[Coverage Report] Test Coverage Report — 2026-06-17

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Covered / Total
Statements	97.2%	4,973 / 5,116
Branches	91.96%	2,757 / 2,998
Functions	98.84%	599 / 606
Lines	97.34%	4,809 / 4,940

Security-Critical Path Status

File	Statements	Branches	Functions	Status
host-iptables-rules.ts	100%	100%	100%	✅ Fully covered
host-iptables-shared.ts	100%	100%	100%	✅ Fully covered
host-iptables-cleanup.ts	100%	100%	100%	✅ Fully covered
squid/access-rules.ts	100%	100%	100%	✅ Fully covered
squid/acl-generator.ts	100%	100%	100%	✅ Fully covered
squid/validation.ts	100%	100%	100%	✅ Fully covered
domain-validation.ts	100%	100%	100%	✅ Fully covered
domain-patterns.ts	100%	89.5%	100%	⚠️ 2 branch gaps
domain-matchers.ts	98.1%	95%	100%	⚠️ 1 branch gap
squid/config-sections.ts	100%	82.8%	100%	⚠️ 5 branch gaps
squid/policy-manifest.ts	87.5%	88.2%	70%	❌ 3 functions uncovered

File-by-File Coverage Gaps (branches < 80%)

File	Statements	Branches	Functions	Risk
services/agent-volumes/etc-mounts.ts	82.5%	67.9%	100%	🔴 High — credential file staging
logs/audit-enricher.ts	83.6%	74.1%	100%	🟡 Medium — audit attribution
services/agent-volumes/docker-host-staging.ts	87.8%	72.4%	100%	🔴 High — path traversal prevention
commands/validators/log-and-limits.ts	90.3%	77.6%	100%	🟡 Medium — input validation
logs/log-streamer.ts	92.2%	77.8%	88.9%	🟡 Medium — log infrastructure
workdir-setup.ts	94.5%	79.6%	100%	🟡 Medium — temp dir handling

---

🔍 Notable Findings

1. etc-mounts.ts — Credential File Staging Has Uncovered Error Paths (67.9% branches)

This file synthesizes /etc/passwd and /etc/group for DinD/ARC runners. The uncovered branches include:

• The fallback path where stageHostFile returns null and a minimal synthesized identity file is written (lines 82–88 and 104–110). If synthesizeIdentityFile also fails (catch block on line 19), passwdPath silently remains undefined, falling back to the real /etc/passwd inside the agent — a credential isolation regression.
• The UID-append path (lines 91–99): when the staged passwd file exists but lacks the runner's UID, a new entry is appended. The resolveUniqueName conflict-resolution loop (counter increment at line 55) is not exercised, meaning the case of two colliding username variants is untested.

These paths gate whether the agent container sees the correct (isolated) user identity in DinD mode.

2. squid/policy-manifest.ts — Blocked-Domain Rule Branches Uncovered (70% functions)

Three arrow functions inside the if (blockedDomains && blockedDomains.length > 0) block (lines 131–158) are never called in tests. This means the deny-blocked-plain and deny-blocked-regex policy rules are not exercised in the manifest generator, so the audit log enricher (audit-enricher.ts) can never attribute a denial to an explicitly blocked domain in a unit-test scenario. Any regression in blocked-domain manifest generation would go undetected.

3. docker-host-staging.ts — Path Traversal Prevention Branches Uncovered (72.4% branches)

stageHostFile (line 49) has a multi-condition path-traversal guard:

relativeToStageRoot.startsWith('..') || path.isAbsolute(relativeToStageRoot) || relativeToStageRoot === ''

The coverage data shows 21 of 29 branches covered, leaving at least two of these three conditions untested in isolation. Without these tests, a future refactor could silently weaken the traversal check. The rejection-logging branch (line 50) is also uncovered.

4. audit-enricher.ts — Regex Error Path and Early-Return Uncovered (74.1% branches)

domainMatchesRule has a try/catch around new RegExp(entry, 'i') (lines 52–57) that silently skips invalid patterns. The catch branch is not tested — an invalid regex in an ACL rule would be silently ignored during audit enrichment, producing an unknown attribution without any warning. Additionally, the domain === '-' early-return guard (line 40) is not covered, meaning the function's behavior on Squid's internal synthetic - domain entry is untested.

---

📈 Recommendations

🔴 High — Add DinD identity-staging edge-case tests for etc-mounts.ts

What to do: Add unit tests that simulate (a) a staging root that can't be written to (triggering synthesizeIdentityFile failure), and (b) a staged passwd file whose content is missing the runner UID, with a pre-existing runner entry that forces the counter loop in resolveUniqueName. These tests should assert the final mount path, not just that no exception is thrown.

Why it matters: Silent fallback to /etc/passwd inside the agent would expose the real host user list, violating the credential isolation guarantees of DinD mode.

🔴 High — Test squid/policy-manifest.ts with blockedDomains configured

What to do: Add a test for generatePolicyManifest that passes a non-empty blockedDomains array (including both plain domains and regex patterns). Assert that the resulting manifest contains deny-blocked-plain and deny-blocked-regex rules with the correct domains values. Also test enableDlp: true and enableHostAccess: true paths to bring function coverage to 100%.

Why it matters: The policy manifest drives the audit enricher. Untested blocked-domain rules mean the audit trail cannot correctly attribute denials to explicit block-list entries — a gap in security observability.

🟡 Medium — Cover docker-host-staging.ts path traversal guard branches

What to do: Add tests for stageHostFile that supply: (a) an empty relativeTargetPath, (b) a path that resolves to .. outside the stage root (e.g., ../../etc/shadow), and (c) an absolute path string. Assert that each returns undefined and logs the rejection message.

Why it matters: This function copies files from the runner filesystem into a staging directory that is then bind-mounted into Docker. The path traversal guard is the only thing preventing a crafted relativeTargetPath from staging arbitrary runner files into the container.

Generated by Test Coverage Reporter · ◷

• expires on Jun 24, 2026, 6:17 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-24T06:17:59.845Z.

Closed by Workflow