Use branch pinned policy refs in some acceptance tests

[simonbaird]

There are two related changes:

• Pin something (by branch) that was previous referencing main branch. This fixes a failure we're experiencing right now due to the new image_referrers built in rego function added recently.
• Pin some other policy refs by branch that were previously referencing a quite old git sha. My reasoning is, let's be consistent, and let's use the "stable" branch, since it was effectively created for this purpose.

In reality the branch is not likely to change ever, so it's just about as stable as the git sha. There are arguments for and against the second change, but I think the consistency and the clearer expression of intent is makes the change worthwhile.

Note we should do something similar in main branch, but let's consider that later.

Ref: https://redhat.atlassian.net/browse/EC-1720

Also includes a golang module upgrade which I think is needed to get the EC check green.

Ref: https://redhat.atlassian.net/browse/EC-1721

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4aaaf745-3bd3-4624-96e8-f5230fbf6d03

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[qodo-code-review]

ⓘ You are approaching your monthly quota for Qodo. Upgrade your plan

Review Summary by Qodo

Pin acceptance test policies to release-v0.8 branch

🐞 Bug fix 🧪 Tests

Walkthroughs

Description

• Pin policy references to release-v0.8 branch instead of old git SHAs
• Fix failing tests due to incompatible ec.oci.image_referrers function
• Replace unpinned main branch references with stable branch pinning
• Ensure consistency across acceptance test policy configurations

Diagram

flowchart LR
  oldSHA["Old git SHA refs<br/>or main branch"]
  newBranch["release-v0.8<br/>branch refs"]
  tests["Acceptance tests<br/>fixed"]
  oldSHA -- "replaced with" --> newBranch
  newBranch -- "stabilizes" --> tests

Loading

File Changes

1. features/ta_task_validate_image.feature 🧪 Tests +4/-4

Pin TA task test policies to release-v0.8

• Updated policy references from old git SHA d34eab36b23d43748e451004177ca144296bf323 to
 release-v0.8 branch
• Changed 3 policy configuration instances in test scenarios
• Affects both inline policy definitions and POLICY_CONFIGURATION parameters

features/ta_task_validate_image.feature

---

2. features/task_validate_image.feature 🧪 Tests +16/-16

Pin EC task test policies to release-v0.8

• Updated policy references from old git SHA 0de5461c14413484575e63e96ddb514d8ab954b5 to
 release-v0.8 branch
• Added explicit ?ref=release-v0.8 to previously unpinned main branch references
• Changed 9 policy configuration instances across multiple test scenarios
• Ensures consistent pinning strategy across all EC task validation tests

features/task_validate_image.feature

---

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 📐 Spec deviations (0)

1. Branch ref makes tests flaky 🐞 Bug ⛯ Reliability

Description

Using ref=release-v0.8 instead of an immutable commit makes the pinned SHA (and thus snapshot
outputs) change whenever the branch head changes, introducing time-dependent acceptance test
failures. This is caused by runtime URL pinning to the fetched commit SHA and snapshot assertions
over the resulting output.

Code

features/ta_task_validate_image.feature[R28-29]

+              "git::github.com/conforma/policy//policy/release?ref=release-v0.8",
+              "git::github.com/conforma/policy//policy/lib?ref=release-v0.8"

Evidence

The docs describe git refs as optional and therefore potentially pointing to a moving default
branch. In this repo, policy download pins URLs to the specific commit that was fetched. If the
configured ref points at a branch, that pinned commit can change over time, and snapshot-based
tests will start failing even without code changes.

docs/modules/ROOT/pages/configuration.adoc[748-773]
internal/policy/source/source.go[168-196]
features/task_validate_image.feature[10-40]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Acceptance tests now use a branch ref (`release-v0.8`) for policy sources. Because the code pins to the fetched commit SHA and snapshots include those pinned URLs, any future movement of the branch will cause snapshot diffs and flaky failures.

## Issue Context
`PolicyUrl.GetPolicy()` rewrites the URL using `metadata.GetPinnedURL()` after download, so outputs contain a specific commit SHA derived from whatever `ref` resolved to at test time.

## Fix Focus Areas
- If long-term determinism is required: pin to an immutable tag/commit SHA in feature files.
- If branch pinning is intentional: update snapshot matching to scrub/parameterize pinned SHAs.

### Files/lines
- features/task_validate_image.feature[10-120]
- features/ta_task_validate_image.feature[21-40]
- internal/policy/source/source.go[168-196]
- acceptance/snaps/snaps.go[98-172]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

ⓘ The new review experience is currently in Beta. Learn more

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.86% <ø> (ø)
generative	18.14% <ø> (ø)
integration	26.99% <ø> (ø)
unit	68.66% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.