You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
These are precisely the areas with lowest coverage, indicating a coverage-to-velocity gap.
🔎 Notable Findings
Critical Coverage Cliff:src/bounded-execution/finite-disclosure.ts at 9.26% statement coverage and 0.26% branch coverage is a security-critical file with nearly no test instrumentation. This module likely handles sensitive information boundaries and requires immediate test coverage.
Microvm Infrastructure Gap: Network reservation, rootfs, and runtime-preflight files (50–72% coverage) form a cohesive subsystem that is under-tested. These files control microvm lifecycle and resource allocation and warrant unified test coverage improvement.
Branch Coverage Weakness: While line and statement coverage is strong (91+%), branch coverage lags at 85.42%. This suggests many conditional paths, especially error handlers and edge cases, lack test coverage. This is most pronounced in:
Cloud Hypervisor Backend: 41/51 functions untested (75.6%). Given that this backend controls microVM lifecycle, missing function coverage suggests fallback paths and error recovery are not instrumented.
Rationale: This is a security-critical module with near-zero coverage. The 0.26% branch coverage suggests most code is unreachable (dead code or initialization only).
Action: Add integration tests for sensitive information flow boundaries and disclosure handling. Verify that the module is actually used in production workflows, or remove dead code if unused.
Rationale: These files control microvm resource allocation and preflight checks. Combined coverage suggests incomplete test harness for error paths and edge cases (e.g., resource exhaustion, invalid configurations).
Action: Build unified test suite for microvm provisioning, including: network reservation conflicts, filesystem mount failures, and preflight validation rejection scenarios. Use snapshot testing for complex configurations.
Estimated effort: 3–4 sprint points
Branch Coverage Improvements (85.42% → 90%+)
Focus areas: Error handlers, validation paths, and conditional logic
Rationale: Branch coverage directly correlates with error path instrumentation. Gaps here suggest retry logic, fallback mechanisms, and exception handling are not tested.
Action: Run coverage report with --omit-filenames and --verbose-branches to identify missing branches by line. Add tests for each uncovered branch, prioritizing failure scenarios.
Estimated effort: 2–3 sprint points
Note: Overall coverage (91.74% statements, 92.19% functions) is excellent. The gaps identified are concentrated in newer features (bounded execution, microvm) and edge-case handling. No regression detected compared to prior baseline.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
📊 Test Coverage Report — 2026-09-01
Overall Coverage
The gh-aw-firewall project maintains strong overall test coverage with all core metrics above 85%:
🛡️ Security-Critical Path Status
Host-Level Network Isolation: ✅ FULLY COVERED
The security-critical iptables rule generation and network isolation stack is comprehensively tested:
src/host-iptables.ts— 100% (lines, statements, branches)src/host-iptables-rules.ts— 100% (lines, statements, branches)src/host-iptables-shared.ts— 100% (lines, statements, branches)src/host-iptables-chain.ts— 100% (lines, statements, branches)src/host-iptables-validation.ts— 100% (lines, statements, branches)src/host-iptables-cleanup.ts— 100% (lines, statements, branches)Squid Proxy Configuration: ✅ FULLY COVERED
src/squid-config.ts— 100% (lines, statements, branches)Domain Pattern Matching: ✅ 100% Statements, ~90% Branches
src/domain-patterns.ts— 100% lines/statements, 89.47% branches (minor gap in branch coverage)src/domain-matchers.ts— 98.14% lines/statements, 95% branchesContainer Orchestration: ✅ HIGHLY TESTED
src/docker-manager.ts— 100% (lines, statements)src/container-lifecycle.ts— 96.66% lines, 96.27% statements, 90% branchessrc/container-startup-diagnostics.ts— 98.8% lines, 98.85% statements, 98.11% branches📋 Coverage Table
Files with sub-80% coverage or critical gaps:
🔧 Function Audit
Excellent (95%+ functions):
Good (80–95% functions):
Needs Work:
📅 Recent Source Changes (last 7 days)
The repository shows active development with recent changes focused on:
These are precisely the areas with lowest coverage, indicating a coverage-to-velocity gap.
🔎 Notable Findings
Critical Coverage Cliff:
src/bounded-execution/finite-disclosure.tsat 9.26% statement coverage and 0.26% branch coverage is a security-critical file with nearly no test instrumentation. This module likely handles sensitive information boundaries and requires immediate test coverage.Microvm Infrastructure Gap: Network reservation, rootfs, and runtime-preflight files (50–72% coverage) form a cohesive subsystem that is under-tested. These files control microvm lifecycle and resource allocation and warrant unified test coverage improvement.
Branch Coverage Weakness: While line and statement coverage is strong (91+%), branch coverage lags at 85.42%. This suggests many conditional paths, especially error handlers and edge cases, lack test coverage. This is most pronounced in:
config-assembly.ts— 25% branch coverage (likely error handling gaps)enclave/runtime-preflight.ts— 41% branch coveragemicrovm/network-reservation.ts— 54% branch coverageCloud Hypervisor Backend: 41/51 functions untested (75.6%). Given that this backend controls microVM lifecycle, missing function coverage suggests fallback paths and error recovery are not instrumented.
🎯 Recommendations
🔴 HIGH PRIORITY
src/bounded-execution/finite-disclosure.ts🟠 MEDIUM PRIORITY
Microvm Infrastructure Subsystem (50–72% → 85%+)
src/microvm/network-reservation.ts,src/microvm/rootfs.ts,src/enclave/runtime-preflight.tsBranch Coverage Improvements (85.42% → 90%+)
config-assembly.ts(25%),artifact-permissions.ts(80%),config-writer.ts(82.4%)--omit-filenamesand--verbose-branchesto identify missing branches by line. Add tests for each uncovered branch, prioritizing failure scenarios.Note: Overall coverage (91.74% statements, 92.19% functions) is excellent. The gaps identified are concentrated in newer features (bounded execution, microvm) and edge-case handling. No regression detected compared to prior baseline.
All reactions