[Coverage Report] Test Coverage Report — 2026-08-21

[github-actions[bot]]

📊 Test Coverage Report — 2026-08-21

Overall Coverage

The gh-aw-firewall codebase demonstrates strong test coverage across all dimensions:

Metric	Coverage	Covered	Total
Statements	92.52%	10,228	11,054
Branches	85.76%	5,613	6,545
Functions	93.05%	1,394	1,498
Lines	93.67%	9,815	10,478

Overall, the codebase exceeds the 80% threshold across all metrics, indicating mature test infrastructure.

---

🛡️ Security-Critical Path Status

Good News: Most security-critical files have excellent coverage:

File	Statements	Branches	Status
src/host-iptables.ts	100%	100%	✅ Fully covered
src/host-iptables-rules.ts	100%	100%	✅ Network isolation rules fully tested
src/host-iptables-shared.ts	100%	100%	✅ iptables utilities fully tested
src/host-iptables-validation.ts	100%	100%	✅ Validation logic fully tested
src/squid-config.ts	100%	100%	✅ Domain ACL generation fully tested
src/domain-patterns.ts	100%	89.47%	✅ Pattern matching well-tested
src/docker-manager.ts	100%	100%	✅ Container lifecycle fully tested

Critical Gap Identified:

File	Statements	Branches	Status	Issue
src/bounded-execution/finite-disclosure.ts	9.26%	0.26%	❌ CRITICAL	Only 43 of 464 statements tested; nearly all branches untested

---

📋 Coverage Table

Host iptables Network Isolation (Security-Critical)

• ✅ src/host-iptables.ts — 100% (wrapper/export module)
• ✅ src/host-iptables-rules.ts — 100% (96 LOC, 9 functions)
• ✅ src/host-iptables-shared.ts — 100% (90 LOC, 15 functions)
• ✅ src/host-iptables-validation.ts — 100% (29 LOC, 4 functions)
• ✅ src/host-iptables-chain.ts — 100% (42 LOC, 3 functions)
• ✅ src/host-iptables-cleanup.ts — 100% (17 LOC, 2 functions)
• ✅ src/host-iptables-network.ts — 100% (16 LOC, 1 function)

Squid Proxy & Domain Filtering (Security-Critical)

• ✅ src/squid-config.ts — 100% (wrapper/export module)
• ✅ src/domain-patterns.ts — 100% statements, 89.47% branches

Docker & Container Management

• ✅ src/docker-manager.ts — 100% (14 LOC, 11 functions)
• ✅ src/cli.ts — 85.71% statements, 50% branches

Bounded Execution (New Feature)

• ❌ src/bounded-execution/finite-disclosure.ts — 9.26% statements, 0.26% branches (464 LOC, 44 functions)
• ✅ src/bounded-execution/index.ts — 100%
• ✅ src/bounded-execution/repository-staging.ts — 100%
• ✅ src/bounded-execution/runtime-probes.ts — 100%

---

🔧 Function Audit

Total Functions: 1,498 across codebase
Covered Functions: 1,394 (93.05%)
Uncovered Functions: 104

Key observations:

• All host iptables functions (60+ across modules) are fully tested
• All squid config functions are fully tested
• Most domain pattern functions are fully tested
• Bounded execution has only 2/44 functions covered — represents ~25% of uncovered functions in the entire codebase

---

📅 Recent Source Changes (last 7 days)

Recent commits indicate active development in:

1. Container workdir ownership (Repair container workdir ownership on native-root runners and fail loudly when unwritable #7599) — affects docker-manager.ts (✅ 100% covered)
2. Container image manifest support (Support compiler-authorized digest-pinned container image manifests #7601) — affects container config (✅ covered)
3. Cloud Hypervisor readiness (Fix Cloud Hypervisor API proxy readiness race #7582) — affects cloud hypervisor modules (⚠️ limited coverage in new code)
4. OpenAI-compatible API targets (feat: support secret-backed OpenAI-compatible targets #7576) — affects API proxy routing (⚠️ check coverage)
5. Native-root runner support (Repair gh-aw config ownership for native-root runners #7565) — affects permissions handling

None of the critical path files (host-iptables.ts, squid-config.ts, domain-patterns.ts) were directly modified, indicating stability in network isolation layer.

---

🔎 Notable Findings

1. Network Isolation Excellence — All 7 host-iptables modules achieve 100% statement and branch coverage. The firewall's core network isolation mechanism is thoroughly tested and trustworthy.

2. Critical Coverage Gap in Bounded Execution — finite-disclosure.ts (464 lines, 44 functions) is a new security feature with only 9.26% statement coverage and 0.26% branch coverage. This is the only file below 80% across the entire codebase and should be prioritized immediately.

3. Domain ACL & Proxy Filtering Solid — squid-config.ts (domain ACL generation) and domain-patterns.ts (pattern matching) both exceed 89% coverage, ensuring HTTP/HTTPS filtering rules are well-tested.

4. Docker Lifecycle Well-Tested — Container orchestration in docker-manager.ts is 100% covered, indicating reliable container startup/shutdown for all code paths.

---

🎯 Recommendations

[HIGH] Increase Test Coverage for bounded-execution/finite-disclosure.ts

• Priority: Critical
• Current State: 9.26% statement coverage, 0.26% branch coverage (only 43/464 statements tested)
• Impact: This module implements bounded execution constraints for untrusted code. Insufficient coverage leaves security vulnerabilities unexposed.
• Action Items:
  1. Add unit tests for all 44 functions in the module (currently only 2 covered)
  2. Test all conditional branches (377 branches, only 1 tested)
  3. Add integration tests for bounded execution workflows
  4. Target: ≥85% statements and ≥75% branches
• Estimated Effort: 2–3 days

[MEDIUM] Improve Branch Coverage in CLI Entry Point (src/cli.ts)

• Priority: Medium
• Current State: 85.71% statements, 50% branches (1/2 branches covered)
• Impact: CLI argument parsing is the entry point for user-facing behavior; untested branches could hide argument validation gaps.
• Action Items:
  1. Identify which branch is untested (likely error/edge case handling)
  2. Add test case for that condition
  3. Target: 100% branches
• Estimated Effort: < 1 day

[LOW] Monitor New Cloud Hypervisor Modules for Coverage Creep

• Priority: Low (ongoing)
• Current State: Cloud Hypervisor modules added recently; verify test coverage remains above 80%
• Impact: New runtime backends must maintain the same test rigor as existing iptables/Squid code
• Action Items:
  1. Review coverage for all src/cloud-hypervisor/ and src/microvm/ modules
  2. Ensure new PRs don't decrease coverage below 80% for any new files
  3. Add pre-commit hook or CI check if not already present
• Estimated Effort: Ongoing (CI configuration)

Generated by Test Coverage Reporter · sum00 · 14.1 AIC · ⊞ 5.4K · ◷

• expires on Aug 28, 2026, 5:19 PM UTC