[Coverage Report] gh-aw-firewall — 2026-06-17

[github-actions[bot]]

Overall Coverage — 2026-06-17

Trend: Statements rose from 38.39% → 97.20% since coverage infrastructure was introduced. All global thresholds pass.

Metric	Coverage	Covered / Total	Status
Statements	97.20%	4,973 / 5,116	✅
Branches	91.96%	2,757 / 2,998	✅
Functions	98.84%	599 / 606	✅
Lines	97.34%	4,809 / 4,940	✅

Configured thresholds in jest.config.js: branches ≥ 30%, functions ≥ 35%, lines/statements ≥ 38%.

---

Security-Critical File Status

File	Stmts	Branches	Funcs	Lines	Status
host-iptables-rules.ts	100%	100%	100%	100%	✅
host-iptables-shared.ts	100%	100%	100%	100%	✅
host-iptables-cleanup.ts	100%	100%	100%	100%	✅
squid/acl-generator.ts	100%	100%	100%	100%	✅
squid/access-rules.ts	100%	100%	100%	100%	✅
squid/domain-acl.ts	100%	100%	100%	100%	✅
squid/validation.ts	100%	100%	100%	100%	✅
domain-patterns.ts	100%	89.5%	100%	100%	⚠️ 2 uncovered branches
squid/policy-manifest.ts	87.5%	88.2%	70%	87.2%	⚠️ 3 uncovered functions
services/agent-volumes/etc-mounts.ts	82.5%	67.9%	100%	82.5%	❌ 9 uncovered branches

---

Files Below 80% Branch Coverage

File	Branch Cov.	Uncovered	Risk
services/agent-volumes/etc-mounts.ts	67.9% (19/28)	9	🔴 Security
services/agent-volumes/docker-host-staging.ts	72.4% (21/29)	8	🟡 Medium
logs/audit-enricher.ts	74.1% (43/58)	15	🟡 Medium
services/agent-volumes/system-mounts.ts	75.0% (9/12)	3	🟡 Medium
commands/validators/log-and-limits.ts	77.6% (45/58)	13	🟡 Medium
logs/log-streamer.ts	77.8% (28/36)	8	🟡 Medium
cli.ts	50.0% (1/2)	1	🟠 Entry point
squid/policy-manifest.ts	88.2% (30/34)	4	🔴 Security

---

🔍 Notable Findings

1. squid/policy-manifest.ts — 3 uncovered functions (70% function coverage)

The generatePolicyManifest function assembles the full Squid ACL policy at runtime. Three inline callbacks remain uncovered, corresponding to three distinct policy code paths:

• Blocked-domains explicit deny (blockedDomains branch, lines 131–158): neither deny-blocked-plain nor deny-blocked-regex rules are exercised by tests. These rules implement the --block-domains flag — a hard-deny list that should be exercised in isolation from the allow-list.
• Protocol-specific HTTP-only or HTTPS-only domain allows (lines 161–205): tests only cover the both-protocol path; the (redacted) and https://protocol-prefix paths throughdomainsByProto.http/domainsByProto.https` are untested. These were added to prevent over-broad allowlisting (see fix: add bare API proxy targets as https:// only to prevent over-broad allowlisting #5130) and have no test coverage in the manifest generator.

2. services/agent-volumes/etc-mounts.ts — 67.9% branch coverage (19/28)

This module controls which /etc identity files (passwd, group) are bind-mounted into the agent container. The uncovered branches are all within the DinD staging path (lines 75–123):

• Synthesized minimal /etc/passwd when the runner has none
• resolveUniqueName counter-increment loop (the while body, line 54)
• readFileContent returning undefined for a staged file
• synthesizeIdentityFile silently returning undefined on mkdirSync failure

These paths are reachable in ARC/DinD environments where the runner filesystem is minimal. An untested failure in this module could cause the agent to run with a missing or malformed /etc/passwd, breaking UID-to-username resolution inside the container.

3. domain-patterns.ts — 2 uncovered branches after recent refactor (commit 777ee828)

The wildcardToRegex function's switch statement has 2 uncovered branches. Based on the character-class cases (lines 111–128), the un-hit cases are likely some of the less-common regex metacharacter escapes (e.g., +, {, |, \). Domain pattern normalization is a classic ACL-bypass surface — a missed escape could allow a crafted domain name to match unintended entries in Squid's dstdom_regex ACL.

4. logs/audit-enricher.ts — 74.1% branch coverage (43/58), 83.6% statement coverage

The audit enricher joins Squid access-log entries with the policy manifest for security reporting. With ~26% of branches uncovered, log entries for certain policy rule types (e.g., deny-dlp, deny-blocked-regex) may not be correctly attributed in audit output. This creates a gap in post-incident forensics rather than a runtime security risk, but it means the audit trail is unverified for some denial categories.

---

📈 Recommendations

🔴 High — Add tests for blocked-domain and protocol-specific paths in squid/policy-manifest.ts

Write tests that call generatePolicyManifest with:

1. A non-empty blockedDomains array (exercises deny-blocked-plain + deny-blocked-regex rules)
2. Domains prefixed with (redacted) and https://` (exercises the protocol-split allow rules)

This raises function coverage from 70% to ~100% and directly validates that the --block-domains flag generates the correct ACL order.

🟡 Medium — Cover DinD edge cases in services/agent-volumes/etc-mounts.ts

Mock stageHostFile to return undefined (missing file on runner) and mock synthesizeIdentityFile to return undefined (disk-write failure). Also add a test where the staged passwd/group already contains the runner UID/GID — confirming no duplicate entry is appended. These scenarios are realistic in ARC-DinD runners and currently have zero coverage.

🟢 Low — Close the 2 remaining branches in domain-patterns.ts post-refactor

Add test cases to wildcardToRegex for domains containing +, {, |, and \ characters. These are edge-case inputs but confirm the ReDoS-prevention logic isn't accidentally defeated by uncommon metacharacters. Given the recent refactor (#5063), a quick targeted test pass would confirm the split didn't silently drop any escape handling.

Generated by Test Coverage Reporter · ◷

• expires on Jun 24, 2026, 12:27 AM UTC

[github-actions[bot]]

🔮 The ancient spirits stir, and the smoke test agent was here. The omens are observed, the path is traced, and the run continues in balance.

🔮 The oracle has spoken through Smoke Codex

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-24T00:27:10.454Z.

Closed by Workflow