feat(wfctl): plugin audit skips IaC interfaces in strict-contracts coverage (Task 19)#607
Merged
Merged
Conversation
…verage check Task 19 of the strict-contracts force-cutover plan (docs/plans/2026-05-10-strict-contracts-force-cutover.md, rev5). Adds filterOutIaCServiceMethods + isIaCServiceMethod helpers in cmd/wfctl/plugin_audit.go. The advertisedPluginContracts pipeline now drops every IaCProvider.* and ResourceDriver.* entry (plus the typed-proto package-qualified equivalents under workflow.plugin.external.iac.*) BEFORE the strict-contracts coverage check fires. Per Task 19: those interfaces are now compile-time enforced via Go interface satisfaction in sdk.RegisterAllIaCProviderServices; the manifest-side strict- contract advertisement is redundant for IaC, so the audit MUST NOT flag missing descriptors for them. Module / Step / Trigger / non-IaC service methods (SecurityScanner, ad-hoc plugin services) remain subject to the coverage requirement so the 14-plugin Module/Step/Trigger migration tracker is unaffected. Tests (cmd/wfctl/plugin_audit_iac_test.go) cover three cases — all pass: - IaCServiceMethodsAreNotRequired: a manifest listing IaC serviceMethods produces NO missing_service_method_contract_ descriptor finding under StrictContracts:true; ServiceMethods. Total=0 after filtering. - NonIaCServiceMethodsStillRequire: a mixed manifest (IaC + SecurityScanner/Scan) flags ONLY SecurityScanner/Scan; ServiceMethods.Total=1 (IaC filtered, non-IaC kept). - IsIaCServiceMethod_Cases: exhaustive matcher coverage — IaCProvider.*, ResourceDriver.*, and typed-proto package- qualified shapes match true; SecurityScanner/Scan, StrictService/Call, PluginService/GetManifest match false. Verification: GOWORK=off go test -race ./cmd/wfctl/... PASS; GOWORK=off go vet ./cmd/wfctl/ clean; gofmt -d clean. Rollback: revert this commit; audit returns to flagging every advertised IaC service method as missing a strict-contract descriptor (which is the pre-cutover behavior — not strictly broken, just redundant after Task 4 ships).
Contributor
There was a problem hiding this comment.
Pull request overview
Updates wfctl’s plugin audit strict-contracts coverage logic to exclude IaC interface service methods (now enforced at compile time), so the audit no longer reports missing strict-contract descriptors for IaCProvider.* / ResourceDriver.* while still enforcing coverage for non-IaC plugin services.
Changes:
- Filters advertised
serviceMethodsto drop IaC-related entries before strict-contract coverage checks. - Adds narrow IaC method classifier (
isIaCServiceMethod) to support both legacyIaCProvider.*/ResourceDriver.*and package-qualified typed-proto names. - Adds focused unit tests validating IaC is excluded and non-IaC service methods remain enforced.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| cmd/wfctl/plugin_audit.go | Filters advertised service methods to exclude IaC interfaces from strict-contracts coverage and adds helper classifiers. |
| cmd/wfctl/plugin_audit_iac_test.go | Adds tests ensuring IaC service methods are ignored while non-IaC service methods still require descriptors under strict-contracts. |
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Task 19 of the strict-contracts force-cutover plan (docs/plans/2026-05-10-strict-contracts-force-cutover.md, rev5).
Adds
filterOutIaCServiceMethods+isIaCServiceMethodhelpers incmd/wfctl/plugin_audit.go. TheadvertisedPluginContractspipeline now drops everyIaCProvider.*andResourceDriver.*entry (plus the typed-proto package-qualified equivalents underworkflow.plugin.external.iac.*) before the strict-contracts coverage check fires.Per Task 19: those interfaces are now compile-time enforced via Go interface satisfaction in
sdk.RegisterAllIaCProviderServices(Task 4); the manifest-side strict-contract advertisement is redundant for IaC. Module / Step / Trigger / non-IaC service methods (SecurityScanner, ad-hoc plugin services) remain subject to the coverage requirement so the 14-plugin Module/Step/Trigger migration tracker is unaffected.Independent of the PR 2 stack — this PR modifies pre-existing audit code that doesn't depend on
iac.protoor the new SDK helpers. Base ismain.Tests (
cmd/wfctl/plugin_audit_iac_test.go) — 3 cases, all PASSIaCServiceMethodsAreNotRequired— manifest listingIaCProvider.*+ResourceDriver.*produces NOmissing_service_method_contract_descriptorfinding underStrictContracts:true;ServiceMethods.Total=0after filteringNonIaCServiceMethodsStillRequire— mixed manifest (IaC +SecurityScanner/Scan) flags ONLYSecurityScanner/Scan;ServiceMethods.Total=1IsIaCServiceMethod_Cases— exhaustive matcher coverage including the typed-proto package-qualified shape (workflow.plugin.external.iac.IaCProviderEnumerator/EnumerateAll)Verification
GOWORK=off go test -race ./cmd/wfctl/...→ PASSGOWORK=off go vet ./cmd/wfctl/→ cleangofmt -d→ clean (pre-commit hook auto-formatted before commit)Rollback
Revert this commit; audit returns to flagging every advertised IaC service method as missing a strict-contract descriptor (which is the pre-cutover behavior — redundant after Task 4 ships, but not strictly broken).
Test plan
TestAuditPluginStrictContracts_IaCServiceMethodsAreNotRequiredpassesTestAuditPluginStrictContracts_NonIaCServiceMethodsStillRequirepasses (filter narrowness verified)TestIsIaCServiceMethod_Casesexhaustive matcher🤖 Generated with Claude Code