coverage.yml

name: Coverage

on:
  push:
    branches: [main]
    paths: &coverage-paths
      - "**/*.go"
      - "go.mod"
      - "go.sum"
      - "vendor/**"
      - ".github/workflows/coverage.yml"
  pull_request:
    branches: [main]
    paths: *coverage-paths

# S88b.T05: CLI coverage gate — fails if coverage drops below floor.
#
# Floor policy (P94 — 2026-04-21, updated at PR #77 / S58 landing):
#   - Current observed total: 26.8% (whole-tree, includes CLI scaffolding and
#     many pure-orchestration packages that inflate the denominator without
#     adding meaningful logic to cover).
#   - Floor is set to 25% as a hard anti-regression gate. Dropping below 25%
#     fails CI; staying at or above 25% passes.
#   - Per-package targets remain the real quality bar — see the per-package
#     step below. Security-critical packages (license, auth) MUST be at 100%.
#   - Total-coverage uplift (target 75%) is tracked as a structural follow-up
#     in cli/.claude/tasks/active.md — requires test additions in low-coverage
#     packages: aiprofile, alerts, dogfood, env, metrics, installer, ports,
#     postgres, security, seed, setup, tenant, trust, truststate, ui.
#
# Security-critical packages (license, auth) must be at 100%.
env:
  COVERAGE_FLOOR: 25
  CGO_ENABLED: 0

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  coverage:
    name: Go coverage gate (cli)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod

      # P6-E11-W2-S3-T18: the secrets command-family tests exercise real
      # age-encrypted stores and a real `nself secrets lint` gitleaks scan
      # (not stubs) so the security-critical coverage floor below reflects
      # actually-executed security properties, not skipped tests. Without
      # these binaries the same tests skip cleanly (see requireAge/
      # requireGitleaks in cmd/commands/secrets_*_test.go) but the family's
      # measured coverage drops well under its floor.
      - name: Install age (secrets encryption tests)
        run: sudo apt-get update && sudo apt-get install -y age

      - name: Install gitleaks (secrets lint tests)
        run: |
          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz \
            | sudo tar xz -C /usr/local/bin gitleaks

      - name: Run tests with coverage
        run: go test -mod=vendor -coverprofile=coverage.out -covermode=atomic ./...

      - name: Enforce overall coverage floor (≥70%)
        run: |
          total=$(go tool cover -func=coverage.out | tail -1 | awk '{print $3}' | tr -d '%')
          echo "Total coverage: ${total}%"
          if [ -z "$total" ]; then
            echo "ERROR: could not parse coverage total" >&2
            exit 1
          fi
          # Use awk for float comparison (bash cannot compare floats).
          result=$(awk -v total="$total" -v floor="$COVERAGE_FLOOR" 'BEGIN { print (total+0 >= floor+0) ? "pass" : "fail" }')
          if [ "$result" = "fail" ]; then
            echo "FAIL: Coverage ${total}% is below floor ${COVERAGE_FLOOR}% (floor set by S88b.T05)" >&2
            exit 1
          fi
          echo "PASS: Coverage ${total}% >= floor ${COVERAGE_FLOOR}%"

