[Coverage Report] Test Coverage Report — 2026-06-27

[github-actions[bot]]

📊 Test Coverage Report — 2026-06-27

Overall Coverage

Metric	Coverage
Statements	98.21% (5277/5373)
Branches	94% (2980/3170)
Functions	99.53% (643/646)
Lines	98.28% (5107/5196)

🛡️ Security-Critical Path Status

🟢 OK  src/host-iptables.ts:           stmts=100%   branch=100%   funcs=100%
🟢 OK  src/host-iptables-rules.ts:     stmts=100%   branch=100%   funcs=100%
🟢 OK  src/host-iptables-shared.ts:    stmts=100%   branch=100%   funcs=100%
🟢 OK  src/host-iptables-chain.ts:     stmts=97.61% branch=90%    funcs=100%
🟢 OK  src/host-iptables-validation.ts: stmts=100%  branch=96.87% funcs=100%
🟢 OK  src/squid-config.ts:            stmts=100%   branch=100%   funcs=100%
🟢 OK  src/docker-manager.ts:          stmts=100%   branch=100%   funcs=100%
🟢 OK  src/domain-patterns.ts:         stmts=100%   branch=89.47% funcs=100%
🟡 LOW src/cli.ts:                     stmts=85.71% branch=50%    funcs=100%

📋 Coverage Table (security-critical + files with any metric < 80%)

File	Stmts	Branch	Funcs	Lines	Status
src/cli.ts	85.71%	50%	100%	85.71%	⚠️
src/config-writer.ts	82.79%	78.94%	100%	82.79%	⚠️
src/workdir-setup.ts	94.54%	79.62%	100%	94.54%	⚠️
src/domain-patterns.ts	100%	89.47%	100%	100%	✅
src/host-iptables-rules.ts	100%	100%	100%	100%	✅
src/host-iptables-shared.ts	100%	100%	100%	100%	✅
src/host-iptables-chain.ts	97.61%	90%	100%	97.61%	✅
src/squid-config.ts	100%	100%	100%	100%	✅
src/docker-manager.ts	100%	100%	100%	100%	✅
TOTAL	98.21%	94%	99.53%	98.28%

🔧 Function Audit

=== host-iptables.ts (re-exports) ===
4: export { setupHostIptables } from './host-iptables-rules'
9: export { ensureFirewallNetwork } from './host-iptables-network'
10: export { cleanupHostIptables } from './host-iptables-cleanup'

=== squid-config.ts (re-exports) ===
1: export { generateSquidConfig } from './squid/config-generator'
2: export { generatePolicyManifest } from './squid/policy-manifest'

=== domain-patterns.ts ===
33: export function parseDomainWithProtocol(...)
60: export function isWildcardPattern(...)
84: export function wildcardToRegex(...)

domain-patterns.ts branch count:
  if-branches: 2   switch-branches: 1

Test files: 170 / Source files: 183

---

🔍 Notable Findings

• All primary firewall enforcement paths are fully covered. host-iptables-rules.ts, host-iptables-shared.ts, squid-config.ts, and docker-manager.ts all reach 100% statement coverage, confirming the core network isolation and domain-ACL logic is comprehensively exercised by the test suite.

• domain-patterns.ts has 2 uncovered branches (89.47% branch coverage, 17/19 branches hit). These gaps are in the wildcard/subdomain-matching functions (parseDomainWithProtocol, isWildcardPattern, wildcardToRegex) that directly govern Squid ACL rules — an uncovered edge case here could silently allow blocked traffic.

• Branch coverage (94%) is the only below-par metric. The weakest files are config-writer.ts (78.94%, 8 of 38 branches uncovered) and workdir-setup.ts (79.62%, 11 of 54 branches uncovered). Both are config-generation paths, not enforcement paths, but malformed output could still degrade security posture.

• cli.ts shows 50% branch coverage, but the file is tiny (7 statements, 2 branches). The uncovered branch is an entry-point error/signal path that does not affect the firewall enforcement logic itself.

---

✅ Recommendations

🔴 High — Cover uncovered branches in domain-patterns.ts
Add targeted unit tests for the 2 uncovered branches in parseDomainWithProtocol, isWildcardPattern, or wildcardToRegex. Focus on edge cases: empty strings, malformed protocols, double-wildcard patterns, and IPv6 literals. These functions directly determine what Squid allows or blocks — closing this gap is highest priority.

🟡 Medium — Fix branch gaps in config-writer.ts
8 of 38 branches (21%) are uncovered. This module writes Squid and Docker Compose configs to disk; untested error branches could silently produce malformed configs. Identify the uncovered paths (likely error-handling and optional-field branches) via the HTML coverage report at coverage/index.html, then add unit tests for each.

🟢 Low — Close remaining branch gaps in workdir-setup.ts and cli.ts
workdir-setup.ts (79.62%, 11 uncovered branches) handles temp-directory setup; add tests for failure scenarios (e.g., pre-existing directory, permission errors). cli.ts (50%, 1 uncovered branch) needs a test exercising its untested entry-point branch (e.g., missing argument or signal handling). Neither affects firewall enforcement, but both improve overall resilience.

---

Generated by test-coverage-reporter workflow. Trigger: schedule

Generated by Test Coverage Reporter · 133.6 AIC · ⊞ 4.7K · ◷

• expires on Jul 4, 2026, 5:52 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-07-04T05:52:29.110Z.

Closed by Workflow