[Coverage Report] Test Coverage Report — 2026-06-20 #5335
Closed
Replies: 2 comments
-
|
🔮 The ancient spirits stir: the smoke test agent was here, and the run holds steady in the lantern light. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Beta Was this translation helpful? Give feedback.
0 replies
-
|
This discussion was automatically closed because it expired on 2026-06-27T22:37:23.822Z.
|
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
📊 Overall Coverage — 2026-06-20
🔐 Security-Critical File Coverage
host-iptables-rules.tshost-iptables-shared.tshost-iptables-cleanup.tssquid/acl-generator.tssquid/access-rules.tssquid/config-sections.tsdomain-patterns.tscli.ts📂 All Files with Coverage Below 90%
services/agent-volumes/etc-mounts.ts/etcbind-mount selection — security-relevantsquid-log-reader.tsconfig-writer.tscli.tsservices/agent-volumes/system-mounts.tsworkdir-setup.tsssl-bump.ts💡 Notable Findings
etc-mounts.tsis the sharpest coverage gap — at 67.85% branch coverage, this file controls which/etcfiles are bind-mounted into the agent container (including the logic that excludes/etc/shadow). Any uncovered branch here is a potential path where sensitive host files could be inadvertently exposed.domain-patterns.tsandsquid/config-sections.tshave minor branch gaps — both have 100% line coverage but unconditional execution paths aren't fully exercised. Fordomain-patterns.tsthis likely involves edge-case wildcard patterns; forconfig-sections.tsit likely involves SSL-bump/upstream-proxy option combinations.jest.config.jsstill enforces 30%/38% thresholds, which are ~55–60 percentage points below actual coverage. This means a severe regression would not be caught by CI until coverage dropped catastrophically.✅ Recommendations
🔴 High — Add coverage for
etc-mounts.tsbranch pathsFile:
src/services/agent-volumes/etc-mounts.tsBranch coverage is 67.85% (9 of 28 branches uncovered). This module decides which
/etcfiles are selectively mounted — the logic that excludes/etc/shadowand other sensitive files. Each uncovered branch represents a conditional decision that hasn't been exercised in tests.Action: Add test cases in
etc-mounts.test.tsthat cover the edge cases: what happens when an expected source path doesn't exist, when the DinD path prefix is set, and when the/etc/ld.so.cacheor/etc/alternativespaths are absent.🟡 Medium — Raise coverage thresholds to reflect actual state
File:
jest.config.jsCurrent thresholds (
branches: 30, functions: 35, lines: 38, statements: 38) are vestigial from the project's early state. Actual coverage is 93.58% branches and 97.89% lines. A future refactor that accidentally drops coverage to 85% would still pass CI silently.Action: Update thresholds to
branches: 90, functions: 98, lines: 95, statements: 95to prevent regressions without blocking normal development.🟢 Low — Cover remaining branch gaps in
squid-log-reader.tsandworkdir-setup.tsFiles:
src/squid-log-reader.ts(80% branches),src/workdir-setup.ts(79.62% branches)Both files have high line coverage but uncovered conditional paths. For
squid-log-reader.ts, this likely involves malformed log lines and edge-case timestamps. Forworkdir-setup.ts, it likely involves cleanup error handling and directory-creation race conditions.Action: Add negative-path unit tests (e.g., malformed input, filesystem errors) to bring both files above 90% branch coverage.
Beta Was this translation helpful? Give feedback.
All reactions