[Coverage Report] Test Coverage Report — 2026-08-31

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-31

Overall Coverage

The gh-aw-firewall repository maintains excellent test coverage with strong performance across all metrics:

Metric	Coverage	Count
Statements	92.66%	11,769 / 12,700
Branches	85.96%	6,532 / 7,598
Functions	93.27%	1,650 / 1,769
Lines	93.88%	11,251 / 11,984

Status: ✅ Healthy — all metrics exceed 85% threshold, indicating robust test suite maturity.

---

🛡️ Security-Critical Path Status

The firewall's core security components show strong test coverage:

Component	Statements	Functions	Branches	Status
host-iptables.ts	100%	100%	100%	✅ Excellent
host-iptables-rules.ts	100%	100%	100%	✅ Excellent
host-iptables-shared.ts	100%	100%	100%	✅ Excellent
squid-config.ts	100%	100%	N/A	✅ Excellent
domain-patterns.ts	100%	100%	89.47%	✅ Good
domain-matchers.ts	98.14%	100%	95.00%	✅ Good
cli.ts	85.71%	100%	50.00%	⚠️ Needs Review
docker-manager.ts	100%	100%	N/A	✅ Excellent

Key Insight: Network isolation (host-iptables) and domain filtering (squid-config) components have comprehensive test coverage. The CLI entry point (85.71%) shows minimal untested branches, likely related to error paths or rare execution modes.

---

📋 Coverage Table

Top Coverage (≥95%)

• api-proxy-config-domains.ts — 99.03% (HTTP proxy domain configuration)
• api-proxy-config-validation.ts — 96.00% (Proxy validation logic)
• capability-filter.ts — 94.73% (Linux capability filtering)
• artifact-preservation.ts — 94.19% (Log/artifact cleanup)
• compose-generator.ts — 100% (Docker Compose YAML generation)
• chroot-home-setup.ts — 100% (Secure home directory isolation)
• config-file.ts — 100% (Configuration file parsing)
• dind-bootstrap.ts — 100% (Docker-in-Docker setup)
• diagnostic-collector.ts — 100% (Runtime diagnostics)

Coverage Gaps (< 85%)

File	Statements	Branches	Issue
finite-disclosure.ts	9.26%	0.26%	🔴 CRITICAL — Bounded execution/secret sanitization nearly untested
runtime-preflight.ts	66.66%	41.02%	🟡 Medium — Enclave preflight checks 1/3 uncovered
rootfs.ts	71.69%	54.54%	🟡 Medium — Cloud Hypervisor rootfs setup ~28% uncovered
config-assembly.ts	73.68%	25.00%	🟡 Medium — Config validation branches partially tested

---

🔧 Function Audit

Zero-Statement Functions (100% but trivial):

• cli.ts — Entry point re-export (7 lines, 1 uncovered)
• docker-manager.ts — Barrel re-export (19 lines, all covered)
• squid-config.ts — Config factory (4 lines, all covered)

High-Value Functions with Full Coverage:

• host-iptables-rules.ts: 9 functions (iptables rule generation) — 100% statements, 100% branches
• domain-validation.ts: 5 functions (domain ACL parsing) — 100% statements, 100% branches
• env-utils.ts: 5 functions (environment configuration) — 100% statements, 100% branches
• dns-resolver.ts: 7 functions (DNS server allowlist) — 100% statements, 92.85% branches

---

📅 Recent Source Changes (last 7 days)

Key commits to covered files:

1. feat: verify virtiofsd sandbox confinement before VM boot (feat: verify virtiofsd sandbox confinement before VM boot #7890)

   • Affects: src/cloud-hypervisor-runtime-backend.ts (93.51% coverage)

2. feat: require explicit Cloud Hypervisor tool-cache mounts (feat: require explicit Cloud Hypervisor tool-cache mounts #7888)

   • Affects: Cloud Hypervisor backend configuration

3. fix: filter workflow commands from microVM output (fix: filter workflow commands from microVM output #7892)

   • Affects: src/microvm/rootfs.ts (71.69% coverage — gap identified)

4. chore(deps): update safe patch dependencies (chore(deps): update safe patch dependencies #7869)

   • No logic changes; no coverage impact

5. docs: add B28 runner-doctor coverage (docs: add B28 runner-doctor coverage for private-CA api-proxy TLS failures #7871)

   • Documentation only; no coverage impact

Assessment: Recent changes are heavily concentrated in Cloud Hypervisor and microVM features, both of which show moderate coverage gaps (71.69%–76.92% statements). These newer subsystems should be priority for expanded test coverage.

