Merge branch 'main' of https://git.stella-ops.org/stella-ops.org/git.stella-ops.org

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/ActionablesEndpointsTests.cs

@@ -128,6 +128,7 @@ public sealed class ActionablesEndpointsTests
         using var factory = new ScannerApplicationFactory();
         using var client = factory.CreateClient();
 
+using StellaOps.TestKit;
         var response = await client.GetAsync("/api/v1/actionables/delta/delta-12345678");
         var result = await response.Content.ReadFromJsonAsync<ActionablesResponseDto>(SerializerOptions);
 

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/AuthorizationTests.cs

@@ -21,6 +21,7 @@ public sealed class AuthorizationTests
         });
 
         using var client = factory.CreateClient();
+using StellaOps.TestKit;
         var response = await client.GetAsync("/api/v1/__auth-probe");
 
         Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/BaselineEndpointsTests.cs

@@ -112,6 +112,7 @@ public sealed class BaselineEndpointsTests
         using var factory = new ScannerApplicationFactory();
         using var client = factory.CreateClient();
 
+using StellaOps.TestKit;
         var response = await client.GetAsync("/api/v1/baselines/recommendations/sha256:artifact123");
         var result = await response.Content.ReadFromJsonAsync<BaselineRecommendationsResponseDto>(SerializerOptions);
 

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/CallGraphEndpointsTests.cs

@@ -63,6 +63,7 @@ public sealed class CallGraphEndpointsTests
         {
             Content = JsonContent.Create(request)
         };
+using StellaOps.TestKit;
         secondRequest.Headers.TryAddWithoutValidation("Content-Digest", "sha256:deadbeef");
 
         var second = await client.SendAsync(secondRequest);

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/CounterfactualEndpointsTests.cs

@@ -205,6 +205,7 @@ public sealed class CounterfactualEndpointsTests
         using var factory = new ScannerApplicationFactory();
         using var client = factory.CreateClient();
 
+using StellaOps.TestKit;
         var request = new CounterfactualRequestDto
         {
             FindingId = "finding-123",

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/DeltaCompareEndpointsTests.cs

@@ -130,6 +130,7 @@ public sealed class DeltaCompareEndpointsTests
         using var factory = new ScannerApplicationFactory();
         using var client = factory.CreateClient();
 
+using StellaOps.TestKit;
         var request = new DeltaCompareRequestDto
         {
             BaseDigest = "sha256:base123",

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/EvidenceCompositionServiceTests.cs

@@ -112,6 +112,7 @@ public sealed class EvidenceEndpointsTests
         });
         using var client = factory.CreateClient();
 
+using StellaOps.TestKit;
         var response = await client.GetAsync("/api/v1/scans/nonexistent-scan/evidence");
 
         // Current behavior: returns empty list (200 OK) for non-existent scans

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/FindingsEvidenceControllerTests.cs

@@ -123,6 +123,7 @@ public sealed class FindingsEvidenceControllerTests
     private static async Task<Guid> SeedFindingAsync(ScannerApplicationFactory factory)
     {
         using var scope = factory.Services.CreateScope();
+using StellaOps.TestKit;
         var db = scope.ServiceProvider.GetRequiredService<TriageDbContext>();
 
         await db.Database.MigrateAsync();

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/HealthEndpointsTests.cs

@@ -13,6 +13,7 @@ public sealed class HealthEndpointsTests
         using var factory = new ScannerApplicationFactory();
         using var client = factory.CreateClient();
 
+using StellaOps.TestKit;
         var healthResponse = await client.GetAsync("/healthz");
         Assert.True(healthResponse.IsSuccessStatusCode, $"Expected 200 from /healthz, received {(int)healthResponse.StatusCode}.");
 

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/IdempotencyMiddlewareTests.cs

@@ -128,6 +128,7 @@ public sealed class IdempotencyMiddlewareTests
         await using var factory = CreateFactory();
         using var client = factory.CreateClient();
 
+using StellaOps.TestKit;
         var content = new StringContent("""{"test":"nodigest"}""", Encoding.UTF8, "application/json");
         // Not adding Content-Digest header - middleware should compute it
 

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/ManifestEndpointsTests.cs

@@ -420,6 +420,7 @@ public sealed class ManifestEndpointsTests
         // Arrange
         await using var factory = new ScannerApplicationFactory();
         using var client = factory.CreateClient();
+using StellaOps.TestKit;
         var scanId = Guid.NewGuid();
 
