Test/increase coverage - #88
Draft
SanadAlrowaili wants to merge 25 commits into
Draft
Conversation
This workflow generates SLSA provenance files for projects, satisfying level 3 requirements. It includes steps for building artifacts and generating subjects for provenance.
chore: use common version across all packages
Revert "chore: use common version across all packages"
Add TestTrader contract for token swapping
# Vade Implementation Report ## Summary Implemented Vercel Web Analytics documentation as requested. Created a comprehensive guide for integrating Vercel Web Analytics across multiple frontend frameworks. ## Changes Made ### Created Files - `docs/vercel-web-analytics.md` - Complete documentation guide for Vercel Web Analytics integration ## Implementation Details The documentation file includes: 1. **Prerequisites section** - Requirements for setting up Vercel Web Analytics including account creation, project setup, and CLI installation 2. **Framework-specific integration guides** for: - Next.js (Pages Directory) - Next.js (App Router) - Remix - Nuxt - SvelteKit - Astro - HTML (Plain HTML sites) - Create React App - Vue - Other frameworks (generic integration) 3. **Step-by-step instructions** including: - Enabling Web Analytics in Vercel dashboard - Installing the `@vercel/analytics` package - Adding the Analytics component/function to each framework - Deployment instructions - Viewing analytics data in the dashboard 4. **Next steps section** with links to: - Package documentation - Custom events - Data filtering - Privacy and compliance - Pricing - Troubleshooting ## Code Quality - Build completed successfully with no new errors - Pre-existing linting errors are unrelated to the documentation changes - No new dependencies were added - Lock files remain unchanged as no package.json modifications were made ## Notes The documentation file is placed in a new `docs/` directory at the repository root, following common documentation organization patterns. The content provides comprehensive framework-specific instructions for integrating Vercel Web Analytics into various types of web applications. Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
# Vade Implementation Report ## Summary Implemented Vercel Web Analytics documentation as requested. Created a comprehensive guide for integrating Vercel Web Analytics across multiple frontend frameworks. ## Changes Made ### Created Files - `docs/vercel-web-analytics.md` - Complete documentation guide for Vercel Web Analytics integration ## Implementation Details The documentation file includes: 1. **Prerequisites section** - Requirements for setting up Vercel Web Analytics including account creation, project setup, and CLI installation 2. **Framework-specific integration guides** for: - Next.js (Pages Directory) - Next.js (App Router) - Remix - Nuxt - SvelteKit - Astro - HTML (Plain HTML sites) - Create React App - Vue - Other frameworks (generic integration) 3. **Step-by-step instructions** including: - Enabling Web Analytics in Vercel dashboard - Installing the `@vercel/analytics` package - Adding the Analytics component/function to each framework - Deployment instructions - Viewing analytics data in the dashboard 4. **Next steps section** with links to: - Package documentation - Custom events - Data filtering - Privacy and compliance - Pricing - Troubleshooting ## Code Quality - Build completed successfully with no new errors - Pre-existing linting errors are unrelated to the documentation changes - No new dependencies were added - Lock files remain unchanged as no package.json modifications were made ## Notes The documentation file is placed in a new `docs/` directory at the repository root, following common documentation organization patterns. The content provides comprehensive framework-specific instructions for integrating Vercel Web Analytics into various types of web applications. Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
Co-authored-by: Dmitry Chepurovskiy <d.chepurovskiy@1inch.io>
…n permissions (#9) Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Added a security policy document outlining supported versions and vulnerability reporting.
…dates (#10) Bumps the npm_and_yarn group with 1 update in the / directory: [bn.js](https://github.com/indutny/bn.js). Updates `bn.js` from 4.12.2 to 4.12.3 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](indutny/bn.js@v4.12.2...v4.12.3) Updates `immutable` from 4.3.7 to 4.3.8 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v4.3.7...v4.3.8) Updates `qs` from 6.14.0 to 6.15.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.0...v6.15.0) --- updated-dependencies: - dependency-name: bn.js dependency-version: 4.12.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: immutable dependency-version: 4.3.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.15.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Local `pnpm audit` reported 174 advisories on master (2 critical, 85 high). This applies `pnpm audit --fix` overrides, then bounds every one of them to its current major line. Total advisories: 174 -> 26. Critical: 2 -> 0. Production dependencies: `pnpm audit --prod` now reports no known vulnerabilities. The only prod-reaching issue was `ws` (via viem in typescript/aqua), now resolved to 8.21.1 / 7.5.13: - GHSA-96hv-2xvq-fx4p (high) ws memory-exhaustion DoS - GHSA-58qx-3vcg-4xpx (moderate) ws uninitialized memory disclosure `pnpm audit --fix` emits unbounded `>=x.y.z` replacements, which silently override the `^` intent in package.json and pull in new majors. Left as generated they resolved nx to 23.x, vitest to 4.x, vite to 8.x, ajv to 8.x and minimatch to 10.x - breaking peer ranges and every eslint run (ajv removed the `missingRefs` option in 7.x; minimatch dropped its default