---

🔎 Notable Findings

1. 🔴 CRITICAL: Bounded Execution Secret Sanitization (9.26% statements)

   • src/bounded-execution/finite-disclosure.ts has 374 lines but only 43 are covered
   • This module appears to handle confidentiality boundaries and secret leakage prevention
   • Risk: Untested code paths could fail silently, leaking secrets or execution details
   • Recommendation: Audit this module for test coverage priorities

2. 🟡 Cloud Hypervisor / MicroVM Features Under-Tested

   • cloud-hypervisor-runtime-backend.ts: 93.51% statements, but 76.92% functions uncovered (9/39 functions)
   • rootfs.ts: 71.69% statements; critical for secure VM filesystem setup
   • Context: These are newer features; coverage should improve with integration tests
   • Recommendation: Add unit and integration tests for VM bootstrap and sandboxing logic

3. ⚠️ CLI Entry Point Branch Coverage (50%)

   • cli.ts has minimal branching (2 branches), only 1 covered
   • Likely reflects error handling or conditional startup paths
   • Impact: Low — main logic is delegated to well-tested cli-workflow.ts (98.63%)

4. ✅ Network Isolation & Domain Filtering Are Solid

   • All host-iptables-* modules: 100% coverage
   • domain-patterns.ts and domain-validation.ts: 100% coverage
   • Implication: Core security guarantees are backed by comprehensive tests

---

🎯 Recommendations

🔴 High Priority

1. Test Bounded Execution / Finite Disclosure Module
   • File: src/bounded-execution/finite-disclosure.ts
   • Current: 9.26% statements, 0.26% branches
   • Action: Audit for security-relevant code paths (secret sanitization, info disclosure prevention). Add unit tests for each confidentiality boundary violation scenario. Consider adding integration tests for secret leakage detection.
   • Timeline: 1–2 sprints

🟡 Medium Priority

2. Expand Cloud Hypervisor Backend Coverage

   • File: src/cloud-hypervisor-runtime-backend.ts (93.51% stmts, 76.92% functions)
   • Action: Write tests for the 9 uncovered functions; focus on VM lifecycle (boot, teardown, error cases). Add failure-mode scenarios (socket timeout, invalid configuration, resource exhaustion).
   • Timeline: 1–2 sprints

3. Test microVM RootFS Setup

   • File: src/microvm/rootfs.ts (71.69% statements)
   • Action: Add tests for filesystem preparation, mount configuration, and rootfs validation. Include edge cases (missing directories, permission errors, disk full scenarios).
   • Timeline: 1 sprint

🟢 Low Priority

4. Improve Config Assembly Validator Branch Coverage
   • File: src/commands/validators/config-assembly.ts (73.68% stmts, 25% branches)
   • Action: Audit conditional logic in config merging/validation. Add tests for invalid config combinations and precedence rules.
   • Timeline: 1 sprint (defer if higher-priority items are blocking)

---

Summary

Overall Status: ✅ Healthy — 92.66% statement coverage with strong performance in security-critical paths.

Coverage Trend: Excellent baseline, but recent feature additions (Cloud Hypervisor, enclaves) bring moderate gaps. The project is in a good position for continued security hardening, pending resolution of the finite-disclosure and microVM testing gaps identified above.

Next Steps: Prioritize bounded execution testing (security-critical), then expand Cloud Hypervisor and microVM test suites to match the rigor of the core network isolation components.

Generated by Test Coverage Reporter · copilot · sum00 · 18.9 AIC · ⊞ 5.4K · ◷

• expires on Sep 7, 2026, 4:50 PM UTC

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-07T16:50:01.558Z.

Closed by Workflow