echo "All tests passed"
 
-exit 0
+exit 0