export). All 89 replacements are therefore pinned with `^`, with comments on the four that caused real breakage. The 26 remaining advisories are all dev-only, reached through @1inch/aqua -> @1inch/solidity-utils (hardhat/jest toolchain) and ts-node. They need a patched range that only exists in a newer major, so they cannot be fixed here without a breaking upgrade upstream. `elliptic` has no patched version published at all. Also adds .github/dependabot.yml - the repo had no Dependabot config, so nothing was keeping these current. Security updates are grouped separately from routine bumps so they can be merged quickly. Verified: build, type-check and test all pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The 'should extract last 10 bytes' test could never pass. Its address literal was 'l0xC65F...' - a stray leading `l` - so the Address constructor threw before the assertion was ever reached. Removing the typo exposed a second fault: the expected value '0x9d4a2e9eb0ce3606eb48' does not correspond to this address. Because the constructor always threw, that expectation had never been evaluated. AddressHalf documents itself as the last 10 bytes (80 bits) of an Ethereum address, and Address.lastHalf() implements exactly that - add0x(val.slice(-20)). For 0xC65F20579D3Eb3757281cddA51883C17F6c07715 the last 20 hex characters are cdda51883c17f6c07715, so the expected value is corrected to match the documented behaviour rather than the reverse. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Adds tests for the four weakest files in the coverage report:
interaction.ts 0% -> 100%
swapped-event.ts 0% -> 100%
swap-vm-contract.ts 56.94% (20% fns) -> 100%
concentrate/utils.ts 6.45% (0% fns) -> ~100%
Notable findings while writing these:
- `Interaction` cannot hold empty data. `isHexBytes('0x')` is false, so both
the constructor and `decode()` throw for a bare 20-byte target. The tests
assert that rather than the more intuitive empty-data behaviour.
- `computeDeltas` returns negative deltas for any price strictly between
priceMin and priceMax. `sqrt()` halves the fixed-point scale - its argument
is 1e18-scaled so the result is 1e9-scaled - and the function then subtracts
TEN_POW_18 from it. sqrt(2e18) is 1_414_213_562, so the divisor lands around
-1e18. Only the explicit boundary ternaries return a sane value. The function
is exported from the package root, so this reaches consumers; nothing in this
repo calls it, which is why 6.45% coverage hid it. Correcting the maths needs
a decision on intent (likely sqrt((price * 1e36) / priceMin)), so it is left
alone here and pinned with `it.fails`, which passes while the defect stands
and starts failing once it is fixed.
- The existing SwapVMContract tests only asserted `toBeInstanceOf(HexString)`.
The new ones decode the calldata back with viem and compare against the
inputs, which is what caught that viem returns checksummed addresses where
`Address` normalises to lowercase.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Nothing enforced coverage before this: no thresholds existed in any config, in typescript/vitest.preset.mjs, or in CI, so coverage could regress silently. Thresholds are set a couple of points below the levels measured here so a regression fails the build without the suite being brittle. aqua 97 / 99 / 80 / 97 (measured 98.85 / 100 / 81.25 / 98.85) sdk-core 43 / 94 / 81 / 43 (measured 44.88 / 96 / 83.33 / 44.88) swap-vm 90 / 96 / 80 / 90 (measured 92.23 / 97.84 / 81.81 / 92.23) sdk-core also gets the coverage scoping the other two packages already had. It was the only package with no `include`/`exclude`, so a build config, four barrel files and a 222-line generated ABI array were all being counted; that alone was reporting 24.64% where the comparable figure is 44.88%. This raises the number without adding a single test, hence calling it out explicitly. src/test-utils is deliberately NOT excluded despite sitting at 0%. It is a published entry point (the `./test-utils` export in package.json), so its lack of coverage is a real gap and should stay visible rather than be configured away. It is what holds sdk-core's statement coverage down. Note that typescript/vitest.preset.mjs is dead config - none of the three packages reference it - so the thresholds are set per package instead. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Adds lcov output, per-package uploads and a codecov.yml. The vitest configs relied on the default reporters, which emit clover.xml and coverage-final.json but no lcov, so there was nothing for Codecov to read. `reporter: ['text', 'html', 'lcov']` is now set explicitly on all three. Uploads are per package rather than one bulk `directory: ./coverage`. Each package writes lcov with paths relative to its own root (SF:src/...), so all three reports are indistinguishable to Codecov and a single upload would conflate three different trees. Each step therefore points `root_dir` at the owning package and carries its own flag, which also keeps the very different baselines visible instead of averaged: aqua ~98.9% swap-vm ~92.2% sdk-core ~44.9% Uploads are best-effort - `affected:test` only runs the projects a PR touches, so a report can legitimately be absent; `fail_ci_if_error: false` plus `continue-on-error` keeps that from failing the build. codecov.yml starts advisory (`informational: true` on both project and patch) so this reports without blocking merges until the team opts in. The ignore list mirrors the vitest coverage excludes. Requires a CODECOV_TOKEN repository secret; without it the upload steps skip harmlessly. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change Summary
What does this PR change?
Related Issue/Ticket:
Testing & Verification
How was this tested?
Risk Assessment
Risk Level:
Risks & Impact