fix: use effectiveTime instead of time.Now() in computeSuccesses

Success filtering was using time.Now() instead of the evaluator's
effective time, causing inconsistent behavior for backdated runs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: joejstuart

internal/evaluator/base_evaluator.go

@@ -318,7 +318,7 @@ func (b *basePolicyEvaluator) postProcessResults(ctx context.Context, runResults
 		result.Exceptions = exceptions
 		result.Skipped = skipped
 
-		result.Successes = b.computeSuccesses(result, b.rules, target.Target, target.ComponentName, missingIncludes, unifiedFilter)
+		result.Successes = b.computeSuccesses(result, b.rules, target.Target, target.ComponentName, missingIncludes, unifiedFilter, effectiveTime)
 
 		totalRules += len(result.Warnings) + len(result.Failures) + len(result.Successes)
 		results = append(results, result)
@@ -351,6 +351,7 @@ func (b *basePolicyEvaluator) computeSuccesses(
 	componentName string,
 	missingIncludes map[string]bool,
 	unifiedFilter PostEvaluationFilter,
+	effectiveTime time.Time,
 ) []Result {
 	seenRules := map[string]bool{}
 	for _, outcomes := range [][]Result{result.Failures, result.Warnings, result.Skipped, result.Exceptions} {
@@ -395,7 +396,7 @@ func (b *basePolicyEvaluator) computeSuccesses(
 
 		if unifiedFilter != nil {
 			filteredResults, _ := unifiedFilter.FilterResults(
-				[]Result{success}, rules, imageRef, componentName, missingIncludes, time.Now())
+				[]Result{success}, rules, imageRef, componentName, missingIncludes, effectiveTime)
 			if len(filteredResults) == 0 {
 				log.Debugf("Skipping result success: %#v", success)
 				continue

internal/evaluator/conftest_evaluator.go

@@ -661,7 +661,7 @@ func (c conftestEvaluator) Evaluate(ctx context.Context, target EvaluationTarget
 		result.Skipped = skipped
 
 		// Replace the placeholder successes slice with the actual successes.
-		result.Successes = c.computeSuccesses(result, rules, target.Target, target.ComponentName, missingIncludes, unifiedFilter)
+		result.Successes = c.computeSuccesses(result, rules, target.Target, target.ComponentName, missingIncludes, unifiedFilter, effectiveTime)
 
 		totalRules += len(result.Warnings) + len(result.Failures) + len(result.Successes)
 
@@ -802,6 +802,7 @@ func (c conftestEvaluator) computeSuccesses(
 	componentName string,
 	missingIncludes map[string]bool,
 	unifiedFilter PostEvaluationFilter,
+	effectiveTime time.Time,
 ) []Result {
 	// what rules, by code, have we seen in the Conftest results, use map to
 	// take advantage of hashing for quicker lookup
@@ -858,7 +859,7 @@ func (c conftestEvaluator) computeSuccesses(
 		if unifiedFilter != nil {
 			// Use the unified filter to check if this success should be included
 			filteredResults, _ := unifiedFilter.FilterResults(
-				[]Result{success}, rules, imageRef, componentName, missingIncludes, time.Now())
+				[]Result{success}, rules, imageRef, componentName, missingIncludes, effectiveTime)
 
 			if len(filteredResults) == 0 {
 				log.Debugf("Skipping result success: %#v", success)

internal/evaluator/conftest_evaluator_unit_filtering_test.go

@@ -28,6 +28,7 @@ package evaluator
 
 import (
 	"testing"
+	"time"
 
 	ecc "github.com/conforma/crds/api/v1alpha1"
 	"github.com/stretchr/testify/assert"
@@ -532,6 +533,7 @@ func TestComputeSuccessesLegacyFallback(t *testing.T) {
 				tt.componentName,
 				tt.missingIncludes,
 				nil, // nil unifiedFilter triggers the legacy fallback path
+				time.Now(),
 			)
 
 			assert.Equal(t, tt.expectedCount, len(successes), "unexpected number of successes")

internal/evaluator/opa_evaluator_test.go

@@ -756,7 +756,7 @@ func TestBasePolicyEvaluatorComputeSuccesses(t *testing.T) {
 			},
 		}
 
-		successes := b.computeSuccesses(result, rules, "", "", map[string]bool{}, nil)
+		successes := b.computeSuccesses(result, rules, "", "", map[string]bool{}, nil, time.Now())
 		assert.Len(t, successes, 1)
 		assert.Equal(t, "Pass", successes[0].Message)
 		assert.Equal(t, "test.ns.rule2", successes[0].Metadata[metadataCode])
@@ -776,7 +776,7 @@ func TestBasePolicyEvaluatorComputeSuccesses(t *testing.T) {
 			},
 		}
 
-		successes := b.computeSuccesses(result, rules, "", "", map[string]bool{}, nil)
+		successes := b.computeSuccesses(result, rules, "", "", map[string]bool{}, nil, time.Now())
 		assert.Empty(t, successes)
 	})
 
@@ -788,7 +788,7 @@ func TestBasePolicyEvaluatorComputeSuccesses(t *testing.T) {
 
 		result := Outcome{Namespace: "test.ns"}
 
-		successes := b.computeSuccesses(result, rules, "", "", map[string]bool{}, nil)
+		successes := b.computeSuccesses(result, rules, "", "", map[string]bool{}, nil, time.Now())
 		assert.Len(t, successes, 2)
 	})
 
@@ -812,7 +812,7 @@ func TestBasePolicyEvaluatorComputeSuccesses(t *testing.T) {
 		}
 		result := Outcome{Namespace: "test.ns"}
 
-		successes := b.computeSuccesses(result, extendedRules, "", "", map[string]bool{}, nil)
+		successes := b.computeSuccesses(result, extendedRules, "", "", map[string]bool{}, nil, time.Now())
 		require.Len(t, successes, 1)
 		assert.Equal(t, "Full Rule", successes[0].Metadata[metadataTitle])
 		assert.Equal(t, "A complete rule", successes[0].Metadata[metadataDescription])