Conversation
Exercise layer creation, scoring, naming, and JSON export against the production build using existing synthetic STIX fixtures. Run the single Chromium test after the existing quality gate builds Navigator, and retain failure artifacts for seven days.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Temporarily expect score 2 after entering score 1 to prove that the draft PR fails and uploads its diagnostic trace. Restore the assertion after validation.
Restore the exported-score assertion to 1. The separate CI run for the preceding commit retains the deliberately incorrect expectation for failure-path validation.
Use the lockfile-installed CLI for Chromium installation so CI cannot fall back to fetching a package through npx.
Move Playwright tests into e2e alongside the existing Protractor files, with separate filename matching and a smoke tag for focused runs. Use test:e2e across local and CI execution, keep artifacts under tmp, and consolidate contributor and Docker instructions in the E2E README. Leave Protractor removal for a separate change.
scotluns
changed the title
Use a shared browser installation path and grant the built-in node user ownership of the test artifact directory. This resolves the SonarCloud finding for the optional Docker setup. Validated the production build and smoke test on Linux arm64 with the documented default Docker run command.
Keep the README focused on the current test setup and rely on the existing tmp ignore rule for Playwright artifacts.
|
jondricek
approved these changes
Sep 16, 2026
jondricek
left a comment
jondricek
left a comment
Contributor
There was a problem hiding this comment.
Overall I approve this pull request, but i'd like you to open a new GitHub issue to update our approach to using mock data for tests in ATT&CK Navigator. We should probably continue to test with various versions of ATT&CK, so we shouldn't completely discount old stuff, but we should also test with current data too, whether mock data or real ATT&CK releases
Comment on lines
+10
to
+20
| // Reuse existing synthetic STIX fixtures; only data responses are replaced. | ||
| await page.route('**/assets/config.json', route => route.fulfill({ | ||
| json: { ...config, collection_index_url: '', versions: configData }, | ||
| })); | ||
| await page.route(configData.entries[0].domains[0].data[0], route => route.fulfill({ | ||
| json: { | ||
| type: 'bundle', | ||
| id: 'bundle-smoke', | ||
| objects: [matrixSDO, TA0000, { ...T0001, name: 'Smoke technique' }, { ...T0003, name: 'Untouched technique' }], | ||
| }, | ||
| })); |
Contributor
There was a problem hiding this comment.
This looks good, but to me it is highlighting that our mock data that it uses here hasn't been updated in 2+ years and probably longer than that, since https://github.com/mitre-attack/attack-navigator/blob/master/nav-app/src/tests/utils/mock-data.ts has ATT&CK v13 in it which is from April 2023.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Establish a foundation for E2E tests that gives contributors confidence that changes preserve Navigator's core workflows. Begin with smoke coverage and a minimal happy path, then add scenarios within the same test setup as coverage grows.
What Changed
nav-app/e2e, run withnpm run test:e2e. Tests tagged@smokecan be selected with--grep @smoke; the README documents the convention and shared setup.tmp/playwright/test-results; CI uploads failure results and traces for seven days.How To Verify
nav-app/e2e/README.mdto build and run locally. The current tagged smoke test passes and writes its export to the configured artifact directory.Known Gaps
Initial coverage uses synthetic data and checks interaction and export behavior. Full ATT&CK data, layer comparison, import, visual rendering, and other browsers remain future coverage.