[Coverage Report] Test Coverage Report — 2026-08-20

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-20

Overall Coverage

Metric	Coverage	Count
Lines	93.82%	9,713 / 10,352
Statements	92.67%	10,118 / 10,918
Functions	93.17%	1,378 / 1,479
Branches	85.87%	5,533 / 6,443

Status: Strong overall coverage across all metrics. Statement and function coverage exceed 92%, demonstrating comprehensive test implementation.

---

🛡️ Security-Critical Path Status

Component	Statements	Branches	Status
host-iptables.ts	100%	100%	✅ Fully Covered
squid-config.ts	100%	100%	✅ Fully Covered
docker-manager.ts	100%	100%	✅ Fully Covered
domain-patterns.ts	100%	89.47%	✅ Excellent (2 branch gaps)
cli.ts	85.71%	50%	⚠️ Partial Coverage (1 line, 1 branch missing)

Key Finding: All core security components (iptables rules, Squid proxy config, Docker management, domain filtering) have 100% statement coverage. The main entry point (cli.ts) has minor gaps (2 uncovered paths) that warrant investigation.

---

📋 Coverage Table

Files Under 70% Statement Coverage (Priority Review)

File	Statements	Branches	Risk Level
src/bounded-execution/finite-disclosure.ts	9.26%	0.26%	🔴 CRITICAL
src/enclave/runtime-preflight.ts	66.66%	41.02%	🟡 LOW
src/commands/validators/config-assembly.ts	69.69%	20%	🟡 LOW
src/microvm/rootfs.ts	71.69%	54.54%	🟡 LOW
src/cloud-hypervisor/virtiofsd.ts	72.51%	55.35%	🟡 LOW

---

🔧 Function Audit

Complete Coverage (Security-Critical)

• ✅ 125 test files covering comprehensive surface area
• ✅ 1,378 / 1,479 functions instrumented (93.17%)
• ✅ Proxy configuration: All Squid ACL and domain filtering paths tested
• ✅ Network isolation: All iptables rules and Docker networking paths tested
• ✅ Container lifecycle: Startup, healthchecks, and teardown fully covered

Partial Coverage (Needs Attention)

• 🔴 finite-disclosure.ts: Only 9.26% coverage — apparent stub or placeholder code
• 🟡 Enclave features: ~67% coverage on preflight checks and validator assembly
• 🟡 Cloud Hypervisor integration: ~72% coverage on rootfs and virtio filesystem code

---

📅 Recent Source Changes (last 7 days)

Commit	Description
1aed44a	feat: support secret-backed OpenAI-compatible targets (#7576)
c47bfcc	Repair gh-aw config ownership for native-root runners (#7565)
fe9dd14	test: align Cloud Hypervisor readiness timeout (#7562)
d79988b	Fix Cloud Hypervisor guest network readiness race (#7555)
4549a5e	Inject stable X-Interaction-Id and Copilot-Integration-Id on Copilot requests (#7545)
051292a	Harden local state mounts across sandbox runtimes (#7530)
6de3cb1	Fix enclave smoke runtime and rootless cleanup failures (#7502)
3098494	Preserve detected DNS resolvers in network isolation (#7499)

---

🔎 Notable Findings

1. Security Coverage Excellence: All foundational security components (iptables, Squid, Docker, domain patterns) achieve 100% statement coverage with comprehensive branch coverage. The firewall's core security posture is well-tested.

2. Minimal Entry Point Gaps: Only 2 uncovered paths in cli.ts (1 statement, 1 branch at 50%), affecting the main orchestration logic. These gaps should be addressed to ensure all CLI flag combinations are exercised.

3. New Features Under-tested: Recent additions (Cloud Hypervisor, enclave features, API key injection) show 66–72% coverage, indicating active development. These areas should be prioritized for additional test coverage as features stabilize.

4. Critical Gap - finite-disclosure.ts: The bounded-execution/finite-disclosure.ts module has only 9.26% coverage with 0.26% branch coverage. This appears to be either a new/stub module or a feature with minimal tests. Recommend investigation to determine if this represents a gap in test infrastructure or incomplete feature implementation.

---

🎯 Recommendations

🔴 HIGH Priority

• Investigate finite-disclosure.ts (0.26% branch coverage): Determine if this is a new feature awaiting tests or a test infrastructure issue. If feature-complete, add test cases to reach minimum 50% branch coverage.
• Complete cli.ts coverage: Add tests for the 2 uncovered paths to achieve 100% statement coverage on the main orchestration entry point.

🟡 MEDIUM Priority

• Audit recent feature tests: Three commits in the last 7 days involved Cloud Hypervisor and enclave stability fixes. Review test coverage for:
  • src/cloud-hypervisor/virtiofsd.ts (72.51% coverage)
  • src/microvm/rootfs.ts (71.69% coverage)
  • Ensure new network isolation and DNS resolver changes are covered by integration tests.

🟢 LOW Priority

• Enclave validator coverage: src/commands/validators/config-assembly.ts and src/enclave/runtime-preflight.ts have 67–70% coverage. As these handle orchestration logic, expand tests to reach 85%+ before next release.
• Maintain security baseline: Continue requiring 100% statement coverage for all files in src/host-iptables*, src/squid-config*, and src/docker-manager* modules in pre-commit hooks.

Generated by Test Coverage Reporter · sum00 · 22.9 AIC · ⊞ 5.4K · ◷

• expires on Aug 27, 2026, 11:17 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-08-27T23:17:34.947Z.

Closed by Workflow