Repository navigation
Duplication scanner still reports clones in the EKS validator tests #2777
Description
🤖 Generated by the Daily AI Engineer
Evidence
After #2776 the duplication scanner drops from 19 findings to 13 in scripts/validate-eks-ci-role-policy/main_test.go, measured locally with the same settings the lint job uses (jscpd --min-lines 5 --min-tokens 50 --threshold 0). The remaining 13 fall into two groups, and they want different treatment:
- Shared manifest shapes. Several test fixtures repeat the same
ClusterRoleBinding→roleRef→subjectsblock with different names — for example the same-name role shadow case and the binding-to-unavailable-privileged-role case. These are genuine copy-paste and should be built from a shared renderer, exactly as fix(lint): scope the lint gate to the paths it actually governs #2776 did for the six identity-binding fixtures. - Table-driven test boilerplate. Others are the standard closing of a case table followed by
for _, tt := range tests { t.Run(...) }, repeated once per test function. This is idiomatic Go rather than copy-paste debt, and abstracting it away naively would make the tests harder to read, not easier. The fix here is a shared case runner, not an inlined clever helper.
Why it matters
Duplication is held at 0% deliberately and is never thresholded or ignored, so every remaining finding keeps the lint job red — and a red lint job on every pull request is what made the original defects invisible in the first place.
Acceptance criteria
-
jscpdreports 0 clones forscripts/validate-eks-ci-role-policy/, with the threshold left at 0.0%. - The test inventory is unchanged: same test and subtest names, same count.
- Any fixture rendered by a helper is proved byte-identical to the literal it replaced before that literal is deleted. These tests assert a manifest is rejected, so a helper emitting subtly wrong YAML still produces the expected rejection — the assertions go vacuous without that proof. fix(lint): scope the lint gate to the paths it actually governs #2776 has the pattern.
Reacted by coderabbitai
Activity
coderabbitai commentedon Jul 21, 2026
🔗 Related PRs
#2273 - ci: re-enable in-process Helm render in validate (revert --skip-helm-render) [merged]
#2370 - fix(autoscaling): break the DaemonSet-VPA node ratchet; keep Longhorn storage off autoscale nodes [merged]
#2507 - fix(apps): make actual-budget openid schema offline-resolvable [merged]
#2580 - fix(policy): refresh replica-floor exemptions as skips [merged]
#2633 - fix(deploy): verify incoming image on Talos nodes [merged]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord!
docs(lint): correct the binding helper's comment and make its YAML re…
devantler commentedon Jul 21, 2026
A finding from self-review on #2776 that belongs to this issue rather than that PR, so it is not lost.
awsIdentityBindingthere is deliberately cut at the boundary of one test's six fixtures, not at "an RBAC binding fixture in this file". It hardcodesmetadata.name: aws-shadowand the leading---, and derivesroleReffrom scope. So the other standalone binding documents inmain_test.go— around lines 114, 391, 492 — cannot adopt it as it stands.That was left alone on purpose: adding fields no current fixture uses would be speculative, and this issue is where the rest of the file gets deduplicated anyway. Worth knowing when picking it up:
roleKind/roleName/namefields and keep scope selecting the defaults the six existing routes rely on, and those routes do not change.RoleBindingreferencing aClusterRoleis how a cluster role is granted namespace-scoped, and the fixture at line 114 already uses that shape. It is a plausible escalation route toaws/awsthat the table does not currently cover. An earlier version of the helper's comment wrongly claimed Kubernetes forbids it — corrected in fix(lint): scope the lint gate to the paths it actually governs #2776, but flagging it here since the gap in coverage is real and is worth a case of its own.fix(lint): scope MegaLinter to the paths it actually governs
chore: agent-claim #2777 nonce=47fae0ee88c7c0b644bb1a5d74619714