[Coverage Report] 📊 Test Coverage Report — 2026-06-09 #4611
Replies: 6 comments
-
|
🔮 The ancient spirits stir, and the smoke-test agent has passed through this discussion. May the whitelists remain true and the proxy wards hold. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Beta Was this translation helpful? Give feedback.
-
|
🔮 The ancient spirits stir; the smoke-test agent has passed through this thread and left the oracle mark. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Beta Was this translation helpful? Give feedback.
-
|
🔮 The ancient spirits stir; the smoke test agent passed through and left this omen in the thread. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Beta Was this translation helpful? Give feedback.
-
|
🔮 The ancient spirits stir in the archive. A smoke test agent passed through, left this omen, and departed in linted silence. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Beta Was this translation helpful? Give feedback.
-
|
🔮 The ancient spirits stir, and the smoke-test agent has passed through this discussion. The omens were logged, the veil was observed, and the runtime remains under watch.
|
Beta Was this translation helpful? Give feedback.
-
|
🔮 The ancient spirits stir... the smoke test agent was here, and the omens read PASS.
|
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Overall Coverage
Overall coverage is strong. All 108 test files exercise 155 source files with no critical (< 50%) gaps.
🔴 Critical Gaps (< 50% statement coverage)
None. All source files are above 50% statement coverage.
🟡 Low Coverage (50–79% statement coverage)
src/commands/validators/network-options.tsOnly one file falls in this range. It validates Docker host and DinD path-prefix options; the uncovered branches (5/10) correspond to DinD-specific error paths that are difficult to trigger in unit tests without a real DinD environment.
🛡️ Security-Critical Path Status
src/host-iptables.tssrc/squid-config.tssrc/docker-manager.tssrc/domain-patterns.tssrc/cli.tssrc/cli.tsis the only security-relevant file with a branch concern — it has 1 of 2 top-level branches uncovered (likely a fatal-error exit path in command initialization).Sub-modules are fully covered:
src/host-iptables-rules.ts— 100% / 98.4% branchsrc/host-iptables-cleanup.ts— 100% all metricssrc/squid/domain-acl.ts— 100% all metricssrc/squid/access-rules.ts— 100% all metrics📋 Coverage Table (files < 95% stmt, sorted by stmt%)
src/commands/validators/network-options.tssrc/squid-log-reader.tssrc/services/agent-volumes/etc-mounts.tssrc/logs/audit-enricher.tssrc/artifact-preservation.tssrc/cli.tssrc/logs/log-parser.tssrc/squid/policy-manifest.tssrc/services/agent-volumes/docker-host-staging.tssrc/dind-bootstrap.tssrc/commands/logs-command-helpers.tssrc/services/doh-proxy-service.tssrc/commands/validators/log-and-limits.tssrc/services/host-path-prefix.tssrc/config-writer.tssrc/services/api-proxy-service.tssrc/logs/log-streamer.tssrc/commands/build-config.tssrc/commands/main-action.ts🔍 Notable Findings
1.
src/cli.ts— branch coverage 50% (1/2 branches)The main entry point has one uncovered branch. Given 263 files were changed in the recent large refactoring commit (#4584 — "Refactor container lifecycle into focused Squid log and startup diagnostics modules"), this branch gap likely corresponds to a top-level error-exit path (e.g.,
process.exiton commander parse failure) that is hard to invoke through unit tests. Worth adding a dedicated test for the fatal-initialization path.2.
src/logs/log-parser.ts— branch coverage 68.6% (48/70 branches)22 uncovered branches in the Squid log parser. This is the component that reads the security audit trail. Edge cases such as malformed timestamps, unexpected field counts, or non-standard Access Log entries are likely not tested. Gaps here could silently drop log lines, masking blocked-traffic events.
3.
src/services/agent-volumes/etc-mounts.ts— 67.8% branch (19/28)This file controls which
/etcfiles are selectively bind-mounted into the agent container (SSL certs,passwd,group, etc., while explicitly excluding/etc/shadow). 9 uncovered branches may represent edge cases in the file-existence checks or conditional mount logic. Testing the "file not found" and "alternative paths" code paths would add confidence to the security boundary.4.
src/dind-bootstrap.ts— 66.7% branch (22/33)DinD bootstrap has notable branch gaps. As DinD support is a relatively newer feature, some initialization and error-recovery paths may not be exercised by the current test suite. The recent refactoring touched this code path significantly.
📈 Recommendations
High —
src/cli.tsbranch coverage: Add a test that exercises the fatal-initialization error path (e.g.,commanderparse failure or missing required args) to close the 50% branch gap in the security-critical main entry point.High —
src/logs/log-parser.tsbranches: Add unit tests for malformed Squid access-log lines: missing fields, truncated lines, unexpected HTTP method tokens, and non-standard timestamps. These gaps could silently drop audit trail entries.Medium —
src/services/agent-volumes/etc-mounts.tsbranches: Test edge cases in/etcselective-mount logic — specifically the paths where expected host files are absent or have unexpected permissions. This validates the security boundary between host and container/etc.Low —
src/commands/validators/network-options.ts: Improve to ≥ 80% by mockingcheckDockerHost()to return invalid states and exercising the DinD-hint-without-prefix error branch. Not security-critical but improves overall quality signal.Generated by test-coverage-reporter workflow. Trigger:
push· Run: 27229459658Beta Was this translation helpful? Give feedback.
All reactions