[Coverage Report] Test Coverage Report — 2026-06-09 #4655
Replies: 3 comments
-
|
🔮 The ancient spirits stir; the smoke-test agent passed through and left this brief rune of verification.
|
Beta Was this translation helpful? Give feedback.
-
|
🔮 The ancient spirits stir, and the smoke test agent has passed through this discussion. The omens are clear: build, browser, file, and GitHub queries all aligned. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Beta Was this translation helpful? Give feedback.
-
|
🔮 The ancient spirits stir over this thread. The smoke test agent was here, the omens were read, and the build rites are underway. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
📊 Overall Coverage
Overall coverage is strong. The codebase has 108 test files covering 155 source files.
🔴 Critical Gaps (< 50% statement coverage)
None. All files are at or above 50% statement coverage.
🟡 Low Coverage (50–79% statement coverage)
src/commands/validators/network-options.tsThis file validates Docker host options, domain resolution, and network configuration. The 3 uncovered warning branches correspond to ARC/DinD deployment paths (external
DOCKER_HOST, missing path prefix with external host, DinD-hint detection). Tests inconfig-assembly.test.tsonly exercise thevalid: true/ no-DinD path.🛡️ Security-Critical Path Status
src/cli.ts's 50% branch figure is theif (require.main === module)bootstrap guard — this branch is structurally untestable viaimportand is not a security gap.📋 Full Coverage Table
All files (sorted by statement coverage)
src/commands/validators/network-options.tssrc/squid-log-reader.tssrc/services/agent-volumes/etc-mounts.tssrc/logs/audit-enricher.tssrc/artifact-preservation.tssrc/cli.tssrc/logs/log-parser.tssrc/squid/policy-manifest.tssrc/services/agent-volumes/docker-host-staging.tssrc/commands/logs-command-helpers.tssrc/dind-bootstrap.tssrc/services/doh-proxy-service.tssrc/commands/validators/log-and-limits.tssrc/services/host-path-prefix.tssrc/config-writer.tssrc/services/agent-volumes/docker-socket.tssrc/services/api-proxy-service.tssrc/logs/log-streamer.tssrc/services/agent-volumes/system-mounts.tssrc/diagnostic-collector.tssrc/commands/build-config.tssrc/commands/validators/agent-options.tssrc/services/agent-volumes/hosts-file.tssrc/services/agent-environment/environment-builder.tssrc/squid/ssl-bump.tssrc/ssl-bump.tssrc/host-env.tssrc/logs/log-aggregator.tssrc/upstream-proxy.tssrc/services/cli-proxy-service.tssrc/commands/main-action.tssrc/container-startup-diagnostics.tssrc/container-lifecycle.tssrc/domain-patterns.tssrc/squid-config.tssrc/host-iptables.tssrc/docker-manager.tsFiles at 100% statement coverage omitted for brevity.
🔍 Notable Findings
1.
network-options.ts— uncovered ARC/DinD warning branches (branch: 50%)The file has 3 conditional
logger.warn()blocks for DinD/external-Docker scenarios. The tests currently supplyvalid: true/dindHint: falseonly. Covering these paths would exercise the--docker-host-path-prefixadvisory warnings that ARC runners depend on.2.
services/api-proxy-service.ts— unguarded error path (branch: 50%)The
if (!networkConfig.proxyIp)guard throws an error but is never tested. This is the entry point for the API credential-isolation sidecar. A test for the missing-IP error case would close this gap.3.
squid/config-sections.ts— 5 uncovered branches (branch: 82.75%)All 45 statements are covered but 5 branches are not. These are likely optional-field conditionals in the Squid config-section generator (e.g., upstream proxy, SSL-bump, DoH). Worth auditing to confirm no security-relevant configuration path is skipped.
4. Recent active area — no regressions detected
The most recent commit (af24ecc) removed the
dind-ubuntuimage from the release workflow. All files changed in the past 7 days (cli.ts,api-proxy-config.ts,logs-*.ts,artifact-preservation.ts,upstream-proxy.ts, and the fullsrc/types/refactor) have corresponding test files and show no new gaps beyond the existing items above.📈 Recommendations
High — Add tests to
network-options.test.ts(doesn't exist yet) orconfig-assembly.test.tsforvalidateNetworkOptions()withcheckDockerHost()returningvalid: falseanddindHint: true. These cover real ARC deployment paths and will bringnetwork-options.tsbranch coverage from 50% → ~100%.Medium — Add a test for
buildApiProxyService()called withnetworkConfig.proxyIpabsent (i.e.,undefined) to cover the error-guard branch inservices/api-proxy-service.ts.Low — Audit the 5 uncovered branches in
squid/config-sections.tsto determine whether any map to security-relevant config combinations (e.g., upstream proxy + SSL-bump), and add targeted tests if so.Generated by test-coverage-reporter workflow. Trigger:
push· Run: 27242623399Beta Was this translation helpful? Give feedback.
All reactions