fix: include all failing dimension values in anomaly alert description

[joostboon]

Summary

• Anomaly alerts for dimension-based tests (e.g. column_anomalies with dimensions) previously showed only a single arbitrary dimension value in the result message
• Now the alert lists all failing dimension values with their metric value and average, truncated to 5 with an "and N more" suffix when there are many failures
• Dimension values are deduplicated (rows are bucket-based so the same dimension value can appear across multiple time buckets; we keep the latest row per value)
• Example new format: In column INCIDENTS_OPENED, 2 anomalous max values for dimension account_name: Joejuice (214.0, avg 21.0), Acme (15.0, avg 6.3).
• Non-dimension tests are unaffected (fall back to existing single-row description)

Test plan

• Added assertions to test_column_anomalies_group_by to verify the description format for 1 and 2 failing dimension values
• Verified locally against a real column_anomalies test with dimensions -- alert now shows all failing dimension values

before and after screenshots:

Summary by CodeRabbit

• Bug Fixes
  • Improved anomaly test result summaries to provide clearer, dimension-aware details (including anomalous count and relevant dimension values, with metric comparison context).
  • Updated the summary generation logic to include a richer description when dimension-based anomalies are present, with a sensible fallback otherwise.
• Tests
  • Expanded the column anomalies grouping test with more granular assertions to verify the updated description content under different anomaly sensitivity settings.

[github-actions]

👋 @joostboon
Thank you for raising your pull request.
Please make sure to add tests and document all user-facing changes.
You can do this by editing the docs files in the elementary repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7ebf305e-5154-4346-a9f7-6c31c1273428

📥 Commits

Reviewing files that changed from the base of the PR and between 4d8c860 and 7bc6114.

📒 Files selected for processing (1)

• macros/edr/data_monitoring/anomaly_detection/store_anomaly_test_results.sql

🚧 Files skipped from review as they are similar to previous changes (1)

• macros/edr/data_monitoring/anomaly_detection/store_anomaly_test_results.sql

---

📝 Walkthrough

Walkthrough

The SQL macro now collects anomalous rows before building test_results_description, and grouped integration tests assert the updated description text for different anomaly sensitivity settings.

Changes

Dimension-aware anomaly description

Layer / File(s)	Summary
Anomalous row collection and description rendering macros/edr/data_monitoring/anomaly_detection/store_anomaly_test_results.sql	Adds preprocessing to separate scored and anomalous rows, updates failure counting for anomalous rows, and renders a dimension-aware description with up to 5 anomalous dimension values, metric details, and fallback text.
Integration test assertions for grouped description integration_tests/tests/test_column_anomalies.py	Adds assertions in test_column_anomalies_group_by checking the anomalous count, grouping phrase, and expected dimension values for both test runs.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: expanding anomaly alert descriptions to include failing dimension values.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dimension-anomaly-alert-description

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

integration_tests/tests/test_column_anomalies.py (1)

320-323: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add one case that exercises the max_shown / "and N more" branch.

These assertions only cover 1- and 2-dimension failures, but the new formatter has separate behavior once there are more than 5 anomalous dimensions. A >5 case would keep the truncation and suffix logic from regressing silently.

Also applies to: 343-347

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@integration_tests/tests/test_column_anomalies.py` around lines 320 - 323, The
current assertions in the anomaly description tests only cover the
small-dimension cases, so add a new test case in test_column_anomalies that
drives the formatter past the max_shown threshold and verifies the “and N more”
suffix. Use the existing description checks around
test_result["test_results_description"] to assert the truncated output and the
extra-count branch, ensuring the formatter logic in the test results description
path does not regress.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@macros/edr/data_monitoring/anomaly_detection/store_anomaly_test_results.sql`:
- Around line 79-107: The summary in store_anomaly_test_results.sql is counting
and listing duplicate dimension_value entries from anomalous_rows, which can
overstate failures for a single dimension. Update the test_results_description
construction to deduplicate anomalous_rows by dimension_value before generating
dim_parts and total, keeping the latest or highest-priority row per value. Then
apply the existing max_shown cap to the unique list so the reported count and
examples reflect distinct failing dimensions.

---

Nitpick comments:
In `@integration_tests/tests/test_column_anomalies.py`:
- Around line 320-323: The current assertions in the anomaly description tests
only cover the small-dimension cases, so add a new test case in
test_column_anomalies that drives the formatter past the max_shown threshold and
verifies the “and N more” suffix. Use the existing description checks around
test_result["test_results_description"] to assert the truncated output and the
extra-count branch, ensuring the formatter logic in the test results description
path does not regress.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 64f4da88-9811-415a-88a8-6e8bd30533e4

📥 Commits

Reviewing files that changed from the base of the PR and between 244f9db and df48e27.

📒 Files selected for processing (2)

• integration_tests/tests/test_column_anomalies.py
• macros/edr/data_monitoring/anomaly_detection/store_anomaly_test_results.sql