Minder rule test format experiment -- Starlark

check_pinned.star

# Minder Rule Test — Starlark Format Experiment
# Rule: branch_protection_allow_force_pushes
# Format: Starlark (using go.starlark.net embedding)
#
# The test runner would embed a Starlark interpreter and expose:
#   - run_rule(rule_name, mocks, profile) → EvalResult
#   - EvalResult.status → "pass" | "fail" | "error"
#   - EvalResult.violations → list of violation messages

# ── Shared setup ──────────────────────────────────────────────────────────────

ENTITY = {
    "owner": "acme-corp",
    "repo":  "widgets",
    "branch": "main",
}

# ── Git ingest rule ───────────────────────────────────────────────────────────
# Rule: actions_check_pinned_tags
# Git ingest rules get file contents instead of HTTP mocks.
# Starlark handles this naturally with a "files" dict.

cases = {
    "pinned": {
        "ref": "b4ffde65f46336ab88eb53be808477a3936bae11",
        "expect": "pass",
    },
    "unpinned" {
        "ref": "v4",
        "expect": "fail",
        "checker": lambda(result): assert len(result.violations) == 1 and "unpinned" in result.violations[0].msg,
    }
}

def testcase(case):
    fs = txtar(load("check_pinned.txtar"))
    fs = {k: v.format(ref=case.ref) for k, v in fs.items()}
    result = run_rule(
        rule   = "actions_check_pinned_tags",
        entity = ENTITY,
        files  = fs,
    )
    assert result.status == case.expect
    if checker in case:
        case.checker(result)

[testcase(v) for k, v in cases] 

def test_no_workflows():
    result = run_rule(
        rule   = "actions_check_pinned_tags",
        entity = ENTITY,
        files  = {},   # empty repo
    )
    assert result.status == "pass"

test_no_workflows()

check_pinned.txtar

--- .github/workflows/action.yml ---
# This is a sample workflow, defanged by being in a .txtar file
name: CI
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@{ref}