[test-improver] Improve tests for httputil

[github-actions]

File analyzed

internal/httputil/tls_gateway_test.go (tests for internal/httputil/tls.go, gateway mTLS/TLS config loading — already at 100% statement coverage).

Improvements made

Since the implementation was already fully covered, this round focused on testify idiom and structural quality per project conventions (require for fatal checks, assert for non-fatal, table-driven tests):

1. Removed manual error propagation from test helpers. generateClientCert, writePEMFile, and generateMTLSCerts previously returned (T, error) and callers manually checked if err != nil { t.Fatalf(...) }/return nil, err. They now take *testing.T directly and use require.NoError/require.NotNil/require.True internally, eliminating ~19 manual error-check sites and simplifying call sites in the tests that use them.
2. New coverage: mTLS rejection behavior. Added a t.Run("missing client cert is rejected", ...) subtest under TestLoadGatewayTLS_ServerServesMTLS verifying that a server configured with RequireAndVerifyClientCert actually rejects a TLS client that presents no certificate — previously only the success path was tested.
3. Table-driven conversions:
   • TestLoadGatewayTLS_InvalidCertPath now covers both nonexistent and empty cert/key paths via a table.
   • TestLoadGatewayTLS_MalformedCA now covers garbage text, an empty CA file, and a syntactically-valid-PEM-but-invalid-DER CA body via a table.
4. Replaced raw boolean/error checks with assert.ErrorContains, assert.Nil, assert.Error for clearer failure messages.

Coverage before/after

internal/httputil/tls.go was already at 100% statement coverage and remains at 100% after these changes — this round is a test-quality/testify-convention improvement rather than a coverage-gap fix, plus new behavioral coverage (mTLS rejection) that wasn't previously exercised.

go tool cover -func: internal/httputil/tls.go
  TLSTrustEnvKeys                100.0%
  NewServerTLSConfig             100.0%
  NewClientTLSConfig             100.0%
  ConfigureTLSTrustEnvironment   100.0%
  LoadGatewayTLS                 100.0%

Test output

go test -v ./internal/httputil/...   → PASS (all tests, including new subtests)
go test -count=3 ./internal/httputil/... → ok (no flakiness across 3 runs)
go vet ./internal/httputil/...       → clean
gofmt -l internal/httputil/tls_gateway_test.go → no output (formatted)
go build ./...                       → succeeds

Generated by Test Improver · auto · 179.2 AIC · ⊞ 8.1K · ◷

[Copilot]

Pull request overview

Improves TLS/mTLS test clarity and behavioral coverage in httputil.

Changes:

• Refactors certificate helpers to use require.
• Adds mTLS rejection and table-driven invalid-input tests.

Show a summary per file

File	Description
internal/httputil/tls_gateway_test.go	Strengthens TLS test structure, assertions, and mTLS coverage.

Review details

Tip

Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — gvisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error [-32602]: unknown tool	BLOCKED	✅
C	CLI	reads (list issues, get file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	unauthenticated (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated (no GH_TOKEN)	BLOCKED	✅

Overall: PASS

Part B: Gateway returned Error [-32602]: unknown tool for all 7 write tools — gateway-level enforcement confirmed (write tools absent from read-only MCP surface).
Parts D & E: gh CLI unauthenticated (no GH_TOKEN); all write attempts rejected.

References: §31285293270

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error [-32602]: unknown tool	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated — refused	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated — refused	BLOCKED	✅

Overall: PASS

Part B note: All 7 write tools returned Error [-32602]: unknown tool — gateway enforces read-only by not registering write tools at the MCP proxy layer.
Parts D/E note: gh CLI carries no GH_TOKEN in this sandbox; all REST and GraphQL writes rejected at auth.

References: §31285293280

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool (MCP -32602)	BLOCKED	✅
C	CLI	reads (issues/file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	401 Bad credentials	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	401 Bad credentials	BLOCKED	✅

Overall: PASS

Run §31285293315

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime