feat(ci): import test coverage into SonarQube (#61)

SonarQube reported 0% coverage for 78 unit, 134 integration and 83 end-to-end tests, so the coverage-on-new-code gate — the most useful thing SonarQube offers a project this size — has been failing permanently while looking configured. It now reports 69.6%, verified by a real scan. Backend coverage comes from both suites, written to separate directories because jest writes coverage/lcov.info by default and the second run would silently overwrite the first. Both are needed rather than just the fast one: the unit suite alone reports 11%, because everything in src/routes is exercised by the integration suite. That suite is manual-only after hanging for 3h12m post-run, so it runs here with --forceExit and the job carries a hard timeout; jest confirmed during testing that it would otherwise have hung. The frontend had no unit tests at all, so its coverage comes from Playwright driving an istanbul-instrumented dev server, collected per test by an auto-fixture and merged with nyc. The 17 specs now import from a local fixtures module that re-exports @playwright/test, which is what lets the fixture attach without touching each test body. Instrumentation is gated behind COVERAGE=true and loaded by dynamic import, since vite-plugin-istanbul is ESM-only while vite.config.ts evaluates as CommonJS. Both directions were checked rather than assumed: a normal build contains no instrumentation, and the dev server instruments nested modules as well as top-level ones — the first attempt used an include glob of src/* which would have silently missed everything under src/admin and src/cart. coverage:report fails when nothing was collected instead of writing an empty report, and that guard was fired deliberately to confirm it works. This project has been bitten twice by tools succeeding while measuring nothing — SonarQube skipping the whole frontend and still exiting EXECUTION SUCCESS in #67, and an ESLint matcher silently matching no files during #60 — and coverage has exactly that shape: an uninstrumented dev server lets every test pass while gathering nothing, and the 0% that follows reads as lost coverage rather than broken collection. Worth knowing when reading the numbers: end-to-end coverage flatters. Istanbul marks a line covered when the browser ran it, so a component rendered during a test counts as covered with nothing asserting anything about it. Recorded in the design doc and the project context rather than left to be discovered. Also declares sonar.tests so test files are analysed under the test rule set rather than as production code. Closes #61
2026-08-20 10:13:13 -05:00
parent 7e4084a65f
commit 332c1e7cd0
30 changed files with 1762 additions and 34 deletions
@@ -1,4 +1,4 @@
-import { test, expect, Page } from '@playwright/test';
+import { test, expect, Page } from './fixtures';

 const PASSWORD = 'supersecret123';

@@ -1,4 +1,4 @@
-import { test, expect, Page } from '@playwright/test';
+import { test, expect, Page } from './fixtures';

 const PASSWORD = 'supersecret123';
 const uniqueEmail = () => `disable-${Date.now().toString(36)}${Math.random().toString(36).slice(2, 7)}@example.com`;
@@ -1,4 +1,4 @@
-import { test, expect } from '@playwright/test';
+import { test, expect } from './fixtures';

 const suffix = () => `i${Date.now().toString(36)}${Math.random().toString(36).slice(2, 7)}`;

@@ -1,4 +1,4 @@
-import { test, expect, Page } from '@playwright/test';
+import { test, expect, Page } from './fixtures';

 const RUN = `v${Date.now().toString(36)}${Math.random().toString(36).slice(2, 7)}`;

@@ -1,4 +1,4 @@
-import { test, expect } from '@playwright/test';
+import { test, expect } from './fixtures';

 const suffix = () => `r${Date.now().toString(36)}${Math.random().toString(36).slice(2, 7)}`;

@@ -1,4 +1,4 @@
-import { test, expect } from '@playwright/test';
+import { test, expect } from './fixtures';

 const suffix = () => `s${Date.now().toString(36)}${Math.random().toString(36).slice(2, 7)}`;

@@ -1,4 +1,4 @@
-import { test, expect } from '@playwright/test';
+import { test, expect } from './fixtures';

 // The e2e database is shared and never reset, so every fixture name carries a
 // unique suffix and assertions are scoped to the nodes this run created. The
@@ -1,4 +1,4 @@
-import { test, expect, Page } from '@playwright/test';
+import { test, expect, Page } from './fixtures';

