fix(cloud-security): exclude per-task runs from latest scan selection

Merged
TO
4mo ago
+266-0

Problem

Automated daily AWS Cloud Security scans show minimal results while manual scans on the same day return full results. Customers see an incomplete security posture from automated runs but get correct data when triggering manually.

Root cause

The getLatestRunsByConnection and getNewPlatformFindings queries select the newest IntegrationCheckRun per connection using distinct(['connectionId']) without filtering by check type. The full AWS security scan (checkId 'aws-security-scan') runs at 05:00 and produces complete results. Later at 06:00 per-task evidence checks write their own runs to the same connectionId with status updates. Since the query picks the absolute newest run per connection, it shadows the full scan result with a tiny per-task run. Manual scans bypass this by writing a fresh full run that temporarily becomes the latest.

Fix

Scope the latest-run selection to only the provider's 'security-scan' checkId, excluding per-task evidence check runs from the latest run calculation. This ensures the dashboard always displays the full scan result as intended.

Explicitly NOT touched

Per-task evidence check runs continue to execute and store normally. No changes to scan scheduling or task execution logic. Historical data remains intact.

Verification

✅ Automated daily scan now returns full result set matching manual scan
✅ Dashboard latest run consistently shows complete AWS security findings
✅ Per-task check runs still execute and don't interfere with primary results

Fixes CS-702

Summary by cubic

Fixes CS-702 by scoping “latest run” selection to cloud-security scan checkIds so per-task and all runs no longer shadow the full daily scan. Automated results now match manual scans across AWS, GCP, and Azure.

  • Bug Fixes
    • Scope latest-run queries in CloudSecurityQueryService to aws-security-scan, gcp-security-scan, and azure-security-scan (via CLOUD_SCAN_CHECK_IDS).
    • Add regression tests that reproduce the 05:00 scan vs 06:00 per-task ordering and verify findings and provider summaries use the full scan, including asserting the scoped checkId filter.