fix(cloud-security): exclude per-task runs from latest scan selection - #3341
Merged
Conversation
## Problem Automated daily AWS Cloud Security scans show minimal results while manual scans on the same day return full results. Customers see an incomplete security posture from automated runs but get correct data when triggering manually. ## Root cause The `getLatestRunsByConnection` and `getNewPlatformFindings` queries select the newest `IntegrationCheckRun` per connection using `distinct(['connectionId'])` without filtering by check type. The full AWS security scan (checkId 'aws-security-scan') runs at 05:00 and produces complete results. Later at 06:00 per-task evidence checks write their own runs to the same connectionId with status updates. Since the query picks the absolute newest run per connection, it shadows the full scan result with a tiny per-task run. Manual scans bypass this by writing a fresh full run that temporarily becomes the latest. ## Fix Scope the latest-run selection to only the provider's 'security-scan' checkId, excluding per-task evidence check runs from the latest run calculation. This ensures the dashboard always displays the full scan result as intended. ## Explicitly NOT touched Per-task evidence check runs continue to execute and store normally. No changes to scan scheduling or task execution logic. Historical data remains intact. ## Verification ✅ Automated daily scan now returns full result set matching manual scan ✅ Dashboard latest run consistently shows complete AWS security findings ✅ Per-task check runs still execute and don't interfere with primary results
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
cubic analysis
No issues found across 2 files
Confidence score: 5/5
- Automated review surfaced no issues in the provided summaries.
- No files require special attention.
Linked issue analysis
Linked issue: CS-702: [Bug] - AWS Cloud Security Tests — Automated Daily Scan Returns Minimal Results vs. Manual Scan
| Status | Acceptance criteria | Notes |
|---|---|---|
| ✅ | Automated daily scans return the full result set (comparable to manual scan) | Unit test reproduces the scenario (full scan at 05:00, newer per-task run at 06:00) and asserts getFindings returns the three full-scan results and excludes the per-task-only result. |
| ✅ | Cloud Tests dashboard latestRun shows the complete AWS security findings (summary metrics from full scan) | Unit test asserts the provider latestRun contains the full-scan totals (totalChecked/passedCount/failedCount) after the change. |
| ✅ | Latest-run selection is scoped to provider 'security-scan' checkIds (excluding per-task/'all' runs) | Code adds CLOUD_SCAN_CHECK_IDS and applies checkId: { in: CLOUD_SCAN_CHECK_IDS } to integrationCheckRun.findMany; a test asserts findMany was called with the expected checkId array. |
| ✅ | Regression covered by tests that emulate Prisma ordering/distinct to ensure per-task runs don't shadow full scans | The spec file includes an in-memory mock of the Prisma semantics and fixtures (scanRun and taskRun) that reproduce the problematic ordering and verify the fix. |
Contributor
|
🎉 This PR is included in version 3.98.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Automated daily AWS Cloud Security scans show minimal results while manual scans on the same day return full results. Customers see an incomplete security posture from automated runs but get correct data when triggering manually.
Root cause
The
getLatestRunsByConnectionandgetNewPlatformFindingsqueries select the newestIntegrationCheckRunper connection usingdistinct(['connectionId'])without filtering by check type. The full AWS security scan (checkId 'aws-security-scan') runs at 05:00 and produces complete results. Later at 06:00 per-task evidence checks write their own runs to the same connectionId with status updates. Since the query picks the absolute newest run per connection, it shadows the full scan result with a tiny per-task run. Manual scans bypass this by writing a fresh full run that temporarily becomes the latest.Fix
Scope the latest-run selection to only the provider's 'security-scan' checkId, excluding per-task evidence check runs from the latest run calculation. This ensures the dashboard always displays the full scan result as intended.
Explicitly NOT touched
Per-task evidence check runs continue to execute and store normally. No changes to scan scheduling or task execution logic. Historical data remains intact.
Verification
✅ Automated daily scan now returns full result set matching manual scan
✅ Dashboard latest run consistently shows complete AWS security findings
✅ Per-task check runs still execute and don't interfere with primary results
Fixes CS-702
Summary by cubic
Fixes CS-702 by scoping “latest run” selection to cloud-security scan checkIds so per-task and
allruns no longer shadow the full daily scan. Automated results now match manual scans across AWS, GCP, and Azure.CloudSecurityQueryServicetoaws-security-scan,gcp-security-scan, andazure-security-scan(viaCLOUD_SCAN_CHECK_IDS).checkIdfilter.Written for commit e1b6c0b. Summary will update on new commits.