[Coverage Report] Test Coverage Report — 2026-06-06

[github-actions[bot]]

📊 Test Coverage Report — 2026-06-06

134 files tracked · 105 test files · 153 source files

Overall Coverage

Metric	Coverage	Covered / Total
Statements	96.5%	4669 / 4840
Branches	90.7%	2546 / 2806
Functions	98.7%	542 / 549
Lines	96.5%	4515 / 4676

---

🔴 Critical Gaps (< 50% statement coverage)

None — all files are above 50%.

---

🟡 Low Coverage (50–79% statement coverage)

File	Stmts	Branch	Funcs	Notes
🟡 src/commands/validators/network-options.ts	66.7%	50.0%	100%	New file (added in last 7 days); 7 uncovered statements, 5 uncovered branches

---

🛡️ Security-Critical Path Status

src/host-iptables.ts          S=100% B=100% F=100%  ✅
src/host-iptables-rules.ts    S=100% B=98%  F=100%  ✅  (1 uncovered branch)
src/host-iptables-shared.ts   S=100% B=95%  F=100%  ✅
src/host-iptables-network.ts  S=100% B=100% F=100%  ✅
src/host-iptables-cleanup.ts  S=100% B=100% F=100%  ✅
src/squid-config.ts           S=100% B=100% F=100%  ✅
src/squid/access-rules.ts     S=100% B=100% F=100%  ✅
src/squid/acl-generator.ts    S=100% B=100% F=100%  ✅
src/squid/config-generator.ts S=100% B=100% F=100%  ✅
src/squid/domain-acl.ts       S=100% B=100% F=100%  ✅
src/squid/validation.ts       S=100% B=100% F=100%  ✅
src/squid/policy-manifest.ts  S=87%  B=88%  F=70%   ⚠️  (3 uncovered functions)
src/docker-manager.ts         S=100% B=100% F=100%  ✅
src/domain-patterns.ts        S=98%  B=95%  F=100%  ✅
src/cli.ts                    S=86%  B=50%  F=100%  ⚠️  (module entry guard not tested)

---

📋 Coverage Table (files below 95%)

Click to expand — 47 files with coverage below 95%

File	Stmts	Branch	Funcs	Lines
🟡 src/commands/validators/network-options.ts	66.7%	50.0%	100.0%	66.7%
🟢 src/services/agent-volumes/etc-mounts.ts	82.5%	67.8%	100.0%	82.5%
🟢 src/logs/audit-enricher.ts	83.6%	74.1%	100.0%	89.4%
🟢 src/artifact-preservation.ts	85.4%	95.3%	100.0%	85.4%
🟢 src/cli.ts	85.7%	50.0%	100.0%	85.7%
🟢 src/logs/log-parser.ts	86.9%	67.1%	100.0%	87.8%
🟢 src/squid/policy-manifest.ts	87.2%	88.2%	70.0%	87.0%
🟢 src/services/agent-volumes/docker-host-staging.ts	87.8%	72.4%	100.0%	87.2%
🟢 src/commands/logs-command-helpers.ts	88.5%	83.3%	100.0%	88.3%
🟢 src/dind-bootstrap.ts	88.9%	66.7%	100.0%	88.5%
🟢 src/services/doh-proxy-service.ts	90.0%	75.0%	100.0%	90.0%
🟢 src/commands/validators/log-and-limits.ts	90.3%	77.6%	100.0%	90.3%
🟢 src/services/host-path-prefix.ts	90.3%	81.6%	100.0%	88.9%
🟢 src/config-writer.ts	90.9%	83.0%	100.0%	90.9%
🟢 src/services/api-proxy-service.ts	91.7%	50.0%	100.0%	91.7%
🟢 src/services/agent-volumes/docker-socket.ts	91.7%	93.3%	100.0%	91.7%
🟢 src/logs/log-streamer.ts	92.2%	77.8%	88.9%	92.1%
🟢 src/diagnostic-collector.ts	92.5%	100.0%	100.0%	92.5%
🟢 src/commands/build-config.ts	92.8%	92.2%	100.0%	92.8%
🟢 src/commands/validators/agent-options.ts	93.0%	88.6%	100.0%	93.0%
🟢 src/services/agent-volumes/hosts-file.ts	93.2%	90.3%	100.0%	92.8%
🟢 src/services/agent-environment/environment-builder.ts	93.5%	66.7%	100.0%	93.5%
🟢 src/squid/ssl-bump.ts	93.8%	91.7%	100.0%	93.8%
🟢 src/ssl-bump.ts	94.0%	84.6%	100.0%	94.7%
🟢 src/host-env.ts	94.1%	80.0%	100.0%	95.9%
🟢 src/logs/log-aggregator.ts	94.7%	87.5%	100.0%	94.7%
🟢 src/upstream-proxy.ts	94.9%	94.7%	100.0%	94.5%
🟢 src/services/cli-proxy-service.ts	95.5%	93.3%	100.0%	95.5%
🟢 src/commands/main-action.ts	95.6%	88.6%	100.0%	95.6%
🟢 src/parsers/volume-parsers.ts	95.8%	100.0%	100.0%	95.8%
🟢 src/container-lifecycle.ts	96.0%	88.1%	100.0%	95.8%
🟢 src/services/agent-volumes/workspace-mounts.ts	96.3%	75.0%	100.0%	96.3%
🟢 src/container-cleanup.ts	96.4%	100.0%	80.0%	95.8%
🟢 src/services/agent-environment/env-passthrough.ts	96.8%	92.3%	100.0%	96.8%
🟢 src/commands/validators/config-assembly.ts	97.0%	90.4%	100.0%	97.9%
🟢 src/compose-sanitizer.ts	97.1%	93.3%	100.0%	97.0%
🟢 src/logs/log-formatter.ts	97.4%	92.8%	100.0%	97.3%
🟢 src/domain-patterns.ts	97.7%	95.4%	100.0%	97.6%
🟢 src/services/agent-service.ts	97.8%	94.6%	100.0%	97.7%
🟢 src/services/agent-volumes/home-strategy.ts	97.8%	83.3%	100.0%	97.7%
🟢 src/config-file.ts	98.1%	97.1%	87.5%	100.0%
🟢 src/rules.ts	98.2%	91.9%	100.0%	98.1%
🟢 src/compose-generator.ts	98.4%	92.5%	100.0%	98.4%
🟢 src/pid-tracker.ts	98.8%	80.8%	100.0%	98.7%
🟢 src/option-parsers.ts	98.9%	95.5%	100.0%	98.8%
🟢 src/api-proxy-config.ts	100.0%	98.2%	100.0%	100.0%
🟢 src/cli-options.ts	100.0%	93.3%	100.0%	100.0%