         // Act - Trailing slash with empty root hash

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/OfflineKitEndpointsTests.cs

@@ -239,6 +239,7 @@ public sealed class OfflineKitEndpointsTests
     private static (string KeyId, string PublicKeyPem, string DsseJson) CreateSignedDsse(byte[] bundleBytes)
     {
         using var rsa = RSA.Create(2048);
+using StellaOps.TestKit;
         var publicKeyDer = rsa.ExportSubjectPublicKeyInfo();
         var fingerprint = ComputeSha256Hex(publicKeyDer);
 

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/PlatformEventPublisherRegistrationTests.cs

@@ -55,6 +55,7 @@ public sealed class PlatformEventPublisherRegistrationTests
             });
             using var scope = factory.Services.CreateScope();
 
+using StellaOps.TestKit;
             var options = scope.ServiceProvider.GetRequiredService<IOptions<ScannerWebServiceOptions>>().Value;
             Assert.True(options.Events.Enabled);
             Assert.Equal("redis", options.Events.Driver);

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/PolicyEndpointsTests.cs

@@ -64,6 +64,7 @@ public sealed class PolicyEndpointsTests
         using var factory = new ScannerApplicationFactory();
         using var client = factory.CreateClient();
 
+using StellaOps.TestKit;
         const string policyYaml = """
 version: "1.0"
 rules:

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/ProofSpineEndpointsTests.cs

@@ -179,6 +179,7 @@ public sealed class ProofSpineEndpointsTests
         await using var factory = new ScannerApplicationFactory();
         using var scope = factory.Services.CreateScope();
 
+using StellaOps.TestKit;
         var builder = scope.ServiceProvider.GetRequiredService<ProofSpineBuilder>();
         var repository = scope.ServiceProvider.GetRequiredService<IProofSpineRepository>();
 

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/RateLimitingTests.cs

@@ -175,6 +175,7 @@ public sealed class RateLimitingTests
         // Arrange
         await using var factory = CreateFactory();
         using var client = factory.CreateClient();
+using StellaOps.TestKit;
         var scanId = Guid.NewGuid();
 
         // Act - Requests from "anonymous" tenant

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/ReachabilityDriftEndpointsTests.cs

@@ -87,6 +87,7 @@ public sealed class ReachabilityDriftEndpointsTests
     private static async Task SeedCallGraphSnapshotsAsync(IServiceProvider services, string baseScanId, string headScanId)
     {
         using var scope = services.CreateScope();
+using StellaOps.TestKit;
         var repo = scope.ServiceProvider.GetRequiredService<ICallGraphSnapshotRepository>();
 
         var baseSnapshot = CreateSnapshot(

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/ReportSamplesTests.cs

@@ -26,6 +26,7 @@ public sealed class ReportSamplesTests
         var path = Path.Combine(repoRoot, "samples", "api", "reports", "report-sample.dsse.json");
         Assert.True(File.Exists(path), $"Sample file not found at {path}.");
         await using var stream = File.OpenRead(path);
+using StellaOps.TestKit;
         var response = await JsonSerializer.DeserializeAsync<ReportResponseDto>(stream, SerializerOptions);
         Assert.NotNull(response);
         Assert.NotNull(response!.Report);

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/ReportsEndpointsTests.cs

@@ -186,6 +186,7 @@ rules:
 
         using var client = factory.CreateClient();
 
+using StellaOps.TestKit;
         var request = new ReportRequestDto
         {
             ImageDigest = "sha256:cafebabe",

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/RubyPackagesEndpointsTests.cs

@@ -270,6 +270,7 @@ public sealed class RubyPackagesEndpointsTests
         }
 
         using var client = factory.CreateClient();
+using StellaOps.TestKit;
         var encodedDigest = Uri.EscapeDataString(digest);
         var response = await client.GetAsync($"/api/v1/scans/{encodedDigest}/entrytrace");
         Assert.Equal(HttpStatusCode.OK, response.StatusCode);

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/RuntimeEndpointsTests.cs

@@ -301,6 +301,7 @@ rules: []
         using var factory = new ScannerApplicationFactory();
         using var client = factory.CreateClient();
 
+using StellaOps.TestKit;
         var request = new RuntimePolicyRequestDto
         {
             Images = Array.Empty<string>()

