[9.5](backport #7424) fix(azure): drive Resource Graph pagination by SkipToken, not ResultTruncated - #7688
Open
mergify[bot] wants to merge 1 commit into
Open
[9.5](backport #7424) fix(azure): drive Resource Graph pagination by SkipToken, not ResultTruncated#7688mergify[bot] wants to merge 1 commit into
mergify[bot] wants to merge 1 commit into
Conversation
…runcated (#7424) ## Summary Most Azure subscriptions in CSPM scans were showing only subscription-level findings, with zero resource-level findings (storage accounts, VMs, key vaults, etc.). Root cause: cloudbeat's Azure Resource Graph (ARG) pagination loop stopped after the first page of results on every real-world query, silently dropping resources per scan cycle. ## Root cause In `internal/resources/providers/azurelib/inventory/resource_graph_provider.go`, `runPaginatedQuery` broke out of its pagination loop whenever `response.ResultTruncated == false`. That flag does not mean "no more pages" — per Microsoft's Resource Graph pagination contract, `SkipToken` presence/absence is the only reliable continuation signal. In practice, ordinary paginated ARG responses report `ResultTruncated: false` even when a valid `SkipToken` for the next page is present, so the loop always exited after page 1. ## Fix Pagination now continues based solely on whether `SkipToken` is empty, matching Microsoft's reference pagination pattern, instead of trusting `ResultTruncated`. ## Regression test Added a test in `internal/resources/providers/azurelib/inventory/resource_graph_provider_test.go` that mocks a 3-page ARG response sequence where every page reports `ResultTruncated: false` but carries a `SkipToken` until the final page. It fails against the pre-fix code (only page 1's asset is returned) and passes with the fix. (cherry picked from commit 100ef56)
jeniawhite
approved these changes
Aug 6, 2026
jeniawhite
enabled auto-merge (squash)
August 6, 2026 18:57
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Most Azure subscriptions in CSPM scans were showing only subscription-level findings, with zero resource-level findings (storage accounts, VMs, key vaults, etc.). Root cause: cloudbeat's Azure Resource Graph (ARG) pagination loop stopped after the first page of results on every real-world query, silently dropping resources per scan cycle.
Root cause
In
internal/resources/providers/azurelib/inventory/resource_graph_provider.go,runPaginatedQuerybroke out of its pagination loop wheneverresponse.ResultTruncated == false. That flag does not mean "no more pages" — per Microsoft's Resource Graph pagination contract,SkipTokenpresence/absence is the only reliable continuation signal. In practice, ordinary paginated ARG responses reportResultTruncated: falseeven when a validSkipTokenfor the next page is present, so the loop always exited after page 1.Fix
Pagination now continues based solely on whether
SkipTokenis empty, matching Microsoft's reference pagination pattern, instead of trustingResultTruncated.Regression test
Added a test in
internal/resources/providers/azurelib/inventory/resource_graph_provider_test.gothat mocks a 3-page ARG response sequence where every page reportsResultTruncated: falsebut carries aSkipTokenuntil the final page. It fails against the pre-fix code (only page 1's asset is returned) and passes with the fix.This is an automatic backport of pull request #7424 done by Mergify.