[Coverage Report] Test Coverage Report — 2026-05-09 #2777
Closed
Replies: 2 comments
-
|
🔮 The ancient spirits stir... the Codex smoke test agent was here, leaving a brief shimmer in the workflow ether. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Beta Was this translation helpful? Give feedback.
0 replies
-
|
This discussion was automatically closed because it expired on 2026-05-16T00:43:28.667Z.
|
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
📊 Overall Coverage
Total: 3,527 / 4,030 statements covered across 51 source files, 49 test files, 135+ tests.
🔴 Critical Gaps (< 50% statement coverage)
src/cli.tscli.tsis the main entry point and orchestrates the entire firewall lifecycle. With only 5.28% branch coverage, argument parsing, signal handling, error paths, and the main startup/shutdown flow are almost entirely untested.🟡 Low Coverage (50–79%)
src/container-cleanup.tsCleanup error paths (partial cleanup, network teardown failures) are the likely uncovered branches.
🛡️ Security-Critical Path Status
src/host-iptables.tssrc/squid-config.tssrc/docker-manager.tssrc/domain-patterns.tssrc/cli.tsAll security-critical firewall modules (
host-iptables,squid-config,docker-manager,domain-patterns) are well-covered. The only critical gap iscli.ts— the entry point that wires them all together.📋 Full Coverage Table
src/cli.tssrc/container-cleanup.tssrc/logs/audit-enricher.tssrc/logs/log-parser.tssrc/host-iptables.tssrc/commands/logs-command-helpers.tssrc/container-lifecycle.tssrc/cli-workflow.tssrc/services/doh-proxy-service.tssrc/services/agent-volumes.tssrc/logs/log-streamer.tssrc/ssl-bump.tssrc/logs/log-aggregator.tssrc/services/cli-proxy-service.tssrc/upstream-proxy.tssrc/squid-config.tssrc/pid-tracker.tssrc/logs/log-formatter.tssrc/services/agent-service.tssrc/domain-patterns.tssrc/services/agent-environment.tssrc/config-file.tssrc/rules.tssrc/host-env.tssrc/services/api-proxy-service.tssrc/compose-generator.tssrc/option-parsers.tssrc/api-proxy-config.tssrc/copilot-api-resolver.tssrc/dlp.tssrc/dns-resolver.tssrc/docker-manager.tssrc/domain-utils.tssrc/env-utils.tssrc/image-tag.tssrc/logger.tssrc/redact-secrets.tssrc/schema-validator.tssrc/commands/logs-audit.tssrc/commands/logs-stats.tssrc/commands/logs-summary.tssrc/commands/logs.tssrc/commands/predownload.tssrc/logs/index.tssrc/logs/log-discovery.tssrc/logs/stats-formatter.tssrc/services/squid-service.ts🔍 Notable Findings
src/cli.ts— near-zero branch coverage (5.28%): This 426-line file exports 69 functions, only 8 of which are covered. Uncovered areas include CLI argument parsing edge cases,--enable-api-proxy,--build-local, signal handlers (SIGINT/SIGTERM), and the mainrun()orchestration flow. A failure here wouldn't be caught by the test suite.src/host-iptables.ts— 19% uncovered branches: ThesetupHostIptables()function has 18 conditional branches, 10 covered. The gaps likely include IPv6-specific paths, error handling inensureFirewallNetwork(), and thecleanupHostIptables()/cleanupFirewallNetwork()teardown paths.src/logs/log-parser.ts— branch coverage 68.57%: Parser error paths and edge-case log line formats are likely uncovered. These paths would be exercised if Squid emits malformed or unexpected log entries.src/container-cleanup.ts— 22.93% uncovered statements: Cleanup runs after everyawfexecution. Uncovered branches likely include partial-cleanup scenarios, timeout handling, and Docker daemon error paths that only manifest under failure conditions.📈 Recommendations
High —
src/cli.tsbranch coverage: Add tests for--enable-api-proxy,--build-local, invalid flag combinations, and SIGINT/SIGTERM signal handling. Even minimal integration-style tests that mockdocker-managerwould dramatically raise branch coverage from 5.28%.Medium —
src/host-iptables.tserror paths: Add tests forcleanupHostIptables()andcleanupFirewallNetwork()failure cases (e.g., iptables command failure, network already removed). These run on everyawfexit.Low —
src/container-cleanup.tserror branches: Test partial cleanup scenarios where some containers have already exited or volumes are already removed before cleanup runs.Generated by test-coverage-reporter workflow · Trigger:
push· Run: 25586536240Beta Was this translation helpful? Give feedback.
All reactions