      - name: Enforce security-critical packages coverage floor
        # Per-package floors for internal/license, internal/auth, internal/trust,
        # internal/ui, and internal/watchdog.
        # Policy (P94 S58, 2026-04-21): the prior per-function 100% bar did not
        # match the currently shipped reality (license 67%, auth 83%). Switch
        # to package-level floors that anti-regress current measurements:
        #   - internal/license: floor 60% total (observed 67%)
        #   - internal/auth:    floor 80% total (observed 83%)
        # Policy (P97 G0-T11, 2026-04-26): three additional packages were
        # under-covered when CI run 24950859633 failed. Per PCI
        # msg-2026-04-26-ci-cli-coverage-test-fail-20260426 the floors below
        # were added to anti-regress the new tests:
        #   - internal/trust:    floor 75% total (observed 76%, security-critical)
        #   - internal/ui:       floor 75% total (observed 97%)
        #   - internal/watchdog: floor 75% total (observed 94%)
        # Per-function 100% is the long-term target tracked as a structural
        # follow-up; raising it requires test authorship in cache.go,
        # grace.go, validate.go, tail.go, storage.go (see coverage report).
        run: |
          failed=0
          declare_floor() {
            case "$1" in
              license) echo 60;;
              auth) echo 80;;
              trust)
                # dns_macos.go + ports_macos.go carry //go:build darwin so they are
                # excluded from Linux builds. Linux-only files (dns_linux.go,
                # ports_linux.go) are covered by linux-specific tests. Floor raised
                # from 20% to 50% at S26.T08 when darwin files were gated.
                # P103 R1: Linux floor reduced from 50% to 35% because the darwin-only
                # idempotency test suite (idempotency_test.go, ~17K lines) is excluded
                # on Linux, driving measured Linux coverage down to ~36.5% against the
                # linux-only trust functions. The darwin floor of 75% remains
                # unchanged. Tracking issue: add Linux-specific trust tests to close
                # the gap (P103 or subsequent patch).
                if [ "$(uname)" = "Darwin" ]; then echo 75; else echo 35; fi;;
              ui) echo 75;;
              watchdog) echo 75;;
              *) echo 0;;
            esac
          }
          for pkg in license auth trust ui watchdog; do
            floor=$(declare_floor "$pkg")
            if ! go test -mod=vendor -coverprofile="/tmp/${pkg}.out" "./internal/${pkg}/..." 2>/dev/null; then
              echo "WARN: could not test internal/${pkg} — package may not exist at this path" >&2
              continue
            fi
            total=$(go tool cover -func="/tmp/${pkg}.out" 2>/dev/null | awk '/^total:/{print $3}' | tr -d '%')
            if [ -z "$total" ]; then
              echo "WARN: could not parse total coverage for internal/${pkg}" >&2
              continue
            fi
            result=$(awk -v total="$total" -v floor="$floor" 'BEGIN { print (total+0 >= floor+0) ? "pass" : "fail" }')
            if [ "$result" = "fail" ]; then
              echo "FAIL: internal/${pkg} coverage ${total}% below floor ${floor}%" >&2
              failed=1
            else
              echo "PASS: internal/${pkg} coverage ${total}% >= floor ${floor}%"
            fi
          done
          exit $failed

      - name: Enforce security-critical command-family coverage floor (P6-E11-W2-S3-T18)
        # Per-family line-coverage floor within cmd/commands, per
        # DECISION-RULINGS-2026-08-27 ruling 6: >=70% per named
        # security-critical family — not a repo-wide floor (that would
        # break unrelated PRs touching other commands) and not a mere
        # nonzero check (a single trivial registration test would clear
        # "nonzero" while leaving the actual security behavior untested).
        #
        # Families:
        #   - db_rls:        db_rls.go
        #   - oauth_refresh: oauth_refresh.go
        #   - secrets:       secrets.go, secrets_audit.go, secrets_core.go,
        #                    secrets_edit_rotate.go, secrets_schedule.go
        #   - ssl:           ssl.go, ssl_add.go, ssl_install.go,
        #                    ssl_renewal.go, ssl_setup.go, ssl_renew.go
        #
        # db_rls (floor 40%, observed ~44%) and ssl (floor 35%, observed
        # ~37%) are INTERIM floors below the 70% target, not a silent
        # acceptance of a permanently lower bar. Every branch reachable
        # without live infrastructure is covered as of this ticket:
        # project-detection guards, identifier/provider/email/domain
        # validation, cert-path construction (regression-tested against the
        # BUG-7f2fd59d/chain-34f84b09 path class), and the real
        # connection-failure error path. What remains uncovered needs
        # infrastructure this ticket does not add — a live Postgres
        # connection for db_rls audit/apply's success path
        # (database.AuditRLS/ApplyRLSBatch), and live certbot + docker +
        # nginx + a real TLS-serving domain for ssl's success paths and
        # ssl.go's checkDomainTLS. Raising these two families to 70% is a
        # follow-up ticket requiring an embedded-Postgres or
        # docker-compose integration harness (see the pglite work tracked
        # under E11-W2-S1-T5) and a local certbot+nginx fixture — tracked
        # here rather than silently, per this ticket's own instruction that
        # undocumented non-coverage is how a gate becomes trusted wrongly.
        run: |
          go test -mod=vendor -coverprofile=/tmp/cmdcov.out ./cmd/commands/...
          python3 - <<'PYEOF'
          import re, sys
          from collections import defaultdict

