feat(go): advance validation sidecar toward production

go-agent/internal/events/pipeline_test.go

@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package events
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestRuleSetMatchesCompatibilityJSON(t *testing.T) {
+	rules := NewRuleSet(DefaultExecRuleEngine())
+	tests := []struct {
+		raw string
+		sid int
+	}{
+		{`{"type":"execve","pid":"42","ppid":"1","uid":"1000","parent_comm":"nginx","filename":"/bin/sh","argv":["-c","id"]}`, 100003},
+		{`{"type":"sys","pid":"43","comm":"loader","syscall":"mprotect","args":["0x1000","0x1000",0],"arg2":"0x6"}`, 100060},
+		{`{"type":"listen","pid":"44","comm":"python3","listen_ip":"0.0.0.0","listen_port":"4444"}`, 100068},
+	}
+	for _, test := range tests {
+		alerts, err := rules.MatchJSON([]byte(test.raw))
+		if err != nil {
+			t.Fatal(err)
+		}
+		found := false
+		for _, alert := range alerts {
+			if alert.SID == test.sid {
+				found = true
+			}
+		}
+		if !found {
+			t.Fatalf("sid %d did not match %s: %#v", test.sid, test.raw, alerts)
+		}
+	}
+}
+
+func TestScanJSONLReportsLine(t *testing.T) {
+	err := ScanJSONL(strings.NewReader("\n{}\n"), func(raw []byte) error {
+		_, err := NewRuleSet(DefaultExecRuleEngine()).MatchJSON(raw)
+		return err
+	})
+	if err == nil || !strings.Contains(err.Error(), "line 2") {
+		t.Fatalf("missing line context: %v", err)
+	}
+}