87 of 134 tracked files (65%) have 100% statement coverage.

---

🔍 Notable Findings

1. src/commands/validators/network-options.ts — New code lacking tests (66.7% stmts, 50% branches)
   This file was added in the last 7 days. The validateNetworkOptions() function has 3 conditional warning branches covering external Docker host detection and DinD path-prefix scenarios (lines ~47–73). None of the warning paths (invalid dockerHostCheck, missing path prefix when DinD hint is active) are exercised by any test. Adding unit tests that mock checkDockerHost() to return { valid: false } and vary dockerHostPrefix / dindHint would reach full coverage.

2. src/logs/log-parser.ts — Complex parsing paths not fully covered (87% stmts, 67% branches)
   23 uncovered branches in the log-parser, primarily in IPv6 address parsing ([ bracket handling, remainder splitting) and the timestamp-normalisation fallback path (typeof obj.ts === 'number' branch). These cover edge-case Squid log formats that could cause silent parse failures in production log analysis.

3. src/squid/policy-manifest.ts — 3 uncovered functions (70% function coverage)
   3 of 10 functions have zero coverage. These are likely utility accessors or edge-case manifest builders for non-default SquidConfig combinations (e.g. SSL bump enabled, custom dangerous-port overrides). Worth adding tests with varied config inputs.

4. src/dind-bootstrap.ts — 11 uncovered branches (67% branch coverage)
   The DinD bootstrap path has substantial uncovered conditional logic — particularly the binary staging path (stageEngineBinary option) and validation branches for unsafe binary names / non-file sources. Given this runs with elevated permissions in CI, these error paths deserve explicit negative-case tests.

---

📈 Recommendations

1. High — Add tests for src/commands/validators/network-options.ts
   Cover the 3 warning branches in validateNetworkOptions(): (a) dockerHostCheck.valid === false, (b) external host with no path prefix, (c) dindHint === true with no path prefix. These are trivially mockable — the function is already well-structured for unit testing.

2. Medium — Cover IPv6 and timestamp-fallback branches in src/logs/log-parser.ts
   Add test cases with IPv6 client addresses (e.g. [::1]:12345) and Squid log entries that use integer ts fields instead of string timestamp. 23 uncovered branches here means log analysis could silently drop or misparse entries from IPv6-enabled deployments.

3. Low — Add negative-case tests for src/dind-bootstrap.ts binary staging
   Cover the SAFE_BINARY_NAME_REGEX rejection path and the isFile() guard. These protect against path-traversal-style inputs in the DinD bootstrap and should have explicit failure-mode tests.

---

Generated by test-coverage-reporter workflow · Trigger: push · Run: 27073349818

Generated by Test Coverage Reporter · sonnet46 1.7M · ◷

• expires on Jun 13, 2026, 8:48 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-13T20:48:30.125Z.

Closed by Workflow