test: add comprehensive unit test coverage for internal/evaluator package

This commit adds comprehensive unit test coverage for the evaluator package,
covering functions across different test files.

Add new test functions for various policy operations:
  - TestConftestEvaluatorDestroy: Tests the Destroy method of conftestEvaluator
  - TestCapabilitiesPath: Tests the CapabilitiesPath method of opaEvaluator
  - TestCollectVolatileConfigItems: Tests collecting volatile configuration items
        based on time ranges
  - TestNewDefaultFilterFactory: Tests creation of new default filter factory instances
  - TestNewPipelineIntentionFilter: Tests creation of new pipeline intention filter instances
  - TestPipelineIntentionFilter_Include: Tests include functionality of pipeline intention filters
  - TestIncludeListFilter_Include: Tests include functionality of include list filters
  - TestExtractStringArrayFromRuleData: Tests extraction of string arrays from rule data

Note: TestConftestEvaluatorDestroy was named specifically to avoid redeclaration
      errors since both test files exist in the same package (evaluator).
      TestNewDefaultFilterFactory covers both function NewDefaultFilterFactory
      and CreateFilters.

Assisted-by: Cursor (powered by granite-3-2-8b-instruct)

Ref: https://issues.redhat.com/browse/EC-1368

Author: cuipinghuo

internal/evaluator/conftest_evaluator_test.go

@@ -2477,3 +2477,70 @@ func createTestArchive(t *testing.T, sourceDir, archivePath string) {
 	})
 	require.NoError(t, err)
 }
+
+// TestDestroy tests the Destroy method of conftestEvaluator.
+func TestConftestEvaluatorDestroy(t *testing.T) {
+	// Setup an in-memory filesystem
+	fs := afero.NewMemMapFs()
+	workDir := "/tmp/workdir"
+
+	// Define test cases
+	testCases := []struct {
+		name         string
+		workDir      string
+		EC_DEBUG     bool
+		expectRemove bool
+	}{
+		{
+			name:         "Non-empty workDir, EC_DEBUG not set",
+			workDir:      workDir,
+			EC_DEBUG:     false,
+			expectRemove: true,
+		},
+		{
+			name:         "Non-empty workDir, EC_DEBUG set",
+			workDir:      workDir,
+			EC_DEBUG:     true,
+			expectRemove: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Set up the environment
+			if tc.workDir != "" {
+				err := fs.MkdirAll(tc.workDir, 0755)
+				assert.NoError(t, err, "Failed to create workDir in in-memory filesystem")
+			}
+
+			if tc.EC_DEBUG {
+				os.Setenv("EC_DEBUG", "true")
+			} else {
+				os.Unsetenv("EC_DEBUG")
+			}
+
+			// Initialize the evaluator
+			conftestEval := conftestEvaluator{
+				workDir: tc.workDir,
+				fs:      fs,
+			}
+
+			// Call Destroy
+			conftestEval.Destroy()
+
+			// Verify the result
+			exists, err := afero.DirExists(fs, tc.workDir)
+			assert.NoError(t, err, "Error checking if workDir exists after Destroy")
+
+			if tc.expectRemove {
+				assert.False(t, exists, "workDir should be removed")
+			} else {
+				assert.True(t, exists, "workDir should not be removed")
+			}
+
+			// Clean up for next test
+			_ = fs.RemoveAll(tc.workDir)
+			os.Unsetenv("EC_DEBUG")
+		})
+	}
+}

internal/evaluator/criteria_test.go

@@ -20,9 +20,13 @@ package evaluator
 
 import (
 	"testing"
+	"time"
 
+	ecc "github.com/enterprise-contract/enterprise-contract-controller/api/v1alpha1"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/conforma/cli/internal/policy"
 )
 
