From 404dccaa28ea878caa7e25d72eb8bc1dc0afac00 Mon Sep 17 00:00:00 2001
From: Fabio Bonelli <fb@fabiobonelli.it>
Date: Mon, 9 Nov 2026 19:11:26 +0000
Subject: [PATCH 1/3] test: cover external validation checks

---
 main_test.go | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/main_test.go b/main_test.go
index 47d6c7a..67110dc 100644
--- a/main_test.go
+++ b/main_test.go
@@ -5,6 +5,7 @@ import (
 	"io"
 	"log"
 	"net/http"
+	"net/http/httptest"
 	"net/url"
 	"os"
 	"strings"
@@ -133,6 +134,14 @@ func TestApi(t *testing.T) {
 func TestValidateEndpoint(t *testing.T) {
 	validYml := loadTestdata(t, "valid.publiccode.yml")
 	invalidYml := loadTestdata(t, "invalid.publiccode.yml")
+	externalChecksServer := httptest.NewServer(http.NotFoundHandler())
+	t.Cleanup(externalChecksServer.Close)
+	externalChecksYml := strings.Replace(
+		validYml,
+		"https://github.com/italia/developers.italia.it.git",
+		externalChecksServer.URL+"/repository.git",
+		1,
+	)
 
 	tests := []TestCase{
 		{
@@ -167,6 +176,31 @@ func TestValidateEndpoint(t *testing.T) {
 				assert.NotNil(t, response["normalized"])
 			},
 		},
+		{
+			description:         "validate: external checks disabled",
+			query:               "QUERY /v1/validate",
+			body:                externalChecksYml,
+			expectedCode:        200,
+			expectedContentType: "application/json; charset=utf-8",
+			validateFunc: func(t *testing.T, response map[string]any) {
+				assert.Equal(t, true, response["valid"])
+				assert.Empty(t, response["results"])
+			},
+		},
+		{
+			description:         "validate: external checks enabled",
+			query:               "QUERY /v1/validate?external-checks=true",
+			body:                externalChecksYml,
+			expectedCode:        200,
+			expectedContentType: "application/json; charset=utf-8",
+			validateFunc: func(t *testing.T, response map[string]any) {
+				assert.Equal(t, false, response["valid"])
+				results, ok := response["results"].([]any)
+				assert.True(t, ok)
+				assert.NotEmpty(t, results)
+				assert.Nil(t, response["normalized"])
+			},
+		},
 		{
 			description:         "validate: invalid file",
 			query:               "QUERY /v1/validate",

From 86603918c16da6b81257e4e8d095af0c02aa3fcb Mon Sep 17 00:00:00 2001
From: Fabio Bonelli <fb@fabiobonelli.it>
Date: Mon, 9 Nov 2026 20:39:15 +0000
Subject: [PATCH 2/3] test: assert external validation guard

---
 main_test.go | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/main_test.go b/main_test.go
index 67110dc..ce447c6 100644
--- a/main_test.go
+++ b/main_test.go
@@ -2,10 +2,10 @@ package main
 
 import (
 	"encoding/json"
+	"fmt"
 	"io"
 	"log"
 	"net/http"
-	"net/http/httptest"
 	"net/url"
 	"os"
 	"strings"
@@ -134,12 +134,10 @@ func TestApi(t *testing.T) {
 func TestValidateEndpoint(t *testing.T) {
 	validYml := loadTestdata(t, "valid.publiccode.yml")
 	invalidYml := loadTestdata(t, "invalid.publiccode.yml")
-	externalChecksServer := httptest.NewServer(http.NotFoundHandler())
-	t.Cleanup(externalChecksServer.Close)
 	externalChecksYml := strings.Replace(
 		validYml,
 		"https://github.com/italia/developers.italia.it.git",
-		externalChecksServer.URL+"/repository.git",
+		"http://127.0.0.1/repository.git",
 		1,
 	)
 
@@ -198,6 +196,7 @@ func TestValidateEndpoint(t *testing.T) {
 				results, ok := response["results"].([]any)
 				assert.True(t, ok)
 				assert.NotEmpty(t, results)
+				assert.Contains(t, fmt.Sprint(results), "non-public")
 				assert.Nil(t, response["normalized"])
 			},
 		},

From 86642839fdd7a2f24cdbe81c073d533873aa89ee Mon Sep 17 00:00:00 2001
From: Fabio Bonelli <fb@fabiobonelli.it>
Date: Thu, 12 Nov 2026 16:26:47 +0000
Subject: [PATCH 3/3] test: use generic repository URLs in fixtures

---
 main_test.go                    | 2 +-
 testdata/invalid.publiccode.yml | 2 +-
 testdata/valid.publiccode.yml   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/main_test.go b/main_test.go
index ce447c6..d1a8b68 100644
--- a/main_test.go
+++ b/main_test.go
@@ -136,7 +136,7 @@ func TestValidateEndpoint(t *testing.T) {
 	invalidYml := loadTestdata(t, "invalid.publiccode.yml")
 	externalChecksYml := strings.Replace(
 		validYml,
-		"https://github.com/italia/developers.italia.it.git",
+		"https://github.com/example/project.git",
 		"http://127.0.0.1/repository.git",
 		1,
 	)
diff --git a/testdata/invalid.publiccode.yml b/testdata/invalid.publiccode.yml
index 63daa3c..c050635 100644
--- a/testdata/invalid.publiccode.yml
+++ b/testdata/invalid.publiccode.yml
@@ -1,7 +1,7 @@
 publiccodeYmlVersion: "0"
 
 name: Medusa
-url: "https://github.com/italia/developers.italia.it.git"
+url: "https://github.com/example/project.git"
 
 platforms:
   - web
diff --git a/testdata/valid.publiccode.yml b/testdata/valid.publiccode.yml
index 712ebe3..f197344 100644
--- a/testdata/valid.publiccode.yml
+++ b/testdata/valid.publiccode.yml
@@ -1,7 +1,7 @@
 publiccodeYmlVersion: "0"
 
 name: Medusa
-url: "https://github.com/italia/developers.italia.it.git"
+url: "https://github.com/example/project.git"
 
 platforms:
   - web