[Coverage Report] Test Coverage Analysis — 2026-09-21

[github-actions[bot]]

📊 Test Coverage Report — 2026-09-21

Overall Coverage

Aggregate metrics across 124 source files:

Metric	Coverage	Status
Lines	93.28% (14,952 / 16,028)	✅ Excellent
Statements	91.94% (15,682 / 17,055)	✅ Excellent
Functions	92.00% (2,314 / 2,515)	✅ Excellent
Branches	85.63% (9,124 / 10,655)	⚠️ Good, but gap exists

---

🛡️ Security-Critical Path Status

Files responsible for network isolation and domain filtering:

File	Lines	Statements	Functions	Branches	Status
src/host-iptables.ts	100%	100%	100%	100%	✅ Secure
src/host-iptables-rules.ts	100%	100%	100%	100%	✅ Secure
src/host-iptables-chain.ts	100%	100%	100%	100%	✅ Secure
src/host-iptables-shared.ts	100%	100%	100%	100%	✅ Secure
src/domain-patterns.ts	100%	100%	100%	89.5%	✅ Secure*
src/docker-manager.ts	100%	100%	100%	N/A	✅ Secure
src/squid-config.ts	100%	100%	100%	N/A	✅ Secure

* Branch coverage gap at 89.5%: Some edge cases in domain pattern validation (6 branch paths) remain untested. However, all executable statements are covered. Consider adding tests for boundary conditions (e.g., deeply nested subdomains, Unicode handling).

---

📋 Coverage Table

High-risk files with <80% statement coverage:

File	Statements	Branches	Issue	Risk Level
src/bounded-execution/finite-disclosure.ts	38.12% ⚠️	25.89%	Core finite-disclosure logic untested	🔴 CRITICAL
src/nvx/index.ts	0% ⚠️	100%	Main entry point not exercised	🔴 CRITICAL
src/microvm/network-reservation.ts	50.22% ⚠️	54.26%	Half of network allocation logic untested	🟠 HIGH
src/nvx/preflight.ts	63.15%	62.29%	Pre-execution checks partially covered	🟠 HIGH
src/enclave/runtime-preflight.ts	68.42%	43.90%	Enclave startup validation weak	🟠 HIGH

Notable gaps in supporting modules:

File	Statements	Issue
src/enclave/github-gateway.ts	79.71%	GitHub API integration logic under-tested
src/enclave/staging.ts	86.36%	Enclave artifact staging incomplete
src/microvm/rootfs.ts	71.69%	Root filesystem builder gaps
src/nvx/one-shot-adapter.ts	77.36%	One-shot execution adapter logic under-covered

---

🔧 Function Audit

Functions never exercised (0 coverage within covered branches):

• src/nvx/index.ts: 35 functions — all untested
  • All re-exports and composition functions lack test coverage
  • No integration tests for the module's public API

Functions partially covered (45–89% range):

• src/nvx/preflight.ts: 45.45% function coverage (5 of 11 functions)

  • Missing: edge-case handlers for invalid configurations

• src/enclave/runtime-preflight.ts: 100% functions listed, but only 68.42% statements

  • Functions exist but conditional branches are untested
  • Missing: error recovery paths

• src/microvm/network-reservation.ts: 56.81% function coverage (25 of 44 functions)

  • Missing: network conflict resolution, IP allocation edge cases

---

📅 Recent Source Changes (last 7 days)

Unable to retrieve recent git history due to environment constraints. Review the git log manually:

cd /home/runner/work/gh-aw-firewall/gh-aw-firewall && \
git log --oneline --since="7 days ago" -- src/

Files in focus:

• Monitor changes to src/nvx/* (0% coverage on index.ts is a regression risk)
• Monitor changes to src/bounded-execution/finite-disclosure.ts (38% is low for a security-critical module)
• Watch src/enclave/runtime-preflight.ts (pre-execution validation; regressions are security risks)

---

🔎 Notable Findings

1. 🔴 CRITICAL: src/nvx/index.ts — 0% Statement Coverage

   • The entire NVX module's public interface is untested.
   • This is a regression: either tests were removed or the file is new without test harness integration.
   • Impact: No test coverage for the module that orchestrates one-shot execution environments.
   • Action: Add integration tests that exercise the exported API.

2. 🔴 CRITICAL: src/bounded-execution/finite-disclosure.ts — 38.12% Statement Coverage

   • 388 lines, only 172 covered. 25.89% branch coverage indicates most decision paths untested.
   • Impact: Disclosure budgeting and finite-resource enforcement may have untested error paths.
   • Action: Prioritize tests for budget exhaustion, concurrent-request limits, and cache-eviction logic.

3. ⚠️ Branch Coverage Below 90% for Security-Critical Files

   • src/domain-patterns.ts: 89.47% (2 branch misses)
   • src/host-iptables-network.ts: 88.88% (1 branch miss)
   • Impact: Edge-case domain matching or network rule generation could be silently broken.
   • Action: Add tests for boundary conditions (empty domains, internationalized names, subnet edge cases).

4. 🟠 HIGH: src/microvm/network-reservation.ts — 50.22% Statement Coverage

   • Nearly half of the network allocation and reservation logic is untested.
   • Impact: IP conflicts, subnet exhaustion, and cleanup paths may fail silently.
   • Action: Add tests for network conflict scenarios, IP pool depletion, and cleanup verification.

---

🎯 Recommendations

Priority 1 (CRITICAL) — Fix in next release

• Add tests for src/nvx/index.ts

  • Severity: CRITICAL | Confidence: 9/10
  • Create integration tests that import and exercise the public API.
  • Verify that one-shot execution environments are properly initialized.
  • Estimate: 2–3 hours for test authoring + validation.

• Increase statement coverage in src/bounded-execution/finite-disclosure.ts to >80%

  • Severity: CRITICAL | Confidence: 8/10
  • Add tests for budget-exhaustion scenarios, concurrent request handling, and cache eviction.
  • Verify error handling paths (e.g., when a request exceeds budget).
  • Estimate: 4–5 hours for comprehensive test coverage.

Priority 2 (HIGH) — Address in current iteration

• Achieve >90% branch coverage for src/domain-patterns.ts

  • Severity: HIGH | Confidence: 7/10
  • Add 2 additional test cases to exercise boundary conditions in domain matching.
  • Verify subdomain edge cases (e.g., ., .., internationalized domains).
  • Estimate: 1 hour.

• Increase src/microvm/network-reservation.ts to >75% statement coverage

  • Severity: HIGH | Confidence: 7/10
  • Add tests for IP conflict detection, subnet exhaustion, and cleanup.
  • Verify that reserved IPs are properly released.
  • Estimate: 3 hours.

Priority 3 (MEDIUM) — Monitor & improve

• Improve enclave preflight coverage

  • Severity: MEDIUM | Confidence: 6/10
  • src/enclave/runtime-preflight.ts and src/nvx/preflight.ts have weak branch coverage.
  • Add tests for misconfigured enclaves, missing dependencies, permission errors.
  • Estimate: 2–3 hours.

• Track coverage trend

  • Add a CI check that fails if any file's statement coverage decreases from the previous run.
  • Ensure new code is added with ≥95% statement coverage (test-first approach).

---

Report generated on 2026-09-21
Next review recommended: 2026-09-28 (or after significant changes to nvx, bounded-execution, or microvm modules)

Generated by Test Coverage Reporter · copilot · sum00 · 19.8 AIC · ⊞ 5.3K · ◷

• expires on Sep 28, 2026, 4:54 PM UTC