Skip to content

Testing on Datasource changes #301

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Nov 12, 2024
Merged

Testing on Datasource changes #301

merged 7 commits into from
Nov 12, 2024

Conversation

ljstella
Copy link
Contributor

@ljstella ljstella commented Oct 7, 2024

When we calculate changes between two branches in order to run tests, we currently do not catch data source object changes as content dependencies. Following the same path in which we calculate macros and lookups as being content dependencies, this PR will attempt to change the diff calculation to include data source object changes.

Notably, this will then trigger the testing for each of these detections when we have an "Auto Update TA" PR like so: splunk/security_content#3154. (See Note at end)

This testing will provide the confidence and verification that such changes can be merged without issues.

Note:
Those PRs currently don't update contentctl.yml, which appears to still be used for testing, so until we decide how to reconcile those here, or update the code powering those PRs to also make those changes, this will trigger tests but still using the old TAs. We also don't really have any testing afaict to confirm that the TA version change does not alter sourcetypes or fields- those will hopefully become apparent via the actual testing, but that's not necessarily guaranteed depending on the original GDI mechanism

@ljstella ljstella self-assigned this Oct 7, 2024
@ljstella
Copy link
Contributor Author

ljstella commented Nov 6, 2024

Update: splunk/security_content#3197 should handle updates to contentctl.yml which gives us a path forward here.

@ljstella ljstella marked this pull request as ready for review November 6, 2024 19:59
@ljstella ljstella requested a review from pyth0n1c November 6, 2024 22:47
pyth0n1c
pyth0n1c previously approved these changes Nov 12, 2024
Copy link
Contributor

@pyth0n1c pyth0n1c left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested these changes locally with a number of changes to detections and data_sources. It looks like it picks up those changes correctly, this looks good to me!

Copy link
Contributor

@pyth0n1c pyth0n1c left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved again. I asked the owner to update the version in prep for a contentctl release and it has been done.

@pyth0n1c pyth0n1c merged commit b8b5c2d into main Nov 12, 2024
18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants