fix(docker): guard nil Config, and raise coverage to 90% for Best Practices Gold

[CybotTM]

Follow-ups to the security and quality reports on the repository's dashboards. Each item below was verified before acting; the ones that turned out to be false positives are dismissed at the source with a justification rather than worked around in code.

A crash, found by writing the coverage tests

convert.go and image.go both read Labels straight off the SDK's Config field. Config is a pointer in container.InspectResponse and image.InspectResponse, so a daemon that omits it — a socket proxy, or a Docker-compatible API that fills in less than Docker does — is a nil dereference on a path that does not recover: the scheduler goes down.

The surrounding code already treats this as a real shape (State and State.Health are guarded a few lines below the container dereference). Config was the field that was missed, and it is the same defect ErrNilContainerConfig was added for in #632/#626, in the two places that fix did not reach.

Both regression tests were confirmed to fail against the unpatched code.

Coverage: 87.64% → 90.08%

OpenSSF Best Practices Gold asks for ≥90% statement coverage. The gap sat where a daemon or a process boundary made code awkward to reach:

	before	after
core/adapters/docker	66.7%	78.3%
root (ofelia.go)	22.0%	95.1%
repository	87.64%	90.08%

A stub daemon answers as Docker would, so each adapter's translation is asserted directly — container lifecycle, the stdcopy demultiplexing CopyLogs performs, system/image/network calls, and the swarm polling loops including both exits (terminal task, and the timeout that stops a wedged job hanging the scheduler). main() is driven over --version, --help, an unknown command and a bare invocation, so a command dropped from the parser fails a test instead of only surfacing when a user runs the binary.

Branch coverage (the second Gold criterion) is not addressed here and cannot be from this repository: Go's toolchain measures statements, not branches, and there is no established FLOSS branch-coverage tool for Go. That criterion needs a justified N/A on bestpractices.dev, which is a change to the badge questionnaire rather than to this repo.

Codecov components

The Components page was empty — codecov.yml declared no component_management, so a coverage drop said nothing about where it happened. Components now follow the boundaries in ARCHITECTURE.md; core negates the adapter and persistence subtrees so those files are not counted twice. Validated against https://codecov.io/validate.

Dismissed at the source (no code change — the code is correct)

• 13× CodeQL go/log-injection in web/server.go. Every one passes req.Name as a structured slog attribute, and ofelia.go:39 installs the stdlib slog.NewTextHandler, which escapes newlines in attribute values and in the message — verified empirically with a payload containing a full forged log line. The action concatenated into two of those messages is a compile-time literal from server.go:618,622. Sanitizing the values would add code that demonstrably prevents nothing.
• 2× Scorecard PinnedDependencies on zizmor.yml:18 and verify-release.yml:90. Both point at netresearch/.github reusables — first-party, misclassified as third-party. Org policy keeps them on @main so upstream security fixes propagate; third-party actions stay hash-pinned.
• 1× zizmor dangerous-triggers on the workflow_run in verify-release.yml. Nothing is checked out, permissions: {} at workflow level with minimal per-job scopes, and the upstream Release workflow fires only on maintainer tag pushes — not fork PRs. The one external value (head_branch) is env-passed and validated against a character allowlist before use.

Open code-scanning alerts on main: 16 → 0.

Reported, not actioned

• Trivy "results may be out of date" is a stale configuration, not a broken scan. The filesystem scan lived in ci.yml and was removed on 2026-04-19 by the template sync (50803c4); the shared go-check.yml uses govulncheck + gosec instead. Trivy still runs as container-scan on every release (last: v0.28.1, 2026-07-28). Clearing the banner means deleting 1016 analyses across 437 refs — GitHub releases only the newest per ref, so the API path is ~1016 chained irreversible deletes. The one-click alternative is Security → Code scanning → Tool status.
• GO-2026-5932 (x/crypto/openpgp unmaintained) is not reachable: 0 occurrences in the build graph, and govulncheck reports 0 vulnerabilities in code. x/crypto is required for bcrypt (cli, web auth). There is no fixed version — introduced: 0 with no fix event — so no upgrade can clear it.
• Missing release provenance is a detection gap, not missing provenance. actions/attest-build-provenance runs in the release; ofelia-linux-amd64 of v0.28.1 has an in-toto attestation retrievable by digest. Scorecard reads release assets and looks for .intoto.jsonl. Fixing it belongs in netresearch/.github, as does the JUnit upload that would populate Codecov Test Analytics.

Test plan

• go test ./... — full suite green, 0 failures
• Coverage measured at 90.0784% (7699/8547 statements)
• golangci-lint run over the whole repo — 0 issues
• lefthook run pre-push — exit 0
• Both nil-Config regression tests confirmed red against the unpatched code
• codecov.yml accepted by Codecov's validator

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[github-actions]

Automated approval for maintainer PR

All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.

[github-actions]

✅ Mutation Testing Results

Mutation Score: 100.00% (threshold: 60%)

✨ Good job! Mutation score meets the threshold.

What is mutation testing?

Mutation testing measures test quality by introducing small changes (mutations) to the code and checking if tests detect them. A higher score means better test effectiveness.

• Killed mutants: Tests caught the mutation (good!)
• Survived mutants: Tests missed the mutation (needs improvement)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.04%. Comparing base (659bb36) to head (56b07b3).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #768      +/-   ##
==========================================
+ Coverage   87.70%   89.04%   +1.33%     
==========================================
  Files          90       90              
  Lines       12057    12059       +2     
==========================================
+ Hits        10575    10738     +163     
+ Misses       1193     1024     -169     
- Partials      289      297       +8     

Flag	Coverage Δ
integration	89.04% <100.00%> (+1.33%)	⬆️
unittests	88.47% <66.66%> (+3.20%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR hardens the Docker SDK adapter layer against nil-pointer dereferences when Docker (or a proxy/compatible API) omits Config in inspect responses, and adds extensive stub-daemon driven tests to raise statement coverage to ≥90% and improve Codecov attribution via components.

Changes:

• Guard Config pointer access in Docker container/image inspect conversions to prevent scheduler crashes.
• Add stub-daemon based adapter tests and main() invocation tests to cover previously hard-to-reach success/termination paths.
• Configure Codecov component management to attribute coverage changes to architectural layers.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
ofelia_main_test.go	Exercises main() parse/return-only paths (--version, --help, invalid/bare invocations) to lock in command wiring and boost root coverage.
core/adapters/docker/service_stub_test.go	Adds stub-daemon tests for Swarm polling loops and terminal/timeout exits, plus allTasksTerminal coverage.
core/adapters/docker/image.go	Prevents nil dereference by reading labels only when img.Config != nil.
core/adapters/docker/convert.go	Prevents nil dereference by reading container labels only when c.Config != nil.
core/adapters/docker/convert_nil_test.go	Adds regression coverage for convertFromContainerJSON when Config is omitted.
core/adapters/docker/container_wrappers_test.go	Introduces stub-daemon tests for container wrapper “success” paths and log demux behavior.
core/adapters/docker/adapters_stub_test.go	Adds stub-daemon tests for system/image/network adapters’ success paths and field mapping.
codecov.yml	Adds Codecov component definitions aligned to architecture boundaries to improve attribution.

Suppressed comments (5)

core/adapters/docker/container_wrappers_test.go:366

• This table test writes to gotPath from the httptest server handler goroutine and reads it in the test goroutine without synchronization; go test -race will flag this. Use a channel (or other synchronization) to pass the observed path back to the test.

			var gotPath string
			adapter := stubDaemon(t, map[string]http.HandlerFunc{
				tc.route: func(w http.ResponseWriter, r *http.Request) {
					gotPath = r.URL.Path
					w.WriteHeader(http.StatusNoContent)

core/adapters/docker/container_wrappers_test.go:390

• This test writes to gotSignal from the httptest server handler goroutine and reads it in the test goroutine without synchronization; go test -race will report a data race. Pass the signal back via a channel (or other synchronization).

	var gotSignal string
	adapter := stubDaemon(t, map[string]http.HandlerFunc{
		"/kill": func(w http.ResponseWriter, r *http.Request) {
			gotSignal = r.URL.Query().Get("signal")
			w.WriteHeader(http.StatusNoContent)

core/adapters/docker/container_wrappers_test.go:411

• This test writes to gotName from the httptest server handler goroutine and reads it in the test goroutine without synchronization; go test -race will report a data race. Use a channel (or other synchronization) to capture the query param value.

	var gotName string
	adapter := stubDaemon(t, map[string]http.HandlerFunc{
		"/rename": func(w http.ResponseWriter, r *http.Request) {
			gotName = r.URL.Query().Get("name")
			w.WriteHeader(http.StatusNoContent)

core/adapters/docker/adapters_stub_test.go:318

• This subtest toggles reached from the httptest server handler goroutine and reads it in the test goroutine without synchronization; go test -race will report a data race. Use a channel (or other synchronization) to signal that the handler was reached.

			reached := false
			adapter := &NetworkServiceAdapter{client: stubSDK(t, map[string]http.HandlerFunc{
				tc.route: func(w http.ResponseWriter, _ *http.Request) {
					reached = true
					w.WriteHeader(http.StatusOK)

core/adapters/docker/service_stub_test.go:189

• poll is incremented in the httptest server handler goroutine and read in the test goroutine without synchronization; go test -race will flag this. Use a channel (or atomic) to drive the handler’s state machine and assert the number of polls in a race-free way.

	poll := 0
	adapter := &SwarmServiceAdapter{client: stubSDK(t, map[string]http.HandlerFunc{
		"/tasks": func(w http.ResponseWriter, _ *http.Request) {
			poll++
			second := string(domain.TaskStateRunning)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Automated approval for maintainer PR

All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.