elastic / cloudbeat / 29962583692

76%

Build Type

push

github

Committed by web-flow

Commit Message

fix(azure): drive Resource Graph pagination by SkipToken, not ResultTruncated (#7424)

## Summary

Most Azure subscriptions in CSPM scans were showing only
subscription-level findings, with zero resource-level findings (storage
accounts, VMs, key vaults, etc.). Root cause: cloudbeat's Azure Resource
Graph (ARG) pagination loop stopped after the first page of results on
every real-world query, silently dropping resources per scan cycle.

## Root cause

In
`internal/resources/providers/azurelib/inventory/resource_graph_provider.go`,
`runPaginatedQuery` broke out of its pagination loop whenever
`response.ResultTruncated == false`. That flag does not mean "no more
pages" — per Microsoft's Resource Graph pagination contract, `SkipToken`
presence/absence is the only reliable continuation signal. In practice,
ordinary paginated ARG responses report `ResultTruncated: false` even
when a valid `SkipToken` for the next page is present, so the loop
always exited after page 1.

## Fix

Pagination now continues based solely on whether `SkipToken` is empty,
matching Microsoft's reference pagination pattern, instead of trusting
`ResultTruncated`.

## Regression test

Added a test in
`internal/resources/providers/azurelib/inventory/resource_graph_provider_test.go`
that mocks a 3-page ARG response sequence where every page reports
`ResultTruncated: false` but carries a `SkipToken` until the final page.
It fails against the pre-fix code (only page 1's asset is returned) and
passes with the fix.

Coverage Stats

3 of 3 new or added lines in 1 file covered. (100.0%)

2 existing lines in 1 file now uncovered.

10205 of 13409 relevant lines covered (76.11%)

15.91 hits per line