F-048 (P7) — Scan-resilience defects (F-024 batch abort, F-025 transient finding loss) without regression test #19
Description
Severity: 🟠 · Criterion: K8 (Tests) · Phase: P7 · Status (review): 🆕
File(s): src/Tests/DockerUpdateGuard.Tests/ImageScanOrchestratorTests.cs; src/Tests/DockerUpdateGuard.Tests/RuntimeContainerScanOrchestratorTests.cs
Finding
The orchestrator suites are overall strong and cover the
per-container resilience exemplarily (…ContinuesAfterContainerProcessingFailureAsync:
one broken container → Partial, the rest run on). What remains uncovered, however, is
exactly the two resilience defects found in P3: (a)
F-024
— an exception outside the inner try (e.g. SingleAsync on an image deleted between
listing and scan, or a DB error on the initial ScanRun save)
aborts all subsequent items in ScanAllAsync/ScanInstanceAsync; all
batch tests, however, use only one instance or skip the pre-try throw. (b)
F-025
— no test seeds active findings and then makes discovery/registry
fail, to check whether existing alerts survive the transient error
(per F-025 they do not).
Impact
Two defects with user impact (starving subsequent items;
flickering "update available" alerts) can regress unnoticed or remain
unverified on a fix — exactly on the paths the review marked as 🟠.
Recommendation
(1) A multi-instance/multi-item batch test in which the first item throws in the
pre-try region, and verification that the remaining items are scanned nonetheless. (2) A test with
pre-existing active findings + a failing discovery that proves
active findings are deleted/deactivated only after a successful re-evaluation.
Auto-generated from the repository code review. Source of truth: docs/review/findings.md → F-048 (P7), branch review/review-analysis-plan.
Activity
LarsLaskowski commentedon Oct 31, 2026
Squad working record
Tier
trivial, no security area. F-024 and F-025 are already fixed onmain(#129, #134); this change only adds the missing regression tests (PR #386). Related defects found on the way: #384, #385.plan.md
Full plan at the last commit that contains it: https://github.com/LarsLaskowski/DockerUpdateGuard/blob/64a2426/specs/issue-19/plan.md
Summary: three tests (AC1 image batch continues after a pre-
tryfailure of the first item, AC2 the same for the runtime batch, AC3 the derived .NET finding survives a failing release feed) plus aFailOnSaveAttemptoption on theSaveChangesFailingDbContexttest double. AC4: each test was shown to fail when its guard is removed.log.md
Squad run metrics
Generated by Claude Code