feat(test): add support for folder-based query test cases

assets/queries/terraform/aws/iam_group_without_users/query.rego

@@ -16,6 +16,7 @@ CxPolicy[result] {
 		"issueType": "MissingAttribute",
 		"keyExpectedValue": sprintf("aws_iam_group[%s] should be associated with an aws_iam_group_membership that has at least one user set", [name]),
 		"keyActualValue": sprintf("aws_iam_group[%s] is not associated with an aws_iam_group_membership that has at least one user set", [name]),
+		"searchLine": common_lib.build_search_line(["resource", "aws_iam_group", name], [])
 	}
 }
 

assets/queries/terraform/aws/iam_group_without_users/test/negative4/negative4_1.tf

@@ -0,0 +1,4 @@
+
+resource "aws_iam_group" "group1" {
+  name = "test"
+}

assets/queries/terraform/aws/iam_group_without_users/test/negative4/negative4_2.tf

@@ -0,0 +1,4 @@
+resource "aws_iam_user_group_membership" "user_group_membership" {
+  user = var.user_iam
+  groups = aws_iam_group.group1.name
+}

assets/queries/terraform/aws/iam_group_without_users/test/positive2/positive2_1.tf

@@ -0,0 +1,7 @@
+resource "aws_iam_group" "group2" {
+  name = "test-group"
+}
+
+resource "aws_iam_group" "group3" {
+  name = "test-group"
+}

assets/queries/terraform/aws/iam_group_without_users/test/positive2/positive2_2.tf

@@ -0,0 +1,27 @@
+resource "aws_iam_group_membership" "team2" {
+  name = "tf-testing-group-membership"
+
+  users = [
+    aws_iam_user.user_one2.name,
+    aws_iam_user.user_two2.name,
+  ]
+
+  group = aws_iam_group.group222.name
+}
+
+resource "aws_iam_user" "user_one2" {
+  name = "test-user"
+}
+
+resource "aws_iam_user" "user_two2" {
+  name = "test-user-two"
+}
+
+resource "aws_iam_group_membership" "team3" {
+  name = "tf-testing-group-membership"
+
+  users = [
+  ]
+
+  group = aws_iam_group.group3.name
+}

assets/queries/terraform/aws/iam_group_without_users/test/positive2/positive_expected_result.json

@@ -0,0 +1,14 @@
+[
+  {
+    "queryName": "IAM Group Without Users",
+    "severity": "MEDIUM",
+    "fileName": "positive2_1.tf",
+    "line": 1
+  },
+  {
+    "queryName": "IAM Group Without Users",
+    "severity": "MEDIUM",
+    "fileName": "positive2_1.tf",
+    "line": 5
+  }
+]

assets/queries/terraform/aws/iam_group_without_users/test/positive_expected_result.json

@@ -2,11 +2,13 @@
   {
     "queryName": "IAM Group Without Users",
     "severity": "MEDIUM",
+    "fileName": "positive.tf",
     "line": 12
   },
   {
     "queryName": "IAM Group Without Users",
     "severity": "MEDIUM",
+    "fileName": "positive.tf",
     "line": 33
   }
-]
+]