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/RuntimeReconciliationTests.cs

@@ -597,6 +597,7 @@ public sealed class RuntimeReconciliationTests
         public Task PutAsync(ArtifactObjectDescriptor descriptor, Stream content, CancellationToken cancellationToken)
         {
             using var ms = new MemoryStream();
+using StellaOps.TestKit;
             content.CopyTo(ms);
             _store[$"{descriptor.Bucket}/{descriptor.Key}"] = ms.ToArray();
             return Task.CompletedTask;

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/SbomEndpointsTests.cs

@@ -85,6 +85,7 @@ public sealed class SbomEndpointsTests
             ArgumentNullException.ThrowIfNull(content);
 
             using var buffer = new MemoryStream();
+using StellaOps.TestKit;
             await content.CopyToAsync(buffer, cancellationToken).ConfigureAwait(false);
 
             var key = $"{descriptor.Bucket}:{descriptor.Key}";

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/SbomUploadEndpointsTests.cs

@@ -143,6 +143,7 @@ public sealed class SbomUploadEndpointsTests
             ArgumentNullException.ThrowIfNull(content);
 
             using var buffer = new MemoryStream();
+using StellaOps.TestKit;
             await content.CopyToAsync(buffer, cancellationToken).ConfigureAwait(false);
 
             var key = $"{descriptor.Bucket}:{descriptor.Key}";

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/ScannerSurfaceSecretConfiguratorTests.cs

@@ -143,6 +143,7 @@ public sealed class ScannerSurfaceSecretConfiguratorTests
         """;
 
         using var handle = SurfaceSecretHandle.FromBytes(Encoding.UTF8.GetBytes(json));
+using StellaOps.TestKit;
         var secretProvider = new StubSecretProvider(new Dictionary<string, SurfaceSecretHandle>(StringComparer.OrdinalIgnoreCase)
         {
             ["registry"] = handle

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/ScansEndpointsTests.Entropy.cs

@@ -24,6 +24,7 @@ public sealed partial class ScansEndpointsTests
 
         using var client = factory.CreateClient();
 
+using StellaOps.TestKit;
         var submitResponse = await client.PostAsJsonAsync("/api/v1/scans", new
         {
             image = new { digest = "sha256:image-demo" }

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/ScansEndpointsTests.RecordMode.cs

@@ -100,6 +100,7 @@ public sealed partial class ScansEndpointsTests
         public Task PutAsync(ArtifactObjectDescriptor descriptor, Stream content, CancellationToken cancellationToken)
         {
             using var buffer = new MemoryStream();
+using StellaOps.TestKit;
             content.CopyTo(buffer);
             Objects[descriptor.Key] = buffer.ToArray();
             return Task.CompletedTask;

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/ScansEndpointsTests.Replay.cs

@@ -38,6 +38,7 @@ public sealed partial class ScansEndpointsTests
         var scanId = submitPayload!.ScanId;
 
         using var scope = factory.Services.CreateScope();
+using StellaOps.TestKit;
         var coordinator = scope.ServiceProvider.GetRequiredService<IScanCoordinator>();
         var recordMode = scope.ServiceProvider.GetRequiredService<IRecordModeService>();
         var timeProvider = scope.ServiceProvider.GetRequiredService<TimeProvider>();

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/ScansEndpointsTests.cs

@@ -182,6 +182,7 @@ public sealed partial class ScansEndpointsTests
         });
 
         using var client = factory.CreateClient();
+using StellaOps.TestKit;
         var response = await client.GetAsync("/api/v1/scans/scan-missing/entrytrace");
         Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
     }

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/SliceEndpointsTests.cs

@@ -477,6 +477,7 @@ public sealed class SliceCacheTests
         // Arrange
         var options = Microsoft.Extensions.Options.Options.Create(new SliceCacheOptions { Enabled = false });
         using var cache = new SliceCache(options);
+using StellaOps.TestKit;
         var cacheResult = CreateTestCacheResult();
 
         // Act

src/Scanner/__Tests/StellaOps.Scanner.WebService.Tests/TriageStatusEndpointsTests.cs

@@ -189,6 +189,7 @@ public sealed class TriageStatusEndpointsTests
         using var factory = new ScannerApplicationFactory();
         using var client = factory.CreateClient();
 
+using StellaOps.TestKit;
         var request = new BulkTriageQueryRequestDto
         {
             Limit = 10