refactor(fixhandler): sanitize YAML inside ApplyFixToContent

External observers don’t need to be aware of the fact we need to
sanitize leading document separators in YAML files. This should be
hidden inside our public function - `ApplyFixToContent()`.

Signed-off-by: Vlad Klokun <vklokun@protonmail.ch>

core/pkg/fixhandler/fixhandler.go

@@ -208,8 +208,6 @@ func (h *FixHandler) ApplyChanges(ctx context.Context, resourcesToFix []Resource
 			continue
 		}
 
-		fileAsString = sanitizeYaml(fileAsString)
-
 		fixedYamlString, err := ApplyFixToContent(ctx, fileAsString, yamlExpression)
 
 		if err != nil {
@@ -219,8 +217,6 @@ func (h *FixHandler) ApplyChanges(ctx context.Context, resourcesToFix []Resource
 			updatedFiles[filepath] = true
 		}
 
-		fixedYamlString = revertSanitizeYaml(fixedYamlString)
-
 		err = writeFixesToFile(filepath, fixedYamlString)
 
 		if err != nil {
@@ -247,6 +243,7 @@ func (h *FixHandler) getFilePathAndIndex(filePathWithIndex string) (filePath str
 }
 
 func ApplyFixToContent(ctx context.Context, yamlAsString, yamlExpression string) (fixedString string, err error) {
+	yamlAsString = sanitizeYaml(yamlAsString)
 	newline := determineNewlineSeparator(yamlAsString)
 
 	yamlLines := strings.Split(yamlAsString, newline)
@@ -268,6 +265,7 @@ func ApplyFixToContent(ctx context.Context, yamlAsString, yamlExpression string)
 	fixedYamlLines := getFixedYamlLines(yamlLines, fixInfo, newline)
 
 	fixedString = getStringFromSlice(fixedYamlLines, newline)
+	fixedString = revertSanitizeYaml(fixedString)
 
 	return fixedString, nil
 }

core/pkg/fixhandler/fixhandler_test.go

@@ -169,6 +169,12 @@ func getTestCases() []indentationTestCase {
 			 select(di==0).spec.securityContext.runAsRoot |= false`,
 			"hybrids/tc-04-01-expected.yaml",
 		},
+		{
+			"hybrids/tc-05-00-input-leading-doc-separator.yaml",
+			`del(select(di==0).spec.containers[0].securityContext) |
+			 select(di==0).spec.securityContext.runAsRoot |= false`,
+			"hybrids/tc-05-01-expected.yaml",
+		},
 	}
 
 	return indentationTestCases
@@ -196,9 +202,8 @@ func TestApplyFixKeepsFormatting(t *testing.T) {
 			want := string(wantRaw)
 			expression := tc.yamlExpression
 
-			fileAsString := sanitizeYaml(string(input))
-			fixedYamlString, _ := ApplyFixToContent(context.TODO(), fileAsString, expression)
-			got := revertSanitizeYaml(fixedYamlString)
+			fileAsString := string(input)
+			got, _ := ApplyFixToContent(context.TODO(), fileAsString, expression)
 
 			assert.Equalf(
 				t, want, got,
@@ -288,9 +293,8 @@ func Test_sanitizeYaml(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if got := sanitizeYaml(tt.args.fileAsString); got != tt.want {
-				t.Errorf("sanitizeYaml() = %v, want %v", got, tt.want)
-			}
+			got := sanitizeYaml(tt.args.fileAsString)
+			assert.Equal(t, tt.want, got)
 		})
 	}
 }
@@ -321,9 +325,8 @@ func Test_revertSanitizeYaml(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if got := revertSanitizeYaml(tt.args.fixedYamlString); got != tt.want {
-				t.Errorf("revertSanitizeYaml() = %v, want %v", got, tt.want)
-			}
+			got := revertSanitizeYaml(tt.args.fixedYamlString)
+			assert.Equal(t, tt.want, got)
 		})
 	}
 }

core/pkg/fixhandler/testdata/hybrids/tc-05-00-input-leading-doc-separator.yaml

@@ -0,0 +1,22 @@
+# Fix to Apply:
+# REMOVE:
+# "del(select(di==0).spec.containers[0].securityContext)"
+
+# INSERT:
+# select(di==0).spec.securityContext.runAsRoot: false
+
+
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: insert_to_mapping_node_1
+
+spec:
+  containers:
+    - name: nginx_container
+
+      image: nginx
+
+      securityContext:
+        runAsRoot: true

core/pkg/fixhandler/testdata/hybrids/tc-05-01-expected.yaml

@@ -0,0 +1,22 @@
+# Fix to Apply:
+# REMOVE:
+# "del(select(di==0).spec.containers[0].securityContext)"
+
+# INSERT:
+# select(di==0).spec.securityContext.runAsRoot: false
+
+
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: insert_to_mapping_node_1
+
+spec:
+  containers:
+    - name: nginx_container
+
+      image: nginx
+  securityContext:
+    runAsRoot: false
+