Feature/61 coverage import #73

2026-08-20T10:30:09-05:00

bermudalamb commented

2026-08-20 10:30:09 -05:00

No description provided.

bermudalamb self-assigned this 2026-08-20 10:30:09 -05:00

bermudalamb added this to the Code Quality and Hardening project 2026-08-20 10:30:09 -05:00

bermudalamb added 3 commits 2026-08-20 10:30:10 -05:00

docs: design for importing test coverage into SonarQube (#61 ) 7e4084a65f

Records what #61 still needs after #67 delivered two of its four asks, and the two constraints that shape the rest: backend route logic is covered only by the integration suite, which is manual-only because of a post-run hang, and the frontend has no unit tests at all so its coverage has to come from instrumenting the app and collecting from Playwright.

Also records the thing most likely to mislead later — end-to-end coverage marks a line covered when the browser merely ran it, so the frontend number will read considerably better than the testing behind it, and the 80% gate will be easier to clear on frontend changes than backend ones. Accepted deliberately, because the alternative leaves every frontend pull request failing a gate it cannot satisfy.

Refs #61

feat(ci): import test coverage into SonarQube (#61 ) 332c1e7cd0

SonarQube reported 0% coverage for 78 unit, 134 integration and 83 end-to-end tests, so the coverage-on-new-code gate — the most useful thing SonarQube offers a project this size — has been failing permanently while looking configured. It now reports 69.6%, verified by a real scan.

Backend coverage comes from both suites, written to separate directories because jest writes coverage/lcov.info by default and the second run would silently overwrite the first. Both are needed rather than just the fast one: the unit suite alone reports 11%, because everything in src/routes is exercised by the integration suite. That suite is manual-only after hanging for 3h12m post-run, so it runs here with --forceExit and the job carries a hard timeout; jest confirmed during testing that it would otherwise have hung.

The frontend had no unit tests at all, so its coverage comes from Playwright driving an istanbul-instrumented dev server, collected per test by an auto-fixture and merged with nyc. The 17 specs now import from a local fixtures module that re-exports @playwright/test, which is what lets the fixture attach without touching each test body.

Instrumentation is gated behind COVERAGE=true and loaded by dynamic import, since vite-plugin-istanbul is ESM-only while vite.config.ts evaluates as CommonJS. Both directions were checked rather than assumed: a normal build contains no instrumentation, and the dev server instruments nested modules as well as top-level ones — the first attempt used an include glob of src/* which would have silently missed everything under src/admin and src/cart.

coverage:report fails when nothing was collected instead of writing an empty report, and that guard was fired deliberately to confirm it works. This project has been bitten twice by tools succeeding while measuring nothing — SonarQube skipping the whole frontend and still exiting EXECUTION SUCCESS in #67, and an ESLint matcher silently matching no files during #60 — and coverage has exactly that shape: an uninstrumented dev server lets every test pass while gathering nothing, and the 0% that follows reads as lost coverage rather than broken collection.

Worth knowing when reading the numbers: end-to-end coverage flatters. Istanbul marks a line covered when the browser ran it, so a component rendered during a test counts as covered with nothing asserting anything about it. Recorded in the design doc and the project context rather than left to be discovered.

Also declares sonar.tests so test files are analysed under the test rule set rather than as production code.

Closes #61

docs(ci): record the coverage pipeline contract and the CI identity gap

SonarQube Analysis / sonarqube (pull_request) Successful in 14m41s

Details

Tests / lint (pull_request) Successful in 2m5s

Details

Tests / backend-unit (pull_request) Successful in 40s

Details

Tests / frontend-e2e (pull_request) Failing after 8m57s

Details

261d087a9c

Two standing documents rather than one, because they are different kinds of thing: one is a contract the pipeline must keep, the other is work not yet done.

The coverage contract names the seven requirements that keep SonarQube's number real, and what specifically breaks if each lapses. It exists because coverage does not fail loudly — it reports a smaller number, which looks exactly like tests covering less. That is the third time this project has met a tool that succeeds while measuring nothing, after #67 and #60, so the failure mode is written down alongside how to check the guard still fires.

The identity document covers CI authenticating to SonarQube as admin rather than a restricted account, raised as a "Related" note in #61 and split out so a permissions change is not buried in a CI-config commit. It spells out the revoke step explicitly, since the workflow goes green one step earlier and stopping there leaves the old credential valid.

bermudalamb moved this to In Progress in Code Quality and Hardening on 2026-08-20 10:30:20 -05:00

bermudalamb merged commit 0587c18307 into main

2026-08-20 10:30:30 -05:00

bermudalamb deleted branch feature/61-coverage-import

2026-08-20 10:30:30 -05:00

bermudalamb moved this to Review in Code Quality and Hardening on 2026-08-20 10:30:35 -05:00

bermudalamb referenced this pull request

2026-08-20 11:25:14 -05:00

new_coverage is 71.2% against an 80% gate — and "new code" is silently the entire codebase #79

bermudalamb referenced this pull request

2026-08-20 15:27:58 -05:00

SonarQube analyses the code but imports no test coverage, so its quality gate is measuring nothing #61

bermudalamb moved this to Ready for Release in Code Quality and Hardening on 2026-08-20 15:44:46 -05:00

bermudalamb moved this to Released in Code Quality and Hardening on 2026-08-21 12:12:01 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bermudalamb/redefined-designs#73