test(worker-image): cover ustar tar-builder + count integration coverage in codecov (MNG-1726)

[aaight]

Summary

Coverage-hardening follow-up to the merged per-project worker Dockerfile sequence (MNG-1721 → MNG-1725). PR #1474 (MNG-1723) merged with codecov/patch red because the gaps were integration-tested code + un-mockable Docker glue rather than untested logic. This PR closes those gaps properly and establishes a durable codecov policy so future image/build PRs don't trip the same carve-out.

Scope: test + CI/coverage config only. No product-behavior changes — no build/spawn/set/UI surface is touched.

Linear: https://linear.app/mongrel/issue/MNG-1726/worker-dockerfile-follow-ups-test-coverage-hardening-codecov-policy

What changed

1. Direct unit test for createSingleFileTar (the hand-rolled ustar builder)

tests/unit/router/worker-dockerfile-tar.test.ts (new, 19 tests) asserts the POSIX ustar output of the riskiest hand-written code in the sequence:

• Header field byte-offsets — name @0, mode @100, uid @108, gid @116, size @124, mtime @136, chksum @148, typeflag @156, magic ustar @257, version @263.
• Checksum — recomputes the sum over all 512 header bytes with the checksum field space-filled during computation, and asserts the stored value (6 octal digits + NUL + space) matches.
• Body padding + trailer — verbatim body, zero-padding up to the 512-byte block boundary (incl. the exact-multiple no-pad case + empty file), the trailing 1024 zero bytes, and a 512-multiple total length.
• Single-file round-trip — a hand-rolled ustar reader confirms the archive contains exactly one Dockerfile entry whose bytes equal the composed Dockerfile, including a multibyte-UTF-8 byte-accurate size case.

createSingleFileTar was already exported, so no product code changed for this.

2. Count integration coverage in Codecov (closes the projectsRepository 0%-patch gap)

recordWorkerImageBuildResult / readWorkerImageBuildInputs are thoroughly tested by tests/integration/db/projectsRepository.test.ts, but they read as 0% patch because only the unit run was uploaded to Codecov. Rather than paper over just these two functions, this wires the integration coverage into Codecov so all integration-covered repository/db code counts:

• package.json — new test:integration:coverage script runs the integration project with --coverage and thresholds disabled (the integration suite alone doesn't exercise 80% of src/**; the combined Codecov report is the gate, not the local run).
• .github/workflows/ci.yml — the integration-tests job now runs test:integration:coverage and uploads coverage/lcov.info under a new integration flag; the existing unit upload gains a unit flag. Codecov merges the two flags per-commit.
• codecov.yml — declares the unit + integration flags with carryforward: true.

Verified locally against a live DB: the integration lcov records hits > 0 on every executable line of both writers (readWorkerImageBuildInputs 12/12, recordWorkerImageBuildResult 30/30).

3. Durable, narrowly-scoped policy for un-mockable Docker-daemon glue

The defaultDeps real-Docker implementations only run against a live daemon, so unit tests drive the handlers through injected fakes and the runtime contract is covered by the shared worker-image smoke-test (docker-build-check CI job). Those specific default-impl blocks now carry line-level /* v8 ignore start | stop */ markers so they can't recurrently fail codecov/patch on future image/build PRs:

• src/router/worker-image-build.ts — defaultResolveBaseDigest, defaultBuildImage, defaultInspectBuiltImage.
• src/router/worker-image-validation.ts — defaultInspectImageDigest, runWorkerImageSmokeTest.

codecov.yml documents the policy. This is deliberately narrow: the handler logic, compose/hashing helpers, and createSingleFileTar stay fully counted — the files are not blanket-ignored. Scoped coverage confirms the build handler now reports 100% function coverage with only pre-existing handler branches (not the glue) uncovered.

Verification

• npm run typecheck — clean.
• biome check on changed files — clean.
• npm run test:coverage (full unit suite) — 10687 passed / 33 skipped, exit 0, thresholds pass (global lines 92.61%).
• npm run test:integration:coverage — 649 passed, exit 0, coverage/lcov.info produced.
• tests/unit/router/worker-dockerfile-tar.test.ts — 19 passed.

Out of scope

No behavior change to the build engine / spawn / set surfaces / UI. No registry push / multi-host / build-time secrets / base-image-bump work.

🤖 Generated with Claude Code

🕵️ claude-code · claude-opus-4-8 · run details

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[nhopeatall]

Summary

APPROVE — a clean, tightly-scoped coverage-hardening PR that fully satisfies the MNG-1726 acceptance criteria with no product-behavior change. I verified the substance rather than trusting the description.

What I verified

• v8-ignore markers are narrow and correctly placed. In both worker-image-build.ts and worker-image-validation.ts the /* v8 ignore start|stop */ blocks wrap only the defaultDeps daemon-glue functions. createSingleFileTar, resolveDigestFromRepoDigests, composeDockerfile, all handler logic, and the defaultDeps objects remain outside the markers and stay counted — matching the ticket's "do NOT blanket-ignore" constraint.
• The exclusions drop no real coverage signal. The excluded functions are referenced in tests only as vi.fn() mocks (injected fakes); none is invoked directly, so nothing testable is being hidden.
• The tar test is a genuine round-trip, not a tautology. I traced every assertion against the actual builder — header field byte-offsets, the space-filled 512-byte checksum recomputation, block padding (incl. exact-multiple and empty-file cases), the 1024-byte trailer, and the multibyte-UTF-8 byte-accurate size — and the hand-rolled parseUstar reader is independent of the producer. Ran it locally: 19/19 pass in 5ms. The mtime test re-creates a fresh tar bounded by before/after, so it isn't flaky.
• Codecov wiring is sound. Two separate CI jobs upload coverage/lcov.info under unit/integration flags (the vitest root coverage config emits lcov). Codecov merges flags as a per-line union, so integration-only-covered repository code (the projectsRepository writers) counts toward patch/project without any risk of lowering the combined number. Flags are declared with carryforward: true; no new per-flag blocking status is introduced, and codecov.yml is well-formed.
• Hygiene/scope. Exactly 6 intentional files, no generated artifacts; source edits are comment-only; CI is 7/7 green.

No blocking or should-fix issues.

🕵️ claude-code · claude-opus-4-8 · run details