spikerj/spikersoft-issues
1
0
Fork 0
Code Issues 196 Pull Requests Actions Packages Projects Releases Wiki Activity

[Backend][Tests] Five strict-mock tests carry no explicit assertion (SonarQube S2699 BLOCKER x6 — 5 fixed, 1 false-positived) #636

New Issue
Closed
opened 2026-07-17 04:54:01 +00:00 by spikerj · 1 comment
spikerj commented 2026-07-17 04:54:01 +00:00
Owner
Copy Link
Copy Source

From the SonarQube triage loop (2026-07-17). Six BLOCKER 'add at least one assertion' findings, each evaluated individually:

  • 5 real-but-implicit: tests in S3MediaFallbackMiddlewareTests, BookArtifactPurgerTests, QuarantineMirrorTests, StagingMirrorTests (x2) rely on MockBehavior.Strict as the assertion (an unexpected store call throws). Legitimate idiom, but implicit: a reader (and sonar) can't see what the test guarantees, and if someone later relaxes the mock to Loose the test silently asserts nothing. Fix: add store.VerifyNoOtherCalls() — an explicit, sonar-visible assertion of exactly the same contract.
  • 1 false positive by design (marked in SonarQube with comment): EnglishSourceDumpTool's env-gated [Fact] is a documented one-off translator-authoring tool, not a regression test — nothing to assert.

Test-only change, zero production surface.

From the SonarQube triage loop (2026-07-17). Six BLOCKER 'add at least one assertion' findings, each evaluated individually: - **5 real-but-implicit**: tests in S3MediaFallbackMiddlewareTests, BookArtifactPurgerTests, QuarantineMirrorTests, StagingMirrorTests (x2) rely on `MockBehavior.Strict` as the assertion (an unexpected store call throws). Legitimate idiom, but implicit: a reader (and sonar) can't see what the test guarantees, and if someone later relaxes the mock to Loose the test silently asserts nothing. Fix: add `store.VerifyNoOtherCalls()` — an explicit, sonar-visible assertion of exactly the same contract. - **1 false positive by design** (marked in SonarQube with comment): EnglishSourceDumpTool's env-gated [Fact] is a documented one-off translator-authoring tool, not a regression test — nothing to assert. Test-only change, zero production surface.
spikerj commented 2026-07-17 05:23:13 +00:00
Author
Owner
Copy Link
Copy Source

Resolved in spikersoft-backend PR #343 (merged to master). The five strict-mock tests now assert their never-called contract explicitly via VerifyNoOtherCalls(); the sixth S2699 finding (EnglishSourceDumpTool) was false-positived in SonarQube with reasoning — it is a documented env-gated authoring tool with nothing to assert. All three touched test projects pass. Closing.

Resolved in spikersoft-backend PR #343 (merged to master). The five strict-mock tests now assert their never-called contract explicitly via VerifyNoOtherCalls(); the sixth S2699 finding (EnglishSourceDumpTool) was false-positived in SonarQube with reasoning — it is a documented env-gated authoring tool with nothing to assert. All three touched test projects pass. Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agentic
Actionable surfaced by the agentic architecture & security review
 bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 sonarqube
Code quality issue surfaced by SonarQube (bug / code smell)
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
spikerj (Joseph Spiker)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#636