Initial commit

tests/test_common_paths_extras.py

@@ -0,0 +1,12 @@
+from pathlib import Path
+
+from applepy.checks.common_paths import check_cron_periodic_surface
+from applepy.context import RunContext
+
+
+def test_cron_periodic_returns_finding(tmp_path: Path) -> None:
+    ctx = RunContext(home=tmp_path, output_dir=tmp_path, phase="unprivileged")
+    out = check_cron_periodic_surface(ctx)
+    assert len(out) == 1
+    assert out[0].id == "soc-011"
+    assert "/etc/crontab" in out[0].evidence or "crontab" in out[0].evidence.lower()