test(threat-network): repair time-sensitive CI coverage (#149)

Author: MahdiHedhli

.github/workflows/trusted-repository-sanitation.yml

@@ -38,5 +38,10 @@ jobs:
           VEDETTA_BASE_REF: ${{ github.event.pull_request.base.ref }}
           VEDETTA_BASE_SHA: ${{ github.event.pull_request.base.sha }}
           VEDETTA_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          VEDETTA_MERGE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
+          # GitHub may leave merge_commit_sha empty for a newly opened PR even
+          # when refs/pull/N/merge already exists. The trusted runner fetches
+          # and verifies that merge ref against the pinned base/head itself;
+          # the head SHA here is therefore a non-empty, validated fallback for
+          # its required event-shape input, not a substitute merge tree.
+          VEDETTA_MERGE_SHA: ${{ github.event.pull_request.merge_commit_sha || github.event.pull_request.head.sha }}
         run: bash scripts/run-trusted-pr-sanitation.sh

scripts/tests/trusted-pr-sanitation-test.sh

@@ -411,7 +411,7 @@ ok grep -Fq 'run: bash scripts/run-trusted-pr-sanitation.sh' "$WORKFLOW" "truste
 # alternate YAML spellings such as quoted keys, flow mappings, anchors, and
 # aliases that text-only step counts cannot interpret safely.
 is "$(file_sha256 "$WORKFLOW")" \
-    "2d54052e13e715e6353ca9cee405a41e88c6b4f5dbe94e69ff4558a806953f44" \
+    "dfffa7eaacf6ebf20b00d34b07868bf12a32d1768923762c237eab8ed5f2ce40" \
     "trusted workflow matches the exact reviewed definition"
 ok workflow_has_no_writable_permissions "$WORKFLOW" "trusted workflow grants no writable permission"
 is "$(grep -Ec '^[[:space:]]*(-[[:space:]]*)?uses:' "$WORKFLOW")" \

threat-network/internal/api/api_test.go

@@ -237,13 +237,22 @@ func signAndPost(t *testing.T, ts *httptest.Server, id, key, nonce string, body
 }
 
 func batchBody(batchID string) []byte {
+	// Consensus intentionally considers only a trailing window. Keep this fixture
+	// inside that window instead of pinning it to the date the test was written.
+	bucket := time.Now().UTC().Truncate(time.Hour)
+	generatedAt := bucket.Add(15 * time.Minute)
 	return []byte(fmt.Sprintf(`{
-      "schema_version":1,"batch_id":%q,"generated_at":"2026-07-03T14:15:02Z",
-      "window_start":"2026-07-03T14:00:00Z","window_end":"2026-07-03T15:00:00Z","signals":[
-        {"signal_id":"s1","kind":"known_bad_domain_hit","time_bucket":"2026-07-03T14:00:00Z",
+      "schema_version":1,"batch_id":%q,"generated_at":%q,
+      "window_start":%q,"window_end":%q,"signals":[
+        {"signal_id":"s1","kind":"known_bad_domain_hit","time_bucket":%q,
          "domain":"c2.badzone.example","etld_plus_one":"badzone.example","local_confidence":0.99,
          "local_reasons":["known_bad"],"observation_count":4,"distinct_asset_count":2,"blocked_count":4}
-      ]}`, batchID))
+      ]}`,
+		batchID,
+		generatedAt.Format(time.RFC3339),
+		bucket.Format(time.RFC3339),
+		bucket.Add(time.Hour).Format(time.RFC3339),
+		bucket.Format(time.RFC3339)))
 }
 
 func TestEndToEndRegisterIngestConsensusFeed(t *testing.T) {

threat-network/internal/store/corpus_publication_invariants_test.go

@@ -61,7 +61,7 @@ func TestCorpusPublishRejectsStoredCrossProfilePredecessor(t *testing.T) {
 		t.Fatal(err)
 	}
 	baseVariantID := base.Variants[0].VariantID
-	base, err = db.PublishCorpusProfile(context.Background(), base.ProfileID, corpusPublishRequest(0),
+	_, err = db.PublishCorpusProfile(context.Background(), base.ProfileID, corpusPublishRequest(0),
 		CorpusMutation{ExpectedETag: base.ETag})
 	if err != nil {
 		t.Fatal(err)

threat-network/internal/store/corpus_rows_resource_test.go

@@ -78,7 +78,7 @@ func TestCorpusReadErrorsReleaseSingleConnection(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		profile, err = db.PublishCorpusProfile(context.Background(), profile.ProfileID, corpusPublishRequest(0),
+		_, err = db.PublishCorpusProfile(context.Background(), profile.ProfileID, corpusPublishRequest(0),
 			CorpusMutation{ExpectedETag: profile.ETag})
 		if err != nil {
 			t.Fatal(err)

threat-network/internal/store/corpus_test.go

@@ -695,7 +695,7 @@ func TestCorpusDraftPublishRevisionAndImmutableRelease(t *testing.T) {
 	if manifest.CorpusRevision != 1 || string(stillOne) != string(releaseOneBytes) {
 		t.Fatal("draft revision changed the public release")
 	}
-	profile, err = db.PublishCorpusProfile(context.Background(), profile.ProfileID, corpusPublishRequest(1), CorpusMutation{ExpectedETag: profile.ETag})
+	_, err = db.PublishCorpusProfile(context.Background(), profile.ProfileID, corpusPublishRequest(1), CorpusMutation{ExpectedETag: profile.ETag})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1196,7 +1196,7 @@ func TestCorpusAbandonedUnpublishedVariantCanRestartIdentity(t *testing.T) {
 	if got == nil || got.VariantID != childID || got.PredecessorVariantID != "" || got.Draft == nil || got.Draft.Revision != 2 {
 		t.Fatalf("abandoned identity was not safely restarted: %+v", got)
 	}
-	profile, err = db.PublishCorpusProfile(context.Background(), profile.ProfileID,
+	_, err = db.PublishCorpusProfile(context.Background(), profile.ProfileID,
 		corpusPublishRequest(0), CorpusMutation{ExpectedETag: profile.ETag})
 	if err != nil {
 		t.Fatal(err)