Skip to content

[9.5](backport #7424) fix(azure): drive Resource Graph pagination by SkipToken, not ResultTruncated - #7688

Open
mergify[bot] wants to merge 1 commit into
9.5from
mergify/bp/9.5/pr-7424
Open

[9.5](backport #7424) fix(azure): drive Resource Graph pagination by SkipToken, not ResultTruncated#7688
mergify[bot] wants to merge 1 commit into
9.5from
mergify/bp/9.5/pr-7424

Conversation

@mergify

@mergify mergify Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Summary

Most Azure subscriptions in CSPM scans were showing only subscription-level findings, with zero resource-level findings (storage accounts, VMs, key vaults, etc.). Root cause: cloudbeat's Azure Resource Graph (ARG) pagination loop stopped after the first page of results on every real-world query, silently dropping resources per scan cycle.

Root cause

In internal/resources/providers/azurelib/inventory/resource_graph_provider.go, runPaginatedQuery broke out of its pagination loop whenever response.ResultTruncated == false. That flag does not mean "no more pages" — per Microsoft's Resource Graph pagination contract, SkipToken presence/absence is the only reliable continuation signal. In practice, ordinary paginated ARG responses report ResultTruncated: false even when a valid SkipToken for the next page is present, so the loop always exited after page 1.

Fix

Pagination now continues based solely on whether SkipToken is empty, matching Microsoft's reference pagination pattern, instead of trusting ResultTruncated.

Regression test

Added a test in internal/resources/providers/azurelib/inventory/resource_graph_provider_test.go that mocks a 3-page ARG response sequence where every page reports ResultTruncated: false but carries a SkipToken until the final page. It fails against the pre-fix code (only page 1's asset is returned) and passes with the fix.


This is an automatic backport of pull request #7424 done by Mergify.

…runcated (#7424)

## Summary

Most Azure subscriptions in CSPM scans were showing only
subscription-level findings, with zero resource-level findings (storage
accounts, VMs, key vaults, etc.). Root cause: cloudbeat's Azure Resource
Graph (ARG) pagination loop stopped after the first page of results on
every real-world query, silently dropping resources per scan cycle.

## Root cause

In
`internal/resources/providers/azurelib/inventory/resource_graph_provider.go`,
`runPaginatedQuery` broke out of its pagination loop whenever
`response.ResultTruncated == false`. That flag does not mean "no more
pages" — per Microsoft's Resource Graph pagination contract, `SkipToken`
presence/absence is the only reliable continuation signal. In practice,
ordinary paginated ARG responses report `ResultTruncated: false` even
when a valid `SkipToken` for the next page is present, so the loop
always exited after page 1.

## Fix

Pagination now continues based solely on whether `SkipToken` is empty,
matching Microsoft's reference pagination pattern, instead of trusting
`ResultTruncated`.

## Regression test

Added a test in
`internal/resources/providers/azurelib/inventory/resource_graph_provider_test.go`
that mocks a 3-page ARG response sequence where every page reports
`ResultTruncated: false` but carries a `SkipToken` until the final page.
It fails against the pre-fix code (only page 1's asset is returned) and
passes with the fix.

(cherry picked from commit 100ef56)
@mergify mergify Bot added the backport label Aug 6, 2026
@mergify
mergify Bot requested a review from a team as a code owner August 6, 2026 15:58
@mergify mergify Bot added the backport label Aug 6, 2026
@jeniawhite
jeniawhite enabled auto-merge (squash) August 6, 2026 18:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant