feat: test and sample unification (#640)

BREAKING CHANGE: requirement tests moved to KO tests

Co-authored-by: kkania-splunk <[email protected]>

Author: uoboda-splunk

.github/workflows/build-test-release.yml

@@ -8,7 +8,8 @@ on:
     tags:
       - "v[0-9]+.[0-9]+.[0-9]+"
   pull_request:
-    branches: [main, develop]
+    branches:
+      - "**"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
@@ -191,14 +192,15 @@ jobs:
       - fossa-scan
       - compliance-copyrights
       - test-splunk-doc
-      - test-splunk-unit
+#      - test-splunk-unit
       - review_secrets
       - review-dog-misspell
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        splunk-version: [8.1, 8.2]
+        splunk-version: [8.2]
+#        splunk-version: [8.1, 8.2]
         test-marker: [
           "splunk_connection_docker",
           "splunk_app_fiction",
@@ -208,10 +210,11 @@ jobs:
           "splunk_fiction_indextime",
           "splunk_fiction_indextime_broken",
           "splunk_setup_fixture",
-          "splunk_app_requirements",
-          "splunk_app_requirements_modinput",
-          "splunk_app_requirements_uf",
-          "splunk_app_requirements_scripted"
+#          "splunk_app_requirements",
+#          "splunk_app_requirements_modinput",
+#          "splunk_app_requirements_uf",
+#          "splunk_app_requirements_scripted",
+          "splunk_app_req"
         ]
     steps:
       - uses: actions/checkout@v3

.gitignore

@@ -30,4 +30,5 @@ docs/_build/
 !deps/build
 .vscode
 test_report.md
-.idea/
+.idea/
+.python-version

.licenserc.yaml

@@ -31,6 +31,7 @@ header:
     - "tests/**"
     - ".*"
     - "pytest_splunk_addon/standard_lib/**/*.json"
+    - "pytest_splunk_addon/standard_lib/**/*.xsd"
     - "MANIFEST.in"
     - "entrypoint.sh"
     - "pytest_splunk_addon/.ignore_splunk_internal_errors"

Dockerfile.uf

@@ -13,10 +13,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-ARG SPLUNK_VERSION=latest
-FROM splunk/universalforwarder:$SPLUNK_VERSION
-ARG SPLUNK_VERSION=latest
+ARG SPLUNK_VERSION=8.2.6
+FROM splunk/universalforwarder:8.2.6
+ARG SPLUNK_VERSION=8.2.6
 ARG SPLUNK_APP_ID=TA_UNKNOWN
 ARG SPLUNK_APP_PACKAGE=package
 RUN echo ${SPLUNK_VERSION} $SPLUNK_APP_PACKAGE
-COPY ${SPLUNK_APP_PACKAGE} /opt/splunkforwarder/etc/apps/${SPLUNK_APP_ID}
+COPY ${SPLUNK_APP_PACKAGE} /opt/splunkforwarder/etc/apps/${SPLUNK_APP_ID}

poetry.lock

@@ -46,6 +46,8 @@ junitparser = "^2.2.0"
 addonfactory-splunk-conf-parser-lib = "^0.3.3"
 defusedxml = "^0.7.1"
 Faker = "^13.12.0"
+xmltodict = "^0.13.0"
+xmlschema = "^1.11.3"
 
 [tool.poetry.extras]
 docker = ['lovely-pytest-docker']

pyproject.toml

@@ -27,7 +27,6 @@
 
 
 def pytest_configure(config):
-    global test_generator
     """
     Setup configuration after command-line options are parsed
     """
@@ -78,8 +77,6 @@ def pytest_configure(config):
         "markers",
         "splunk_searchtime_requirements: Test an requirement test only  is mapped with only one data models",
     )
-    if config.getoption("splunk_app", None):
-        test_generator = AppTestGenerator(config)
 
     cim_report = config.getoption("cim_report")
     if cim_report and not hasattr(config, "slaveinput"):
@@ -96,7 +93,7 @@ def pytest_unconfigure(config):
 
 
 def pytest_sessionstart(session):
-
+    global test_generator
     SampleXdistGenerator.event_path = session.config.getoption("event_path")
     SampleXdistGenerator.event_stored = False
     SampleXdistGenerator.tokenized_event_source = session.config.getoption(
@@ -114,6 +111,8 @@ def pytest_sessionstart(session):
         store_events = session.config.getoption("store_events")
         sample_generator = SampleXdistGenerator(app_path, config_path)
         sample_generator.get_samples(store_events)
+    if session.config.getoption("splunk_app", None):
+        test_generator = AppTestGenerator(session.config)
 
 
 def pytest_generate_tests(metafunc):

pytest_splunk_addon/plugin.py

@@ -23,6 +23,8 @@
 import logging
 import os
 import shutil
+from collections import defaultdict
+from itertools import chain
 from time import sleep
 import json
 import pytest
@@ -800,6 +802,60 @@ def file_system_prerequisite():
         os.mkdir(monitor_dir)
 
 
+@pytest.fixture(scope="session")
+def splunk_dm_recommended_fields(splunk_search_util):
+    """
+    Returns function which gets recommended fields from Splunk for given datamodel
+
+    Note that data is being dynamically retrieved from Splunk. When CIM add-on version changes
+    retrieved data may differ
+
+    Args:
+        splunk_search_util: Other fixture preparing connection to Splunk Search.
+
+    """
+    recommended_fields = defaultdict(list)
+
+    def _find(name, dictionary):
+        for key, value in dictionary.items():
+            if key == name:
+                yield value
+            elif isinstance(value, dict):
+                yield from _find(name, value)
+            elif isinstance(value, list):
+                for element in value:
+                    if isinstance(element, dict):
+                        yield from _find(name, element)
+
+    def update_recommended_fields(model, datasets):
+        model_key = f"{model}:{':'.join(datasets)}".strip(":")
+        if model_key not in recommended_fields:
+            for cim_model in splunk_search_util.getFieldValuesList(
+                f'| rest /servicesNS/-/-/data/models/{model} | fields "eai:data"'
+            ):
+                model_definition = json.loads(cim_model["eai:data"])
+                for object in model_definition["objects"]:
+                    object_name = object["objectName"]
+                    if (
+                        object["parentName"] == "BaseEvent"
+                        or object_name in datasets
+                        or object_name == model
+                    ):
+                        for fields in chain(
+                            _find("fields", object), _find("outputFields", object)
+                        ):
+                            for field in fields:
+                                recommended = field["comment"].get("recommended")
+                                if recommended:
+                                    recommended_fields[model_key].append(
+                                        field["fieldName"]
+                                    )
+
+        return recommended_fields
+
+    return update_recommended_fields
+
+
 def is_responsive_uf(uf):
     """
     Verify if the management port of Universal Forwarder is responsive or not

pytest_splunk_addon/splunk.py

@@ -34,3 +34,4 @@
 
 from .app_test_generator import AppTestGenerator
 from .addon_basic import Basic
+from .utilities import escape_char_event