[cristim]

Summary

Repairs two pre-commit failures on main that block every PR.

1. gocyclo (closes #1222) — the CI blocker

recEffectiveSavingsPct had cyclomatic complexity 12, above the pre-commit gocyclo -over 10 threshold, so the "Run pre-commit hooks" CI job failed on every PR regardless of what it touched (the hook scans all non-test .go files). Extracted the on-demand baseline derivation into a new helper recOnDemandBaseline, bringing both functions under the threshold.

Behavior is identical — the helper returns the same (baseline, ok) for every input branch (explicit OnDemandCost, monthly_cost reconstruction, the AWS-without-baseline and no-monthly_cost guards), so the net-savings semantics from #1103/#1148 are unchanged.

2. trivy DS-0002 on Dockerfile.test

Newer trivy (>=0.70.0) flags Dockerfile.test (the ephemeral docker-compose E2E test-runner) for running as root; CI pins trivy v0.69.3 which doesn't report it, so the hook was clean on CI but failed for contributors on a newer local trivy. Rather than suppress the finding, the test image now runs as a dedicated non-root e2e user, with GOCACHE in its home so both the build-time pre-compile and the runtime go test run unprivileged. tests/e2e is stdlib-only, so no module downloads are needed.

Testing

• gocyclo -over 10 internal/config/store_postgres_recommendations.go -> clean
• trivy config --severity HIGH,CRITICAL --exit-code 1 ... . -> exit 0
• go build ./... -> ok; go test ./internal/config/ -> ok
• docker build -f Dockerfile.test . -> go vet + go test run cleanly as non-root e2e

Unblocks the QA-sheet fix PRs (#1247, #1248, #1251, #1249/#1250, #1252) which stack on this branch.

Summary by CodeRabbit

• Tests

  • Enhanced test container security by configuring tests to run with non-root user privileges.

• Refactor

  • Improved internal recommendation cost calculation logic for better code organization.

[cristim]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 572281f6-c2b5-4214-a023-7d90abe98456

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The E2E test Dockerfile is updated to run as a non-root e2e user (UID 10001) with GOCACHE set under that user's home directory. In store_postgres_recommendations.go, on-demand baseline computation is extracted from recEffectiveSavingsPct into a new recOnDemandBaseline helper function.

Changes

Non-root E2E Container

Layer / File(s)	Summary
Non-root user setup Dockerfile.test	Creates e2e user (UID 10001), sets GOCACHE to a path under that user's home, copies tests/e2e/ with --chown=e2e:e2e, and switches the runtime user to e2e, replacing the previous root-oriented WORKDIR and plain COPY.

On-demand Baseline Extraction

Layer / File(s)	Summary
recOnDemandBaseline helper and updated caller internal/config/store_postgres_recommendations.go	Introduces recOnDemandBaseline returning (onDemand, ok), preferring provider OnDemandCost when positive, otherwise reconstructing from MonthlyCost + Savings + amortized UpfrontCost, and rejecting missing MonthlyCost or AWS without an explicit baseline. recEffectiveSavingsPct delegates to this helper and guards against a zero baseline.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related issues

• Main pre-commit broken: gocyclo complexity 12 in recEffectiveSavingsPct #1222: The extraction of recOnDemandBaseline from recEffectiveSavingsPct directly reduces cyclomatic complexity, addressing the reported gocyclo threshold violation.

Possibly related PRs

• LeanerCloud/CUDly#1206: Directly modifies recEffectiveSavingsPct baseline reconstruction logic and pct calculation semantics in the same file, making it closely related to this refactor.

Suggested labels

urgency/this-sprint, effort/s

Poem

🐇 Hop, hop! No root for me,
I run as e2e — safe and free!
The baseline helper stands apart,
Each function now plays just one part.
Clean code, clean cache, clean container too —
A rabbit's tidy work, through and through! 🥕

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the two main fixes: gocyclo complexity reduction for recEffectiveSavingsPct (issue #1222) and Dockerfile.test non-root user setup, accurately summarizing the primary changes.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/1222-precommit-repair

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}