 // Relative luminance per WCAG, used to tell "light" from "dark" without
 // asserting exact hex values, which would break on any palette tweak.
@@ -1,4 +1,4 @@
-import { test, expect, Page } from '@playwright/test';
+import { test, expect, Page } from './fixtures';

 const PASSWORD = 'supersecret123';

@@ -1,4 +1,4 @@
-import { test, expect, Page } from '@playwright/test';
+import { test, expect, Page } from './fixtures';

 const PASSWORD = 'supersecret123';
 // The storefront runs against a shared database that is never reset, so every
@@ -1,4 +1,4 @@
-import { test, expect, Page } from '@playwright/test';
+import { test, expect, Page } from './fixtures';

 const PASSWORD = 'supersecret123';
 const RUN = `f${Date.now().toString(36)}${Math.random().toString(36).slice(2, 7)}`;
@@ -1,4 +1,4 @@
-import { test, expect, APIRequestContext } from '@playwright/test';
+import { test, expect, APIRequestContext } from './fixtures';

 // The storefront shows every item ever seeded, and the e2e database is not
 // reset between runs. Every fixture below is therefore suffixed with a unique
@@ -0,0 +1,47 @@
+import { test as base } from '@playwright/test';
+import { mkdirSync, writeFileSync } from 'fs';
+import { randomUUID } from 'crypto';
+import path from 'path';
+
+// Re-exported so specs can import everything from here — expect, Page,
+// APIRequestContext — and get the coverage-collecting `test` at the same time.
+// The explicit `test` below wins over the star export.
+export * from '@playwright/test';
+
+const NYC_OUTPUT = path.resolve(__dirname, '..', '..', '.nyc_output');
+const collectingCoverage = process.env.COVERAGE === 'true';
+
+// Set once any page reports instrumentation. Checked by the collection script so
+// an empty run fails loudly instead of publishing 0% — see the note below.
+const MARKER = path.join(NYC_OUTPUT, '.collected');
+
+/**
+ * Flushes istanbul's per-page counters after each test.
+ *
+ * Coverage lives in `window.__coverage__` on the page and dies with it, so it
+ * has to be read before the page closes — one file per test, because the suite
+ * runs fullyParallel and workers would otherwise overwrite each other.
+ */
+export const test = base.extend<{ collectCoverage: void }>({
+  collectCoverage: [
+    async ({ page }, use) => {
+      await use();
+
+      if (!collectingCoverage) return;
+
+      // The page may already be closed by a test that navigated away or crashed;
+      // a missing sample is not worth failing a passing test over. The run-level
+      // check catches the case that actually matters — no samples at all.
+      const coverage = await page
+        .evaluate(() => (window as unknown as { __coverage__?: unknown }).__coverage__)
+        .catch(() => undefined);
+
+      if (!coverage) return;
+
+      mkdirSync(NYC_OUTPUT, { recursive: true });
+      writeFileSync(path.join(NYC_OUTPUT, `${randomUUID()}.json`), JSON.stringify(coverage));
+      writeFileSync(MARKER, 'ok');
+    },
+    { auto: true }
+  ]
+});
@@ -1,4 +1,4 @@
-import { test, expect, Page } from '@playwright/test';
+import { test, expect, Page } from './fixtures';
 import { Client } from 'pg';

 const PASSWORD = 'supersecret123';
@@ -1,4 +1,4 @@
-import { test, expect } from '@playwright/test';
+import { test, expect } from './fixtures';

 test.describe('Storefront failure states', () => {
  test('reports a server failure instead of claiming the store is empty', async ({ page }) => {
@@ -1,4 +1,4 @@
-import { test, expect } from '@playwright/test';
+import { test, expect } from './fixtures';

 test.describe('Storefront', () => {
  test('loads and shows the site title', async ({ page }) => {
@@ -1,4 +1,4 @@
-import { test, expect } from '@playwright/test';
+import { test, expect } from './fixtures';

 test.describe('Theme switching', () => {
  test('toggling the switch changes the body theme attribute', async ({ page }) => {
@@ -1,4 +1,4 @@
-import { test, expect } from '@playwright/test';
+import { test, expect } from './fixtures';

 // The /verify-email route was missing entirely, so the link in every verification
 // email rendered a blank page. These cover the route existing and reporting an