Include enforcement date in warnings for future effective_on violations

features/__snapshots__/validate_image.snap

@@ -357,7 +357,7 @@ Error: success criteria not met
       "source": {},
       "warnings": [
         {
-          "msg": "Fails in 2099",
+          "msg": "Fails in 2099. This will become a failure starting on ${TIMESTAMP}",
           "metadata": {
             "effective_on": "${TIMESTAMP}"
           }
@@ -1407,7 +1407,7 @@ Error: no suitable config file found at git::${GITHOST}/git/happy-config.git?ref
       "source": {},
       "violations": [
         {
-          "msg": "Fails in 2099",
+          "msg": "Fails in 2099. This will become a failure starting on ${TIMESTAMP}",
           "metadata": {
             "effective_on": "${TIMESTAMP}"
           }
@@ -2011,7 +2011,7 @@ For more information about policy issues, see the policy documentation: https://
       "source": {},
       "violations": [
         {
-          "msg": "Fails in 2099",
+          "msg": "Fails in 2099. This will become a failure starting on ${TIMESTAMP}",
           "metadata": {
             "effective_on": "${TIMESTAMP}"
           }

internal/evaluator/conftest_evaluator_unit_core_test.go

@@ -221,7 +221,7 @@ func TestConftestEvaluatorEvaluateSeverity(t *testing.T) {
 				},
 
 				{
-					Message: "not yet effective",
+					Message: "not yet effective. This will become a failure starting on 3021-01-01T00:00:00Z",
 					Metadata: map[string]any{
 						"effective_on": "3021-01-01T00:00:00Z",
 					},

internal/evaluator/filters.go

@@ -996,7 +996,10 @@ func (f *LegacyPostEvaluationFilter) CategorizeResults(
 				warnings = append(warnings, result)
 			}
 		case "failure":
-			if getSeverity(result) == severityWarning || !isResultEffective(result, effectiveTime) {
+			if getSeverity(result) == severityWarning {
+				warnings = append(warnings, result)
+			} else if !isResultEffective(result, effectiveTime) {
+				result.Message = formatFutureEnforcementMessage(result)
 				warnings = append(warnings, result)
 			} else {
 				failures = append(failures, result)
@@ -1119,7 +1122,10 @@ func (f *UnifiedPostEvaluationFilter) CategorizeResults(
 				warnings = append(warnings, filteredResult)
 			}
 		case "failure":
-			if getSeverity(filteredResult) == severityWarning || !isResultEffective(filteredResult, effectiveTime) {
+			if getSeverity(filteredResult) == severityWarning {
+				warnings = append(warnings, filteredResult)
+			} else if !isResultEffective(filteredResult, effectiveTime) {
+				filteredResult.Message = formatFutureEnforcementMessage(filteredResult)
 				warnings = append(warnings, filteredResult)
 			} else {
 				failures = append(failures, filteredResult)
@@ -1204,3 +1210,21 @@ func (f *UnifiedPostEvaluationFilter) determineOriginalType(filteredResult Resul
 
 	return "unknown"
 }
+
+// formatFutureEnforcementMessage enhances a result message to indicate when
+// a future effective_on date will cause enforcement to begin.
+// Returns the enhanced message if effective_on is present, otherwise returns
+// the original message unchanged.
+func formatFutureEnforcementMessage(result Result) string {
+	originalMessage := result.Message
+
+	// Check if this result has an effective_on date
+	effectiveOnStr, ok := result.Metadata[metadataEffectiveOn].(string)
+	if !ok || effectiveOnStr == "" {
+		return originalMessage
+	}
+
+	// Append enforcement notice with the effective_on date as-is
+	return fmt.Sprintf("%s. This will become a failure starting on %s",
+		strings.TrimSuffix(originalMessage, "."), effectiveOnStr)
+}

internal/evaluator/filters_test.go

@@ -1796,3 +1796,79 @@ func TestPipelineIntentionWithMultipleValues(t *testing.T) {
 			"security package should be included (has included rules)")
 	})
 }
+
+//////////////////////////////////////////////////////////////////////////////
+// formatFutureEnforcementMessage tests
+//////////////////////////////////////////////////////////////////////////////
+
+func TestFormatFutureEnforcementMessage(t *testing.T) {
+	tests := []struct {
+		name     string
+		result   Result
+		expected string
+	}{
+		{
+			name: "with effective_on string",
+			result: Result{
+				Message: "The required 'cpe' label is missing",
+				Metadata: map[string]interface{}{
+					metadataEffectiveOn: "2024-12-01T00:00:00Z",
+				},
+			},
+			expected: "The required 'cpe' label is missing. This will become a failure starting on 2024-12-01T00:00:00Z",
+		},
+		{
+			name: "missing effective_on metadata",
+			result: Result{
+				Message:  "Some error message",
+				Metadata: map[string]interface{}{},
+			},
+			expected: "Some error message",
+		},
+		{
+			name: "non-string effective_on",
+			result: Result{
+				Message: "Some error message",
+				Metadata: map[string]interface{}{
+					metadataEffectiveOn: 12345,
+				},
+			},
+			expected: "Some error message",
+		},
+		{
+			name: "empty string effective_on",
+			result: Result{
+				Message: "Some error message",
+				Metadata: map[string]interface{}{
+					metadataEffectiveOn: "",
+				},
+			},
+			expected: "Some error message",
+		},
+		{
+			name: "nil metadata",
+			result: Result{
+				Message:  "Some error message",
+				Metadata: nil,
+			},
+			expected: "Some error message",
+		},
+		{
+			name: "message already ends with period",
+			result: Result{
+				Message: "The required 'cpe' label is missing.",
+				Metadata: map[string]interface{}{
+					metadataEffectiveOn: "2025-01-15T00:00:00Z",
+				},
+			},
+			expected: "The required 'cpe' label is missing. This will become a failure starting on 2025-01-15T00:00:00Z",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := formatFutureEnforcementMessage(tc.result)
+			assert.Equal(t, tc.expected, got)
+		})
+	}
+}