docs/queries.md

@@ -130,6 +130,50 @@ And the file tree should be as follows:
     |   |   |- query.rego
 ```
 
+##### Folder-Based Test Case (Optional)
+
+Test cases can optionally be organized into folders, which is useful when multiple resource files are needed for a single case.
+Each folder is treated as a single unit representing either a positive or a negative case. Positive cases must include their own `positive_expected_result.json` file containing the expected results.
+Other than the `positive_expected_result.json` file, every file inside the folder must start with the folder’s name.
+The file tree for a query can be extended to:
+```none
+- <technology>/
+    |- <provider>/
+    |    |- <queryfolder>/
+    |    |    |- test/
+    |    |    |    |- positive<.ext>
+    |    |    |    |- negative<.ext>
+    |    |    |    |- positive_expected_result.json
+    |    |    |    |- positive/ (= <folder_name>/)
+    |    |    |    |    |- <folder_name><.ext>
+    |    |    |    |    |- positive_expected_result.json
+    |    |    |    |- negative/ (= <folder_name>/)
+    |    |    |    |    |- <folder_name><.ext>
+    |    |    |- metadata.json
+    |    |    |- query.rego
+```
+
+A query containing all the cases could look like:
+```none
+- <technology>/
+    |- <provider>/
+    |    |- <queryfolder>/
+    |    |    |- test/
+    |    |    |    |- positive1<.ext>
+    |    |    |    |- positive2<.ext>
+    |    |    |    |- negative1<.ext>
+    |    |    |    |- negative2<.ext>
+    |    |    |    |- positive_expected_result.json
+    |    |    |    |- positive3/
+    |    |    |    |    |- positive3_1<.ext>
+    |    |    |    |    |- positive3_2<.ext>
+    |    |    |    |    |- positive_expected_result.json
+    |    |    |    |- negative3/
+    |    |    |    |    |- negative3_1<.ext>
+    |    |    |    |    |- negative3_2<.ext>
+    |    |    |- metadata.json
+    |    |    |- query.rego
+```
 
 #### Query Dependencies
 
@@ -155,4 +199,4 @@ Since the Password and Secrets mechanism uses generic regexes, we advise you to
 
 **Note**: KICS does not execute scan by default as of [version 1.3.0](https://github.com/Checkmarx/kics/releases/tag/v1.3.0).
 
-**Note**: KICS deprecated the availability of binaries in the GitHub releases assets as of [version 1.5.2](https://github.com/Checkmarx/kics/releases/tag/v1.5.2), it is advised to update all systems (pipelines, integrations, etc.) to use the [KICS Docker Images](https://hub.docker.com/r/checkmarx/kics).
+**Note**: KICS deprecated the availability of binaries in the GitHub releases assets as of [version 1.5.2](https://github.com/Checkmarx/kics/releases/tag/v1.5.2), it is advised to update all systems (pipelines, integrations, etc.) to use the [KICS Docker Images](https://hub.docker.com/r/checkmarx/kics).

go.mod

@@ -31,19 +31,19 @@ require (
 	github.com/rs/zerolog v1.34.0
 	github.com/sosedoff/ansible-vault-go v0.2.0
 	github.com/spf13/cobra v1.9.1
-	github.com/spf13/pflag v1.0.6
+	github.com/spf13/pflag v1.0.7
 	github.com/spf13/viper v1.20.1
 	github.com/stretchr/testify v1.10.0
 	github.com/tdewolff/minify/v2 v2.23.1
 	github.com/tidwall/gjson v1.18.0
 	github.com/xeipuuv/gojsonschema v1.2.0
 	github.com/yargevad/filepathx v1.0.0
 	github.com/zclconf/go-cty v1.16.2
-	golang.org/x/net v0.40.0
-	golang.org/x/text v0.26.0
-	golang.org/x/tools v0.33.0
+	golang.org/x/net v0.41.0
+	golang.org/x/text v0.27.0
+	golang.org/x/tools v0.34.0
 	gopkg.in/yaml.v3 v3.0.1
-	helm.sh/helm/v3 v3.18.4
+	helm.sh/helm/v3 v3.18.5
 	mvdan.cc/sh/v3 v3.11.0
 	sigs.k8s.io/controller-runtime v0.14.6
 )
@@ -93,6 +93,7 @@ require (
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sagikazarmark/locafero v0.7.0 // indirect
 	github.com/samber/lo v1.38.1 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/sourcegraph/conc v0.3.0 // indirect
 	github.com/tchap/go-patricia/v2 v2.3.2 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
@@ -107,6 +108,8 @@ require (
 	go.opentelemetry.io/otel/sdk/metric v1.35.0 // indirect
 	go.opentelemetry.io/otel/trace v1.35.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.3 // indirect
 	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
 	golang.org/x/mod v0.25.0 // indirect
 	google.golang.org/api v0.215.0 // indirect
@@ -211,29 +214,29 @@ require (
 	github.com/xlab/treeprint v1.2.0 // indirect
 	github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect
 	github.com/yashtewari/glob-intersection v0.2.0 // indirect
-	golang.org/x/crypto v0.39.0 // indirect
+	golang.org/x/crypto v0.40.0 // indirect
 	golang.org/x/oauth2 v0.28.0 // indirect
-	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.33.0 // indirect
-	golang.org/x/term v0.32.0 // indirect
+	golang.org/x/sync v0.16.0 // indirect
+	golang.org/x/sys v0.34.0 // indirect
+	golang.org/x/term v0.33.0 // indirect
 	golang.org/x/time v0.11.0 // indirect
 	google.golang.org/grpc v1.71.1 // indirect
 	google.golang.org/protobuf v1.36.6 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	k8s.io/api v0.33.2
-	k8s.io/apiextensions-apiserver v0.33.2 // indirect
-	k8s.io/apimachinery v0.33.2
-	k8s.io/apiserver v0.33.2 // indirect
-	k8s.io/cli-runtime v0.33.2 // indirect
-	k8s.io/client-go v0.33.2
-	k8s.io/component-base v0.33.2 // indirect
+	k8s.io/api v0.33.3
+	k8s.io/apiextensions-apiserver v0.33.3 // indirect
+	k8s.io/apimachinery v0.33.3
+	k8s.io/apiserver v0.33.3 // indirect
+	k8s.io/cli-runtime v0.33.3 // indirect
+	k8s.io/client-go v0.33.3
+	k8s.io/component-base v0.33.3 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
-	k8s.io/kubectl v0.33.2 // indirect
+	k8s.io/kubectl v0.33.3 // indirect
 	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
 	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
 	sigs.k8s.io/kustomize/api v0.19.0 // indirect
 	sigs.k8s.io/kustomize/kyaml v0.19.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	sigs.k8s.io/yaml v1.5.0 // indirect
 )