 func TestLen(t *testing.T) {
@@ -256,3 +260,145 @@ func TestGet(t *testing.T) {
 		})
 	}
 }
+
+// MockConfigProvider implements ConfigProvider interface for testing
+type MockConfigProvider struct {
+	effectiveTime time.Time
+}
+
+func (m *MockConfigProvider) EffectiveTime() time.Time {
+	return m.effectiveTime
+}
+
+func (m *MockConfigProvider) SigstoreOpts() (policy.SigstoreOpts, error) {
+	return policy.SigstoreOpts{}, nil
+}
+
+func (m *MockConfigProvider) Spec() ecc.EnterpriseContractPolicySpec {
+	return ecc.EnterpriseContractPolicySpec{}
+}
+
+func TestCollectVolatileConfigItems(t *testing.T) {
+	// Create a fixed time for testing
+	fixedTime := time.Date(2025, 8, 18, 12, 0, 0, 0, time.UTC)
+
+	tests := []struct {
+		name             string
+		items            *Criteria
+		volatileCriteria []ecc.VolatileCriteria
+		configProvider   ConfigProvider
+		expectedItems    *Criteria
+		expectedSuccess  bool
+	}{
+		{
+			name: "Successful scenario - criteria within time range",
+			items: &Criteria{
+				digestItems:  make(map[string][]string),
+				defaultItems: []string{"existing-item"},
+			},
+			volatileCriteria: []ecc.VolatileCriteria{
+				{
+					Value:          "volatile-item-1",
+					EffectiveOn:    "2025-08-01T00:00:00Z",
+					EffectiveUntil: "2025-08-31T23:59:59Z",
+					ImageRef:       "quay.io/test/image:latest",
+				},
+				{
+					Value:          "volatile-item-2",
+					EffectiveOn:    "2025-08-10T00:00:00Z",
+					EffectiveUntil: "2025-08-20T23:59:59Z",
+					ImageDigest:    "sha256:abc123",
+				},
+			},
+			configProvider: &MockConfigProvider{effectiveTime: fixedTime},
+			expectedItems: &Criteria{
+				digestItems: map[string][]string{
+					"quay.io/test/image:latest": {"volatile-item-1"},
+					"sha256:abc123":             {"volatile-item-2"},
+				},
+				defaultItems: []string{"existing-item"},
+			},
+			expectedSuccess: true,
+		},
+		{
+			name: "Failed scenario - criteria outside time range",
+			items: &Criteria{
+				digestItems:  make(map[string][]string),
+				defaultItems: []string{"existing-item"},
+			},
+			volatileCriteria: []ecc.VolatileCriteria{
+				{
+					Value:          "expired-item",
+					EffectiveOn:    "2025-07-01T00:00:00Z",
+					EffectiveUntil: "2025-07-31T23:59:59Z",
+					ImageUrl:       "quay.io/test/expired",
+				},
+				{
+					Value:          "future-item",
+					EffectiveOn:    "2025-09-01T00:00:00Z",
+					EffectiveUntil: "2025-09-30T23:59:59Z",
+					ImageRef:       "quay.io/test/future",
+				},
+			},
+			configProvider: &MockConfigProvider{effectiveTime: fixedTime},
+			expectedItems: &Criteria{
+				digestItems:  make(map[string][]string),
+				defaultItems: []string{"existing-item"},
+			},
+			expectedSuccess: true, // Function doesn't fail, just doesn't add items
+		},
+		{
+			name: "Warning scenario - invalid time formats",
+			items: &Criteria{
+				digestItems:  make(map[string][]string),
+				defaultItems: []string{"existing-item"},
+			},
+			volatileCriteria: []ecc.VolatileCriteria{
+				{
+					Value:          "partial-invalid-item",
+					EffectiveOn:    "2025-08-01T00:00:00Z", // Valid format
+					EffectiveUntil: "not-a-date",           // Invalid format
+					ImageDigest:    "sha256:def456",
+				},
+			},
+			configProvider: &MockConfigProvider{effectiveTime: fixedTime},
+			expectedItems: &Criteria{
+				digestItems: map[string][]string{
+					"sha256:def456": {"partial-invalid-item"},
+				},
+				defaultItems: []string{"existing-item"},
+			},
+			expectedSuccess: true, // Function handles invalid times gracefully
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Create a copy of the initial items to avoid modifying the test data
+			initialItems := &Criteria{
+				digestItems:  make(map[string][]string),
+				defaultItems: make([]string, len(tt.items.defaultItems)),
+			}
+			copy(initialItems.defaultItems, tt.items.defaultItems)
+			for k, v := range tt.items.digestItems {
+				initialItems.digestItems[k] = make([]string, len(v))
+				copy(initialItems.digestItems[k], v)
+			}
+
+			// Call the function
+			result := collectVolatileConfigItems(initialItems, tt.volatileCriteria, tt.configProvider)
+
+			// Verify the result
+			if tt.expectedSuccess {
+				require.Equal(t, tt.expectedItems.defaultItems, result.defaultItems, "defaultItems mismatch")
+				require.Equal(t, len(tt.expectedItems.digestItems), len(result.digestItems), "digestItems count mismatch")
+
+				for expectedKey, expectedValues := range tt.expectedItems.digestItems {
+					actualValues, exists := result.digestItems[expectedKey]
+					require.True(t, exists, "Expected key %s not found in result", expectedKey)
+					require.Equal(t, expectedValues, actualValues, "Values mismatch for key %s", expectedKey)
+				}
+			}
+		})
+	}
+}