          FAMILIES = {
              "db_rls": (["cmd/commands/db_rls.go"], 40),
              "oauth_refresh": (["cmd/commands/oauth_refresh.go"], 70),
              "secrets": ([
                  "cmd/commands/secrets.go", "cmd/commands/secrets_audit.go",
                  "cmd/commands/secrets_core.go", "cmd/commands/secrets_edit_rotate.go",
                  "cmd/commands/secrets_schedule.go",
              ], 70),
              "ssl": ([
                  "cmd/commands/ssl.go", "cmd/commands/ssl_add.go",
                  "cmd/commands/ssl_install.go", "cmd/commands/ssl_renewal.go",
                  "cmd/commands/ssl_setup.go", "cmd/commands/ssl_renew.go",
              ], 35),
          }

          stats = defaultdict(lambda: [0, 0])  # covered_stmts, total_stmts
          with open("/tmp/cmdcov.out") as f:
              next(f, None)  # skip the "mode: ..." header line
              for line in f:
                  m = re.match(r'(.+):\d+\.\d+,\d+\.\d+ (\d+) (\d+)', line.strip())
                  if not m:
                      continue
                  path, numstmt, count = m.group(1), int(m.group(2)), int(m.group(3))
                  idx = path.find("cmd/commands/")
                  if idx == -1:
                      continue
                  key = path[idx:]
                  stats[key][1] += numstmt
                  if count > 0:
                      stats[key][0] += numstmt

          failed = False
          for fam, (files, floor) in FAMILIES.items():
              cov = sum(stats[f][0] for f in files)
              tot = sum(stats[f][1] for f in files)
              pct = (cov / tot * 100) if tot else 0.0
              status = "PASS" if pct >= floor else "FAIL"
              if pct < floor:
                  failed = True
              print(f"{status}: {fam} coverage {pct:.1f}% (floor {floor}%) [{cov}/{tot} statements]")

          if failed:
              sys.exit(1)
          PYEOF

      - name: Verify pentest mocked-network test suite exists and passes
        # DECISION-RULINGS-2026-08-27 ruling 18: the pentest family's
        # coverage floor is satisfied by pentest_mock_test.go existing and
        # passing (mocked Hasura GraphQL + plugin API + an in-process RLS
        # predicate simulation) — there is no production `pentest` command
        # to compute a line-coverage percentage against (rls-pentest.sh is
        # a standalone bash script, not a Go command; see that test file's
        # doc comment for exactly what is and is not covered). No live
        # pentest run is required or attempted here.
        run: |
          test -f cmd/commands/pentest_mock_test.go || { echo "FAIL: cmd/commands/pentest_mock_test.go is missing"; exit 1; }
          go test -mod=vendor ./cmd/commands/... -run '^TestAttack' -v

      - name: Coverage delta comment (PR only)
        if: github.event_name == 'pull_request'
        run: |
          total=$(go tool cover -func=coverage.out | tail -1 | awk '{print $3}')
          echo "### Coverage Report" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "| Metric | Value |" >> "$GITHUB_STEP_SUMMARY"
          echo "|--------|-------|" >> "$GITHUB_STEP_SUMMARY"
          echo "| Total coverage | ${total} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Floor | ${COVERAGE_FLOOR}% |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Security-critical (license, auth) | 100% required |" >> "$GITHUB_STEP_SUMMARY"

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v7
        with:
          file: coverage.out
          flags: cli
          fail_ci_if_error: false