From 08e59363b6410f1701c9902858b3c0149556ff10 Mon Sep 17 00:00:00 2001
From: Andrew Kroh <andrew.kroh@elastic.co>
Date: Tue, 19 Mar 2024 15:53:53 -0400
Subject: [PATCH] auditbeat - skip TestExeObjParser on CI (#38441)

TestExeObjParser fails on Windows because Defender is removing the
testdata that is required by the test. This adds a conditional test
skip for CI when those files are missing.

Closes #38211
---
 auditbeat/module/file_integrity/exeobjparser_test.go | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/auditbeat/module/file_integrity/exeobjparser_test.go b/auditbeat/module/file_integrity/exeobjparser_test.go
index 0958305afb8..f8ca144e4ed 100644
--- a/auditbeat/module/file_integrity/exeobjparser_test.go
+++ b/auditbeat/module/file_integrity/exeobjparser_test.go
@@ -19,8 +19,11 @@
 package file_integrity
 
 import (
+	"errors"
 	"fmt"
+	"io/fs"
 	"math"
+	"os"
 	"reflect"
 	"strconv"
 	"testing"
@@ -44,6 +47,12 @@ func TestExeObjParser(t *testing.T) {
 					t.Skip("skipping test on garbled PE file: see https://github.com/elastic/beats/issues/35705")
 				}
 
+				if _, ci := os.LookupEnv("CI"); ci {
+					if _, err := os.Stat(target); err != nil && errors.Is(fs.ErrNotExist, err) {
+						t.Skip("skipping test because target binary was not found: see https://github.com/elastic/beats/issues/38211")
+					}
+				}
+
 				got := make(mapstr.M)
 				err := exeObjParser(nil).Parse(got, target)
 				if err != nil {