feat: expand audit mode with config health checks and tests

Add three new AuditFetchers that flag alert configuration issues:
- disabled_conditions: NRQL conditions with enabled=false
- uncovered_alert_policies: policies with active conditions but no
  aiWorkflow routing their alerts, and policies with zero conditions
- legacy_conditions: APM/Browser/Mobile metric conditions that should
  be migrated to NRQL

Update report.go to render config findings (empty IDType) without the
ID->entity resolution line, and split the overall summary into
"Hardcoded ID refs" and "Config issues" counters.

Fix resolver.go suggest() to preserve pre-set Suggestion on config
findings instead of overwriting with an empty string.

Add 8 test files covering patterns, CSV, report, and all four fetchers
(conditions, disabled, uncovered policies, legacy). Update CI to emit
a coverage report and upload coverage.out as an artifact.

Author: Adilson Somensari

.github/workflows/ci.yml

@@ -23,7 +23,16 @@ jobs:
         run: go vet ./...
 
       - name: Test
-        run: go test -race -v ./...
+        run: go test -race -coverprofile=coverage.out -covermode=atomic ./...
+
+      - name: Coverage summary
+        run: go tool cover -func=coverage.out | tail -1
+
+      - name: Upload coverage
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage
+          path: coverage.out
 
   build:
     name: Cross-compile

.gitignore

@@ -22,3 +22,6 @@ output/
 # Go test cache
 *.test
 coverage.out
+
+# Local dev notes (not for version control)
+DEVNOTES.md

internal/audit/auditor.go

@@ -154,9 +154,12 @@ func AllFetchers() []AuditFetcher {
 	return []AuditFetcher{
 		&dashboardsAuditFetcher{},
 		&conditionsAuditFetcher{},
+		&disabledConditionsAuditFetcher{},
+		&legacyConditionsAuditFetcher{},
 		&workloadsAuditFetcher{},
 		&serviceLevelsAuditFetcher{},
 		&workflowsAuditFetcher{},
+		&uncoveredPoliciesAuditFetcher{},
 	}
 }
 

