Component Tests and Supply Chain⚓︎
Every component of the Expeto Platform is tested in isolation in its own repository before it reaches the platform end-to-end suites, and every image and chart that ships is checked for provenance and known vulnerabilities. This page summarizes those layers.
Component tests⚓︎
| Component | Test suite | Runs |
|---|---|---|
| xControl services (API, agent protocol, data model, reporting) | More than 400 JUnit test classes across the service modules. The database suite runs against a real PostgreSQL 17 instance in the pipeline, so schema migrations and queries are exercised against the database the platform ships with. | Every merge request; JUnit reports published |
| xControl front end | Unit tests (Vitest) of the portal's components and state, a TypeScript type check and a lint pass | Every merge request |
| Session management function (SMF, SGW-C and PGW-C) | About 90 test classes covering session establishment, modification and release, rule evaluation, PFCP handling and persistence | Every merge request |
| Kubernetes operator for the core (the controller that reconciles a declarative Site into a running core) | More than 600 Go test functions in 83 files: reconciler tests that drive a full reconcile against a fake API server, admission validation, network configuration rendering, BGP resources, preflight checks and the certification harness itself. The suite is deterministic by rule: a flake is treated as a defect. | Every merge request |
| Network functions (AMF, MME, HSS, UDM, UDR, AUSF, UPF and the supporting services) | Built and packaged by the shared pipelines, then exercised end to end by the platform suites and release certification. | Every merge request in the owning repository |
Supply chain⚓︎
| Check | What it verifies | When |
|---|---|---|
| Image provenance | Every container in every managed namespace of a platform-suite run comes from the Expeto registry, is tagged with the chart version, and uses imagePullPolicy: IfNotPresent; third-party images are on an explicit allow-list |
Every platform suite run |
| Vulnerability scanning | Trivy scans every managed namespace for HIGH and CRITICAL findings and publishes JSON, table, HTML and JUnit reports | Every platform suite run on the default Kubernetes version |
| Software bill of materials | A CycloneDX bill of materials is produced for the Java components, for every image the rendered charts reference, and for the charts themselves, and uploaded to Expeto's Dependency-Track instance where it is tracked against vulnerability feeds | Every release tag |
| Chart rendering | The charts are rendered with helm template against the supported Kubernetes API versions as part of the bill-of-materials pipeline, and rendered twice with identical arguments in the platform suites to detect non-deterministic templates |
Every release tag; every platform suite run |
| Image availability | Every image in the operator's image catalog is confirmed to exist in the registry with a manifest inspection before certification | Before a release |
MNOs who require the bill of materials or the vulnerability report for a release can request them through their Expeto account team.