test(coverage): measure GitHub App runtime core

[seonghobae]

Summary

Restores the GitHub App credential-runtime core to Noema's exact 100% owned-production coverage obligation without exporting private helpers, weakening thresholds, or reviving broad V8 exclusions. This is a bounded #84 slice on current protected main; already-integrated OIDC/replay/runtime behavior is preserved.

Exact lineage

• protected/live base: 29a64e144eda0fb52a25f3c682b3cbfa2a2dedf9
• initial coverage-policy RED: 01c7c1a12fbb6b4451c8b66292841487607a0e60
• realistic public-path GitHub App regressions: 965f09ea0eae4bb99b8452b6735e7ca25e2aa295
• broad-ignore removal candidate: 86bd1cd6dfbca2f51cb77c2210b10599ab17a9e5
• unreachable optional-header fallback RED/GREEN: 5cb780ada477925f4d0a83bb90faeef8d81d8f1a -> e48f6e7fde85082d1c518f66fc909a33ac784219
• redundant status-branch RED/GREEN: 80bd9e920873ef9006e3b511a8be3c7044fd29ed -> a063774820594206bc11d4dd9d30986e6daf4145
• final public-path residual branch coverage: cb349a7c900cf49e854bf26775992c683e4afee6
• branch: quality/github-app-runtime-coverage

No predecessor-head check/review/scanner evidence transfers.

Test-first repair

The branch first makes the GitHub App runtime region measurable and exercises it only through the public /exchange Worker boundary with real WebCrypto RSA keys and signed GitHub OIDC JWT fixtures while mocking only external OIDC/GitHub network responses.

The regressions cover:

• explicit installation ID and exact least-privilege repository token request;
• GitHub installation lookup 302 / 429 / 5xx / 4xx fail-closed classification with zero token mint on lookup failure;
• missing installation ID;
• missing installation token;
• missing or invalid token expiry;
• discovered installation-ID cache hit;
• expired cache eviction and fresh lookup.

Coverage RCA also removed two production branches that were unreachable under the actual internal contract instead of adding exclusions: githubJson now requires a concrete string-header map, and its post->=500 fallback no longer repeats a redundant <500 test.

Current evidence boundary

Exact head cb349a7c900cf49e854bf26775992c683e4afee6 is unchanged and freshly passed application CI, reviewer-ci, and the eligible central Security Scan. Current review threads and formal reviews are empty. Live protected main remains 29a64e144eda0fb52a25f3c682b3cbfa2a2dedf9; the active Noema ruleset requires the central .github/workflows/security-scan.yml@main workflow and currently exposes no independent-approval-count rule.

Transitioning from Draft must trigger fresh ready-for-review evidence; those new runs are non-passing until terminal success and will be revalidated before any merge decision.

Non-goals

• no coverage threshold reduction or new ignore region;
• no private-helper export solely for tests;
• no foreign dedicated-writer source change;
• no outbound-license, release, deployment, KPI, revenue, or acquisition-readiness claim.

Related: #84

Summary by CodeRabbit

• 개선 사항

  • GitHub App 인증 과정의 오류 처리를 간소화하고, 필수 인증 정보가 누락된 경우 안전하게 처리를 중단하도록 개선했습니다.
  • 설치 정보와 인증 토큰을 효율적으로 재사용하며, 만료 후에는 최신 정보를 다시 조회합니다.

• 테스트

  • 정상적인 인증 흐름, 오류 응답, 캐시 재사용 및 만료 상황에 대한 검증을 강화했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 99626bbb-a298-405a-8950-9916c5dcd77a

📥 Commits

Reviewing files that changed from the base of the PR and between 29a64e1 and cb349a7.

📒 Files selected for processing (3)

• src/index.ts
• test/github-app-runtime-coverage.test.ts
• test/production-coverage-policy.test.ts

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

GitHub API 어댑터의 요청 타입과 오류 상태 계산을 단순화했습니다. GitHub App 런타임 커버리지 제외 주석을 제거하고, OIDC 인증·installation 조회·토큰 발급·캐시 동작을 검증하는 테스트를 추가했습니다.

Changes

GitHub App 런타임 검증

Layer / File(s)	Summary
API 어댑터와 런타임 커버리지 src/index.ts, test/production-coverage-policy.test.ts	githubJson 요청의 headers 타입을 명확히 지정했습니다. 헤더 fallback과 불필요한 4xx 분기를 제거했습니다. GitHub App 런타임 코드가 커버리지 측정 대상인지 검증합니다.
GitHub App exchange 경계 테스트 test/github-app-runtime-coverage.test.ts	OIDC discovery와 JWKS를 모킹합니다. 명시적 installation ID, 권한, 오류 상태 분류, fail-closed 처리, 토큰 만료 검증, installation ID 캐시와 TTL 만료를 검증합니다.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: ⚪ Minimal · up to cb349

The change is limited to coverage tests and a small runtime cleanup; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 GitHub App 런타임 핵심의 커버리지 측정 테스트 추가라는 주요 변경 사항을 간결하게 설명합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch quality/github-app-runtime-coverage

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.