internal/audit/csv_test.go

@@ -0,0 +1,171 @@
+package audit
+
+import (
+	"bytes"
+	"encoding/csv"
+	"io"
+	"testing"
+
+	"github.com/asomensari-es/nr-tf-util/internal/resources"
+)
+
+func readCSV(t *testing.T, r io.Reader) [][]string {
+	t.Helper()
+	rows, err := csv.NewReader(r).ReadAll()
+	if err != nil {
+		t.Fatalf("csv parse error: %v", err)
+	}
+	return rows
+}
+
+func TestWriteCSV_Headers(t *testing.T) {
+	var buf bytes.Buffer
+	if err := WriteCSV(&buf, nil); err != nil {
+		t.Fatalf("WriteCSV error: %v", err)
+	}
+	rows := readCSV(t, &buf)
+	if len(rows) != 1 {
+		t.Fatalf("expected header row only, got %d rows", len(rows))
+	}
+	want := []string{
+		"account_id", "account_name",
+		"asset_type", "asset_id", "asset_name",
+		"location", "id_type", "id_value",
+		"resolved", "entity_name", "entity_type",
+		"suggestion",
+	}
+	if len(rows[0]) != len(want) {
+		t.Fatalf("header column count = %d, want %d", len(rows[0]), len(want))
+	}
+	for i, col := range want {
+		if rows[0][i] != col {
+			t.Errorf("header[%d] = %q, want %q", i, rows[0][i], col)
+		}
+	}
+}
+
+func TestWriteCSV_IDFinding(t *testing.T) {
+	results := []*AuditResult{
+		{
+			Account: resources.Account{ID: 1234, Name: "Prod"},
+			Findings: []Finding{
+				{
+					AssetType:  "nrql_condition",
+					AssetID:    "1234:99",
+					AssetName:  "High Error Rate",
+					Location:   "condition query",
+					IDType:     "appId",
+					IDValue:    "555",
+					Resolved:   true,
+					EntityName: "Checkout Service",
+					EntityType: "APPLICATION",
+					Suggestion: "Replace with: appName = 'Checkout Service'",
+				},
+			},
+		},
+	}
+
+	var buf bytes.Buffer
+	if err := WriteCSV(&buf, results); err != nil {
+		t.Fatalf("WriteCSV error: %v", err)
+	}
+	rows := readCSV(t, &buf)
+	if len(rows) != 2 { // header + 1 finding
+		t.Fatalf("expected 2 rows, got %d", len(rows))
+	}
+	row := rows[1]
+	checks := []struct{ col, want int }{
+		{0, 0}, // account_id checked separately
+	}
+	_ = checks
+
+	assertEqual(t, row, 0, "1234")
+	assertEqual(t, row, 1, "Prod")
+	assertEqual(t, row, 2, "nrql_condition")
+	assertEqual(t, row, 3, "1234:99")
+	assertEqual(t, row, 4, "High Error Rate")
+	assertEqual(t, row, 5, "condition query")
+	assertEqual(t, row, 6, "appId")
+	assertEqual(t, row, 7, "555")
+	assertEqual(t, row, 8, "true")
+	assertEqual(t, row, 9, "Checkout Service")
+	assertEqual(t, row, 10, "APPLICATION")
+	assertEqual(t, row, 11, "Replace with: appName = 'Checkout Service'")
+}
+
+func TestWriteCSV_ConfigFinding(t *testing.T) {
+	results := []*AuditResult{
+		{
+			Account: resources.Account{ID: 9, Name: "Staging"},
+			Findings: []Finding{
+				{
+					AssetType:  "nrql_condition",
+					AssetID:    "9:7",
+					AssetName:  "CPU Alert",
+					Location:   "condition configuration",
+					Suggestion: "Condition is disabled — enable it or remove it to reduce policy noise",
+				},
+			},
+		},
+	}
+
+	var buf bytes.Buffer
+	if err := WriteCSV(&buf, results); err != nil {
+		t.Fatalf("WriteCSV error: %v", err)
+	}
+	rows := readCSV(t, &buf)
+	if len(rows) != 2 {
+		t.Fatalf("expected 2 rows, got %d", len(rows))
+	}
+	row := rows[1]
+	assertEqual(t, row, 6, "")  // id_type empty
+	assertEqual(t, row, 7, "")  // id_value empty
+	assertEqual(t, row, 8, "false") // resolved false
+	assertEqual(t, row, 9, "")  // entity_name empty
+	assertEqual(t, row, 10, "") // entity_type empty
+	assertEqual(t, row, 11, "Condition is disabled — enable it or remove it to reduce policy noise")
+}
+
+func TestWriteCSV_MultipleAccounts(t *testing.T) {
+	results := []*AuditResult{
+		{
+			Account:  resources.Account{ID: 1, Name: "A"},
+			Findings: []Finding{{AssetType: "dashboard", AssetID: "g1", AssetName: "D1", Location: "l1", IDType: "appId", IDValue: "1"}},
+		},
+		{
+			Account:  resources.Account{ID: 2, Name: "B"},
+			Findings: []Finding{},
+		},
+		{
+			Account: resources.Account{ID: 3, Name: "C"},
+			Findings: []Finding{
+				{AssetType: "workflow", AssetID: "w1", AssetName: "W1", Location: "l1", IDType: "appId", IDValue: "2"},
+				{AssetType: "workflow", AssetID: "w1", AssetName: "W1", Location: "l2", IDType: "hostId", IDValue: "3"},
+			},
+		},
+	}
+
+	var buf bytes.Buffer
+	if err := WriteCSV(&buf, results); err != nil {
+		t.Fatalf("WriteCSV error: %v", err)
+	}
+	rows := readCSV(t, &buf)
+	// header + 1 (account 1) + 0 (account 2) + 2 (account 3)
+	if len(rows) != 4 {
+		t.Fatalf("expected 4 rows, got %d", len(rows))
+	}
+	assertEqual(t, rows[1], 0, "1")
+	assertEqual(t, rows[2], 0, "3")
+	assertEqual(t, rows[3], 0, "3")
+}
+
+func assertEqual(t *testing.T, row []string, col int, want string) {
+	t.Helper()
+	if col >= len(row) {
+		t.Errorf("column %d out of range (row has %d columns)", col, len(row))
+		return
+	}
+	if row[col] != want {
+		t.Errorf("col[%d] = %q, want %q", col, row[col], want)
+	}
+}

internal/audit/fetch_conditions_test.go

@@ -0,0 +1,103 @@
+package audit
+
+import (
+	"context"
+	"testing"
+)
+
+func TestConditionsAuditFetcher_HardcodedID(t *testing.T) {
+	mock := newMock(`{
+		"actor":{"account":{"alerts":{"nrqlConditionsSearch":{
+			"nrqlConditions":[
+				{"id":"1","name":"High Error","nrql":{"query":"SELECT count(*) FROM Transaction WHERE appId = 55555"}}
+			],
+			"nextCursor":""
+		}}}}}`)
+
+	fetcher := &conditionsAuditFetcher{}
+	findings, err := fetcher.Fetch(context.Background(), mock, 9)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(findings) != 1 {
+		t.Fatalf("got %d findings, want 1", len(findings))
+	}
+	f := findings[0]
+	if f.AssetType != "nrql_condition" {
+		t.Errorf("AssetType = %q, want nrql_condition", f.AssetType)
+	}
+	if f.AssetID != "9:1" {
+		t.Errorf("AssetID = %q, want 9:1", f.AssetID)
+	}
+	if f.IDType != "appId" {
+		t.Errorf("IDType = %q, want appId", f.IDType)
+	}
+	if f.IDValue != "55555" {
+		t.Errorf("IDValue = %q, want 55555", f.IDValue)
+	}
+}
+
+func TestConditionsAuditFetcher_NoHardcodedIDs(t *testing.T) {
+	mock := newMock(`{
+		"actor":{"account":{"alerts":{"nrqlConditionsSearch":{
+			"nrqlConditions":[
+				{"id":"1","name":"Clean Condition","nrql":{"query":"SELECT count(*) FROM Transaction"}}
+			],
+			"nextCursor":""
+		}}}}}`)
+
+	fetcher := &conditionsAuditFetcher{}
+	findings, err := fetcher.Fetch(context.Background(), mock, 9)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(findings) != 0 {
+		t.Errorf("got %d findings, want 0", len(findings))
+	}
+}
+
+func TestConditionsAuditFetcher_Pagination(t *testing.T) {
+	mock := newMock(
+		`{"actor":{"account":{"alerts":{"nrqlConditionsSearch":{
+			"nrqlConditions":[{"id":"1","name":"C1","nrql":{"query":"WHERE appId = 1"}}],
+			"nextCursor":"page2"
+		}}}}}`,
+		`{"actor":{"account":{"alerts":{"nrqlConditionsSearch":{
+			"nrqlConditions":[{"id":"2","name":"C2","nrql":{"query":"WHERE appId = 2"}}],
+			"nextCursor":""
+		}}}}}`,
+	)
+
+	findings, err := (&conditionsAuditFetcher{}).Fetch(context.Background(), mock, 1)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(findings) != 2 {
+		t.Errorf("got %d findings, want 2", len(findings))
+	}
+	if mock.calls() != 2 {
+		t.Errorf("expected 2 API calls, made %d", mock.calls())
+	}
+}
+
+func TestConditionsAuditFetcher_Empty(t *testing.T) {
+	mock := newMock(`{"actor":{"account":{"alerts":{"nrqlConditionsSearch":{
+		"nrqlConditions":[],"nextCursor":""}}}}}`)
+
+	findings, err := (&conditionsAuditFetcher{}).Fetch(context.Background(), mock, 1)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(findings) != 0 {
+		t.Errorf("got %d findings, want 0", len(findings))
+	}
+}
+
+func TestConditionsAuditFetcher_APIError(t *testing.T) {
+	mock := newMock(`not valid json`)
+
+	_, err := (&conditionsAuditFetcher{}).Fetch(context.Background(), mock, 1)
+	if err == nil {
+		t.Error("expected error from malformed JSON, got nil")
+	}
+}

internal/audit/fetch_disabled_conditions.go

@@ -0,0 +1,74 @@
+package audit
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/asomensari-es/nr-tf-util/internal/resources"
+)
+
+// disabledConditionsAuditFetcher flags NRQL alert conditions that are disabled.
+type disabledConditionsAuditFetcher struct{}
+
+func (f *disabledConditionsAuditFetcher) Name() string { return "disabled_conditions" }
+
+func (f *disabledConditionsAuditFetcher) Fetch(ctx context.Context, ng resources.NerdGrapher, accountID int) ([]Finding, error) {
+	const query = `
+query($accountId: Int!, $cursor: String) {
+  actor {
+    account(id: $accountId) {
+      alerts {
+        nrqlConditionsSearch(cursor: $cursor) {
+          nrqlConditions {
+            id
+            name
+            enabled
+          }
+          nextCursor
+        }
+      }
+    }
+  }
+}`
+
+	type condPage struct {
+		Actor struct {
+			Account struct {
+				Alerts struct {
+					NrqlConditionsSearch struct {
+						NrqlConditions []struct {
+							ID      string `json:"id"`
+							Name    string `json:"name"`
+							Enabled bool   `json:"enabled"`
+						} `json:"nrqlConditions"`
+						NextCursor string `json:"nextCursor"`
+					} `json:"nrqlConditionsSearch"`
+				} `json:"alerts"`
+			} `json:"account"`
+		} `json:"actor"`
+	}
+
+	var findings []Finding
+
+	err := paginate(ctx, func(cursor string) (string, error) {
+		var resp condPage
+		vars := map[string]interface{}{"accountId": accountID, "cursor": cursor}
+		if err := ng.QueryWithResponseAndContext(ctx, query, vars, &resp); err != nil {
+			return "", err
+		}
+		for _, c := range resp.Actor.Account.Alerts.NrqlConditionsSearch.NrqlConditions {
+			if !c.Enabled {
+				findings = append(findings, Finding{
+					AssetType:  "nrql_condition",
+					AssetName:  c.Name,
+					AssetID:    fmt.Sprintf("%d:%s", accountID, c.ID),
+					Location:   "condition configuration",
+					Suggestion: "Condition is disabled — enable it or remove it to reduce policy noise",
+				})
+			}
+		}
+		return resp.Actor.Account.Alerts.NrqlConditionsSearch.NextCursor, nil
+	})
+
+	return findings, err
+}