tests: add c8 coverage thresholds for JS tests

[benvinegar]

Adds code coverage tracking and enforcement for JS/TS tests using c8 (V8 native coverage).

What changed

• New: .c8rc.json — coverage config with thresholds (50% lines/functions/statements, 40% branches)
• Updated: bin/test.sh — new coverage mode (bin/test.sh coverage)
• Updated: package.json — npm run test:coverage script
• Updated: CI workflow — runs coverage check after tests
• Updated: .gitignore — excludes coverage/ and .c8_output/

Coverage approach

Uses c8 wrapping node --test rather than migrating to vitest. This keeps the existing test infrastructure unchanged while adding coverage tracking. c8 uses V8's built-in coverage, so there's no instrumentation overhead.

Current coverage

File	Statements	Branches	Functions
scan-extensions.mjs	94%	77%	100%
security.mjs	98%	94%	100%
Total	96%	86%	100%

Thresholds are set conservatively (50%/40%) to avoid blocking PRs while establishing the baseline. Can ratchet up as coverage grows.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	c8@​10.1.3

View full report

[greptile-apps]

Greptile Summary

Adds c8-based code coverage tracking for JS tests, with conservative enforcement thresholds (50% lines/functions/statements, 40% branches). The bin/test.sh script is refactored to share a test file array between normal and coverage modes, and CI is updated to run coverage checks.

• .c8rc.json includes a lib/**/*.mjs pattern that matches no files (the directory doesn't exist) — consider removing it
• CI now runs JS tests twice: once in bin/test.sh (all tests) and again in bin/test.sh coverage — these could be consolidated to save CI time
• The addition of root-level npm ci in the test job is a necessary fix (previously only subdirectory deps were installed)
• Test script refactoring from inline commands to shared arrays is clean and maintainable

Confidence Score: 4/5

• This PR is safe to merge — it adds tooling infrastructure without changing runtime behavior.
• No runtime code is changed. The test script refactoring is correct and the coverage infrastructure works. Deducted one point for the dead lib/**/*.mjs include pattern and the redundant double execution of JS tests in CI, which are non-blocking style issues.
• .c8rc.json (dead include pattern) and .github/workflows/ci.yml (tests run twice)

Important Files Changed

Filename	Overview
.c8rc.json	New c8 coverage config with conservative thresholds. Has a dead lib/**/*.mjs include pattern (directory doesn't exist).
.github/workflows/ci.yml	Adds root npm ci (needed for c8) and coverage check step. JS tests now run twice in the test job — once in bin/test.sh and once in bin/test.sh coverage.
.gitignore	Adds coverage/ and .c8_output/ ignores; removes a duplicate node_modules/ entry.
bin/test.sh	Refactors test file list into arrays shared between normal and coverage modes. Adds coverage filter mode that runs JS tests under npx c8. Clean refactoring.
package.json	Adds test:coverage script and c8 devDependency.
package-lock.json	Lock file updated for c8 dependency addition.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["bin/test.sh"] --> B{FILTER arg?}
    B -->|"all / js"| C["run_js_tests()"]
    B -->|"shell"| D["run_shell_tests()"]
    B -->|"coverage"| E["npx c8 node --test JS_TEST_FILES"]
    B -->|"all"| D
    C --> F["node --test per file<br/>with pass/fail tracking"]
    D --> G["bash test scripts<br/>with pass/fail tracking"]
    E --> H[".c8rc.json thresholds"]
    H --> I{"Coverage ≥ thresholds?"}
    I -->|Yes| J["Exit 0"]
    I -->|No| K["Exit 1"]

Loading

_{Last reviewed commit: ece351a}

[greptile-apps]

_{6 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}