[Coverage Report] Test Coverage Report — 2026-06-11

[github-actions[bot]]

Overall Coverage

Metric	Coverage
Statements	96.38% (4770/4949)
Branches	90.78% (2630/2897)
Functions	98.77% (563/570)
Lines	96.46% (4616/4785)

Overall coverage is healthy. The weakest dimension is branch coverage at 90.78%, which warrants attention in a security-critical codebase.

---

🔴 Critical Gaps (< 50% statement coverage)

None — all files are above 50% statement coverage.

---

🟡 Low Coverage (50–89% statement coverage)

File	Stmts	Branch	Fns	Lines
🟡 src/commands/validators/network-options.ts	66.66%	50%	100%	66.66%
🟡 src/squid-log-reader.ts	82.22%	80%	100%	82.22%
🟡 src/services/agent-volumes/etc-mounts.ts	82.45%	67.85%	100%	82.45%
🟡 src/logs/audit-enricher.ts	83.6%	74.13%	100%	89.36%
🟡 src/artifact-preservation.ts	85.36%	95.34%	100%	85.36%
🟡 src/cli.ts	85.71%	50%	100%	85.71%
🟡 src/logs/log-parser.ts	86.9%	68.57%	100%	87.8%
🟡 src/squid/policy-manifest.ts	87.23%	88.23%	70%	86.95%
🟡 src/services/agent-volumes/docker-host-staging.ts	87.75%	72.41%	100%	87.23%
🟡 src/commands/logs-command-helpers.ts	88.52%	83.33%	100%	88.33%
🟡 src/dind-bootstrap.ts	88.88%	66.66%	100%	88.46%

---

🛡️ Security-Critical Path Status

File	Stmts	Branch	Fns	Status
src/host-iptables.ts	100%	100%	100%	✅ Fully covered
src/squid-config.ts	100%	100%	100%	✅ Fully covered
src/docker-manager.ts	100%	100%	100%	✅ Fully covered
src/domain-patterns.ts	97.67%	95.38%	100%	✅ Well covered
src/cli.ts	85.71%	50%	100%	⚠️ Branch gaps (thin wrapper, 13 lines)

The four core security enforcement modules (host-iptables, squid-config, docker-manager, domain-patterns) are all at or near 100% — excellent posture for the most attack-surface-critical code.

---

🔍 Notable Findings

1. src/commands/validators/network-options.ts — newly added, no dedicated test file (66.66% stmt / 50% branch)

This file was introduced in the last 7 days (commit 102c422 — "Add opt-in diagnostics artifact for blocked LLM request bodies"). It has no dedicated *.test.ts file; coverage is only incidentally achieved via config-assembly.test.ts. The uncovered branches are warning-path conditionals: !dockerHostCheck.valid, dockerHostPathPrefixResolution.dindHint, and the combined DinD hint + missing prefix check. These paths govern how AWF handles external Docker hosts and ARC/DinD split-filesystem setups — a security-relevant misconfiguration scenario.

2. src/services/agent-volumes/etc-mounts.ts — bind-mount security, 67.85% branch coverage

This file controls which /etc files are selectively bind-mounted into the agent container (excluding /etc/shadow and unwhitelisted paths). The uncovered branches at lines 49, 69, 82, 91, 104, and 113 include: content-based passwd/group UID/GID validation (the !stagedPasswdContent and fileHasPasswdUid checks), and the shouldUseDockerHostStaging guard. Since these paths affect which credential-containing files land in the container, they are worth covering.

3. src/logs/log-parser.ts — audit log integrity, 68.57% branch coverage

Log parsing underpins awf logs stats and awf logs summary (used in GitHub Actions step summaries). At 68.57% branch coverage, edge-case parsing failures could silently corrupt audit data. The uncovered branches likely include malformed-line handling and timestamp edge cases.

4. src/services/api-proxy-service.ts — API proxy credential isolation, 50% branch coverage

At 50% branch coverage (91.66% stmt), the unhappy paths in the API proxy service — which is responsible for injecting real API credentials — lack test coverage. Credential-injection failures in unexpected conditions should be tested.

---

📈 Recommendations

1. High — Add network-options.test.ts: The recently-added validateNetworkOptions function has no dedicated tests. Add unit tests covering: (a) !dockerHostCheck.valid warning path, (b) dindHint detected but no prefix set, (c) the combined DinD+no-prefix warning. This is the highest-ROI gap given it was just added.

2. High — Cover branch gaps in src/services/agent-volumes/etc-mounts.ts: Add tests for stagedPasswdContent null path, fileHasPasswdUid mismatch, and the shouldUseDockerHostStaging(false) branch. These validate that credential-containing files are only bind-mounted when expected.

3. Medium — Improve src/logs/log-parser.ts branch coverage (68.57%): Add tests for malformed/truncated log lines, missing fields, and non-numeric timestamps to ensure audit log integrity under adversarial or corrupt input.

4. Low — API proxy service unhappy paths (src/services/api-proxy-service.ts, 50% branch): Test failure conditions such as missing credentials, unreachable upstream, and mismatched port configuration.

---

Generated by test-coverage-reporter workflow. Trigger: push · Commit: 102c422
108 test files | 155 source files | 1 commit in last 7 days

Generated by Test Coverage Reporter · 156.4 AIC · ⊞ 30.7K · ◷

• expires on Jun 18, 2026, 1:49 AM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-18T01:49:22.792Z.

Closed by Workflow