From b0bbe5300d71f845871c3e7d0a3e1de36e088c75 Mon Sep 17 00:00:00 2001 From: DoRmAmMu1997 Date: Fri, 4 Sep 2026 19:47:38 +0530 Subject: [PATCH] fix(QUAL-009): bring app.py into the coverage gate The gate measured `--cov=backend --cov=screeners --cov=ui`, so the 927-line Streamlit entrypoint contributed nothing to the 89% floor even though ~14 tests/test_app_*.py modules exercise it. Coverage could regress in app.py without CI noticing - the exact failure the floor exists to prevent. Add `--cov=app` to the command. Note the spelling: `--cov=app.py` makes pytest-cov abort, so the module name is what works. The floor did NOT need re-baselining. app.py measures 76% (290 statements, 69 missed) and pulls the total from 89.97% to 89.71%, which still clears 89 with 0.71pp of headroom - matching the "~0.7pp" figure AGENTS.md already documents. Leaving the number alone also keeps this diff to one flag in six files rather than a floor change nobody asked for. Per AGENTS.md section 7, the command string is updated in every place that mirrors it - the workflow, AGENTS.md, README.md, docs/operations.md, docs/adding-a-screener.md - and in all three assertions in tests/test_supply_chain_policy.py, in the same commit. The three *-handoff.md docs still quote `--cov-fail-under=84`. Those are point-in-time ticket handoffs, so they are left as the historical record they are, exactly like the audit register. Deliberately NOT included: the `--strict-markers` rider suggested on the issue. Its premise was "if a [tool.coverage.run] section is being added anyway" - it is not, because `--cov=app` needs no coverage config. Keeping pyproject.toml untouched preserves the empty section-7 pin diff for this branch. Worth its own small ticket. Closes #120 Co-Authored-By: Claude Opus 5 --- .github/workflows/quality-and-security.yml | 2 +- AGENTS.md | 6 +++++- README.md | 2 +- docs/adding-a-screener.md | 2 +- docs/operations.md | 2 +- tests/test_supply_chain_policy.py | 6 +++--- 6 files changed, 12 insertions(+), 8 deletions(-) diff --git a/.github/workflows/quality-and-security.yml b/.github/workflows/quality-and-security.yml index dd9a193..2190336 100644 --- a/.github/workflows/quality-and-security.yml +++ b/.github/workflows/quality-and-security.yml @@ -49,7 +49,7 @@ jobs: # The floor sits ~two points under the measured 89% (QUAL-005) so # routine PRs don't fight the gate, while a large untested addition # still fails. - python -m pytest -q --cov=backend --cov=screeners --cov=ui --cov-fail-under=89 + python -m pytest -q --cov=app --cov=backend --cov=screeners --cov=ui --cov-fail-under=89 - name: Compile importable Python files run: python -m compileall -q app.py backend screeners ui tests diff --git a/AGENTS.md b/AGENTS.md index 336afde..3c34c20 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -126,7 +126,7 @@ Reproduce it locally — these are the exact commands; **all must pass**: python -m pip install -r requirements.txt -r requirements-dev.txt -c constraints.txt python -m pre_commit validate-config .pre-commit-config.yaml -python -m pytest -q --cov=backend --cov=screeners --cov=ui --cov-fail-under=89 +python -m pytest -q --cov=app --cov=backend --cov=screeners --cov=ui --cov-fail-under=89 python -m compileall -q app.py backend screeners ui tests python -m ruff check app.py backend screeners ui Dependencies tests python -m mypy @@ -142,6 +142,10 @@ docker compose down --volumes --remove-orphans Coverage floor is **89%** (measured ~89.7%). Headroom is deliberately thin, so a sizeable untested addition fails the gate rather than quietly eroding the suite. +The measured set includes `app.py` (QUAL-009); it sits at ~76%, which is the main +reason the headroom is as tight as it is. `Dependencies/` and `migrations/` remain +unmeasured on purpose - the first is an interactive credential helper, the second +is hand-written migrations that the Alembic drift guard covers instead. `pre-commit` hooks are **non-rewriting** (check-only, no `--fix`) so commits stay author-reviewed. diff --git a/README.md b/README.md index 501c7fe..2b94edf 100644 --- a/README.md +++ b/README.md @@ -1197,7 +1197,7 @@ pip install -r requirements-dev.txt -c constraints.txt Run the full local verification set before publishing changes: ```bash -python -m pytest -q --cov=backend --cov=screeners --cov=ui --cov-fail-under=89 +python -m pytest -q --cov=app --cov=backend --cov=screeners --cov=ui --cov-fail-under=89 python -m compileall -q app.py backend screeners ui tests python -m ruff check app.py backend screeners ui Dependencies tests python -m bandit -r app.py backend screeners ui Dependencies -q diff --git a/docs/adding-a-screener.md b/docs/adding-a-screener.md index c6f03a2..741266d 100644 --- a/docs/adding-a-screener.md +++ b/docs/adding-a-screener.md @@ -155,7 +155,7 @@ python -m pytest -q # alway ```bash python -m pre_commit validate-config .pre-commit-config.yaml -python -m pytest -q --cov=backend --cov=screeners --cov=ui --cov-fail-under=89 +python -m pytest -q --cov=app --cov=backend --cov=screeners --cov=ui --cov-fail-under=89 python -m compileall -q app.py backend screeners ui tests python -m ruff check app.py backend screeners ui Dependencies tests python -m mypy diff --git a/docs/operations.md b/docs/operations.md index 75a602b..85d16cd 100644 --- a/docs/operations.md +++ b/docs/operations.md @@ -1022,7 +1022,7 @@ The "Quality and security" workflow runs the same gates you can run locally: ```bash python -m pre_commit validate-config .pre-commit-config.yaml -python -m pytest -q --cov=backend --cov=screeners --cov=ui --cov-fail-under=89 +python -m pytest -q --cov=app --cov=backend --cov=screeners --cov=ui --cov-fail-under=89 python -m compileall -q app.py backend screeners ui tests python -m ruff check app.py backend screeners ui Dependencies tests python -m mypy diff --git a/tests/test_supply_chain_policy.py b/tests/test_supply_chain_policy.py index bdc545a..824a96b 100644 --- a/tests/test_supply_chain_policy.py +++ b/tests/test_supply_chain_policy.py @@ -52,7 +52,7 @@ ) CI_COMMANDS = ( "python -m pre_commit validate-config .pre-commit-config.yaml", - "python -m pytest -q --cov=backend --cov=screeners --cov=ui --cov-fail-under=89", + "python -m pytest -q --cov=app --cov=backend --cov=screeners --cov=ui --cov-fail-under=89", "python -m compileall -q app.py backend screeners ui tests", "python -m ruff check app.py backend screeners ui Dependencies tests", "python -m mypy", @@ -124,7 +124,7 @@ def test_ci_workflow_runs_quality_and_dependency_security_checks(): assert 'python-version: ["3.11", "3.12"]' in text assert "python -m pre_commit validate-config .pre-commit-config.yaml" in text assert ( - "python -m pytest -q --cov=backend --cov=screeners --cov=ui " + "python -m pytest -q --cov=app --cov=backend --cov=screeners --cov=ui " "--cov-fail-under=89" in text ) @@ -253,7 +253,7 @@ def test_readme_documents_local_quality_and_security_commands(): assert "pip install -r requirements.txt -c constraints.txt" in text assert "pip install -r requirements-dev.txt -c constraints.txt" in text assert ( - "python -m pytest -q --cov=backend --cov=screeners --cov=ui " + "python -m pytest -q --cov=app --cov=backend --cov=screeners --cov=ui " "--cov-fail-under=89" in text )