chore(tests): add testcases for #742 (#1134)

crates/zizmor/tests/integration/snapshots/integration__snapshot__unsound_condition.snap

@@ -1,8 +1,39 @@
 ---
 source: crates/zizmor/tests/integration/snapshot.rs
 expression: "zizmor().input(input_under_test(\"unsound-condition.yml\")).run()?"
-snapshot_kind: text
 ---
+help[obfuscation]: obfuscated usage of GitHub Actions features
+  --> @@INPUT@@:68:25
+   |
+68 |         if: true && ${{ false }}
+   |                         ----- help: can be replaced by its static evaluation
+   |
+   = note: audit confidence → High
+
+help[obfuscation]: obfuscated usage of GitHub Actions features
+  --> @@INPUT@@:73:17
+   |
+73 |         if: ${{ false }} && true
+   |                 ----- help: can be replaced by its static evaluation
+   |
+   = note: audit confidence → High
+
+help[obfuscation]: obfuscated usage of GitHub Actions features
+  --> @@INPUT@@:78:17
+   |
+78 |         if: ${{ false }} lol
+   |                 ----- help: can be replaced by its static evaluation
+   |
+   = note: audit confidence → High
+
+help[obfuscation]: obfuscated usage of GitHub Actions features
+  --> @@INPUT@@:83:21
+   |
+83 |         if: lol ${{ false }}
+   |                     ----- help: can be replaced by its static evaluation
+   |
+   = note: audit confidence → High
+
 error[unsound-condition]: unsound conditional expression
   --> @@INPUT@@:27:9
    |
@@ -32,4 +63,36 @@ error[unsound-condition]: unsound conditional expression
    |
    = note: audit confidence → High
 
-3 findings: 0 unknown, 0 informational, 0 low, 0 medium, 3 high
+error[unsound-condition]: unsound conditional expression
+  --> @@INPUT@@:68:9
+   |
+68 |         if: true && ${{ false }}
+   |         ^^^^^^^^^^^^^^^^^^^^^^^^ condition always evaluates to true
+   |
+   = note: audit confidence → High
+
+error[unsound-condition]: unsound conditional expression
+  --> @@INPUT@@:73:9
+   |
+73 |         if: ${{ false }} && true
+   |         ^^^^^^^^^^^^^^^^^^^^^^^^ condition always evaluates to true
+   |
+   = note: audit confidence → High
+
+error[unsound-condition]: unsound conditional expression
+  --> @@INPUT@@:78:9
+   |
+78 |         if: ${{ false }} lol
+   |         ^^^^^^^^^^^^^^^^^^^^ condition always evaluates to true
+   |
+   = note: audit confidence → High
+
+error[unsound-condition]: unsound conditional expression
+  --> @@INPUT@@:83:9
+   |
+83 |         if: lol ${{ false }}
+   |         ^^^^^^^^^^^^^^^^^^^^ condition always evaluates to true
+   |
+   = note: audit confidence → High
+
+11 findings: 0 unknown, 0 informational, 4 low, 0 medium, 7 high

crates/zizmor/tests/integration/test-data/unsound-condition.yml

@@ -62,3 +62,23 @@ jobs:
             && other.context
           }}
         run: echo not ok
+
+      - name: 10-not-ok
+        # NOT OK: evaluates to true because of stringification
+        if: true && ${{ false }}
+        run: echo not ok
+
+      - name: 11-not-ok
+        # NOT OK: evaluates to true because of stringification
+        if: ${{ false }} && true
+        run: echo not ok
+
+      - name: 12-not-ok
+        # NOT OK: evaluates to true because of stringification
+        if: ${{ false }} lol
+        run: echo not ok
+
+      - name: 13-not-ok
+        # NOT OK: evaluates to true because of stringification
+        if: lol ${{ false }}
+        run: echo not ok