[Coverage Report] Test Coverage Report — 2026-06-06

[github-actions[bot]]

Overall Coverage

Metric	Coverage	Covered / Total
Statements	96.46%	4,669 / 4,840
Branches	90.73%	2,546 / 2,806
Functions	98.72%	542 / 549
Lines	96.55%	4,515 / 4,676

134 files tracked · 105 test files · 153 source files

---

🔴 Critical Gaps (< 50% statement coverage)

None. All 134 tracked files exceed 50% statement coverage.

---

🟡 Low Coverage (50–79% statement coverage)

File	Statements	Branches	Functions
src/commands/validators/network-options.ts	66.7% (6/9)	50.0% (1/2)	100%

Only one file sits in the low-coverage band. The uncovered branch is the Docker-host warning path — the !dockerHostCheck.valid + !dockerHostPathPrefixResolution.dockerHostPrefix guard that emits split-filesystem warnings under ARC/DinD conditions.

---

🛡️ Security-Critical Path Status

File	Statements	Branches	Functions	Status
src/host-iptables.ts	100%	100%	100%	✅ Fully covered
src/squid-config.ts	100%	100%	100%	✅ Fully covered
src/docker-manager.ts	100%	100%	100%	✅ Fully covered
src/domain-patterns.ts	97.7%	95.4%	100%	✅ Excellent
src/cli.ts	85.7%	50.0%	100%	⚠️ Branch gap

src/cli.ts has only 7 statements total; the 50% branch gap is the require.main === module guard — a standard Node.js pattern that is effectively untestable without spawning a subprocess.

---

📋 Medium Coverage (80–89% statements)

9 files with 80–89% statement coverage

File	Statements	Branches
src/services/agent-volumes/etc-mounts.ts	82.5%	67.8%
src/logs/audit-enricher.ts	83.6%	74.1%
src/artifact-preservation.ts	85.4%	95.3%
src/cli.ts	85.7%	50.0%
src/logs/log-parser.ts	86.9%	67.1%
src/squid/policy-manifest.ts	87.2%	88.2%
src/services/agent-volumes/docker-host-staging.ts	87.8%	72.4%
src/commands/logs-command-helpers.ts	88.5%	83.3%
src/dind-bootstrap.ts	88.9%	66.7%

---

🔍 Notable Findings

1. src/logs/log-parser.ts — 67.1% branch coverage
Log parsing is used in the awf logs command family. Several error-handling branches for malformed log entries are not exercised. Uncovered paths likely include: timestamp parse failures, missing fields, and truncated lines. These are realistic production scenarios (container crash mid-write).

2. src/services/agent-volumes/etc-mounts.ts — 67.8% branch coverage
The /etc selective bind-mount logic contains platform-conditional branches (file existence checks, optional mount paths). Uncovered branches appear to be the "file not found" fallback paths which only trigger on non-standard Linux configurations.

3. src/squid/policy-manifest.ts — 3/10 functions uncovered
Three policy-manifest functions have zero coverage. These are likely the DLP/audit-related manifest sections added as features were extended. Since Squid config generation itself is 100% covered, the risk is moderate.

4. src/dind-bootstrap.ts — 66.7% branch coverage
DinD bootstrap code runs only in ARC/DinD runner environments; the uncovered branches reflect the "daemon not reachable" and retry-exhausted failure paths. These are integration-only paths with no unit-test equivalent.

---

📈 Recommendations

1. High — src/logs/log-parser.ts: Add unit tests for malformed-input branches (truncated lines, missing timestamp, unknown log format). These are realistic failure modes and the parser is called in CI summary generation.

2. Medium — src/services/agent-volumes/etc-mounts.ts: Add tests that mock fs.existsSync returning false for optional /etc paths (e.g., /etc/alternatives, /etc/ld.so.cache). This would bring branch coverage from 67.8% to ~90%.

3. Medium — src/squid/policy-manifest.ts: Add tests for the 3 uncovered functions. Check which functions they are with grep -n "^export" src/squid/policy-manifest.ts and add tests for the DLP/rate-limit manifest builders.

4. Low — src/commands/validators/network-options.ts: Add a test that mocks checkDockerHost() returning { valid: false } with no path-prefix to exercise the ARC/DinD warning branch.

---

📊 Coverage Trend

The repository has grown significantly — 134 files are now tracked, with 258 source files touched in the past 7 days. Overall coverage remains high at 96.46% statements and 90.73% branches, well above the configured thresholds (38% / 30%).

---

Generated by test-coverage-reporter workflow · Trigger: push · Run: 27069081155

Generated by Test Coverage Reporter · sonnet46 1.3M · ◷

• expires on Jun 13, 2026, 5:36 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-13T17:36:06.337Z.

Closed by Workflow