Add test with positive outcome

Signed-off-by: David Korczynski <[email protected]>

checks/evaluation/sast.go

@@ -79,6 +79,12 @@ func SAST(name string,
 		// retun checker.InconclusiveResultScore.
 		return checker.CreateRuntimeErrorResult(name, sce.ErrScorecardInternal)
 	}
+	// Sast inconclusive.
+	if snykScore != checker.InconclusiveResultScore {
+		if snykScore == checker.MaxResultScore {
+			return checker.CreateMaxScoreResult(name, "SAST tool detected: Snyk")
+		}
+	}
 
 	// Both scores are conclusive.
 	// We assume the CodeQl config uses a cron and is not enabled as pre-submit.
@@ -106,13 +112,6 @@ func SAST(name string,
 		}
 	}
 
-	// Sast inconclusive.
-	if snykScore != checker.InconclusiveResultScore {
-		if snykScore == checker.MaxResultScore {
-			return checker.CreateMaxScoreResult(name, "SAST tool detected: Snyk")
-		}
-	}
-
 	if codeQlScore != checker.InconclusiveResultScore {
 		if codeQlScore == checker.MaxResultScore {
 			return checker.CreateMaxScoreResult(name, "SAST tool detected: CodeQL")

checks/evaluation/sast_test.go

@@ -155,6 +155,36 @@ func TestSAST(t *testing.T) {
 				NumberOfInfo: 0,
 			},
 		},
+		{
+			name: "Snyk is installed, Sonar and CodeQL are not installed",
+			findings: []finding.Finding{
+				{
+					Probe:   "sastToolCodeQLInstalled",
+					Outcome: finding.OutcomeNegative,
+				},
+				{
+					Probe:   "sastToolSnykInstalled",
+					Outcome: finding.OutcomePositive,
+				},
+				{
+					Probe:   "sastToolRunsOnAllCommits",
+					Outcome: finding.OutcomePositive,
+					Values: map[string]int{
+						"totalPullRequestsAnalyzed": 1,
+						"totalPullRequestsMerged":   3,
+					},
+				},
+				{
+					Probe:   "sastToolSonarInstalled",
+					Outcome: finding.OutcomeNegative,
+				},
+			},
+			result: scut.TestReturn{
+				Score:        10,
+				NumberOfWarn: 1,
+				NumberOfInfo: 2,
+			},
+		},
 	}
 	for _, tt := range tests {
 		tt := tt