Repository navigation
test(go): coverage push — Go table-driven tests for cmd/vmafx-* and pkg/ - #585
Merged
Merged
Conversation
lusoris
force-pushed
the
test/go-coverage-push-wf-d3a2d6b2
branch
from
June 3, 2026 22:18
d1e404e to
c1f8cf0
Compare
lusoris
marked this pull request as ready for review
June 3, 2026 22:18
Adds table-driven tests targeting the lowest-coverage Go packages and fixes pre-existing build failures that prevented the test suite from running cleanly. - cmd/vmafx-server/grpc_server.go: `runGRPCWithServer` referenced free variables `log`/`scorer`/`metrics` from the outer `runGRPC` scope; replaced with `impl.log`/`impl` registration. - cmd/vmafx-operator/internal/controller: `trainerStatusResponse.CurrentSamples` (int) assigned to `VmafxModelTrainingStatus.CurrentSamples` (int32) without conversion; fixed with int32() cast. - cmd/vmafx-operator/internal/controller: `VmafxNodeReconciler.probeHealthz` method referenced in tests but absent; added with HTTP body-drain fix (keep-alive connection reuse — ADR-0786 audit finding). - cmd/vmafx-controller/auth/grpc_interceptor.go: nil `*grpc.UnaryServerInfo` dereference when unit tests pass nil info; guarded with nil check. - cmd/vmafx-mcp/impl.go: `handleVmafScore` and `handleDescribeModel` did not route to the direct cgo path when `VMAFX_MCP_DIRECT=1`; fixed. - cmd/vmafx-mcp/impl.go: `inferBackendFromSym` missing `_vulkan` suffix; `inferBackendFromPayload` missing `>= 30 metrics → vulkan` heuristic. - cmd/vmafx-controller: tests called `newHTTPServer` without the `authMW` parameter added in a later PR; fixed by passing `nil`. - cmd/vmafx-server: same `newHTTPServer` arity mismatch (`grpc` param). - cmd/vmafx-node: `executor_test.go` and `main_test.go` referenced a removed `ScoringJob` struct, `loadConfig`, and `node` type; replaced with tests matching the current `main.go` + `executor.go` API. - cmd/vmafx-controller: gRPC tests called `SubmitJob` with `context.Background()` but the handler requires a `tenant_id` auth context; added `auth.ContextWithClaims` export + `testTenantCtx()` helper. - cmd/vmafx-controller/queue/queue_listall_test.go: ListAll, Depth, filter, multi-status IN-clause (repeatCommaQ), ordering, round-trip. - cmd/vmafx-operator/internal/controller/vmafxjob_applystatus_test.go: applyRemoteStatus all-transitions, idempotency, field propagation, resolveControllerAddr env/field/default paths. - cmd/vmafx-operator/internal/controller/vmafxmodeltraining_applystatus_test.go: applySidecarStatus phase mapping, idempotency, int32 conversion, checkpoint parse; pollTrainerStatus via httptest. - pkg/observability/otel_instruments_test.go: InitOTelMetrics non-nil, StartSpan, EndSpan nil-error / error paths, ObserveScoreLatency nil guard, span name constants. - pkg/score/grpc_client_unary_test.go: unary Score happy path / server error, Dial non-blocking, Close smoke test, recvStatusOnEOF non-EOF passthrough. - cmd/vmafx-node/online_feedback_pump_test.go: Send enqueue/drop, Dropped counter, socket env override/default, delivery counter with echo sidecar. cmd/vmafx-operator/internal/controller: 7 % → 45 % (+38 pp) pkg/observability: 68 % → 87 % (+19 pp) pkg/score: 47 % → 68 % (+21 pp) cmd/vmafx-controller/queue: 66 % → 82 % (+16 pp) cmd/vmafx-node: 30 % → 46 % (+15 pp) no rebase impact: test-only additions + targeted bug fixes; no public headers or proto changes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
lusoris
force-pushed
the
test/go-coverage-push-wf-d3a2d6b2
branch
from
June 3, 2026 22:20
c1f8cf0 to
8f27c79
Compare
lusoris
added a commit
that referenced
this pull request
Jun 12, 2026
…CI) (#868) * fix(codeql): resolve HIGH-severity security-cpp-high alerts (23 sites) - cpp/integer-multiplication-cast-to-long (11): pre-cast one operand to size_t / double / ptrdiff_t before int*int multiplications in cambi.c, float_vif.c (log message), iqa/convolve.c (img_offset), moment.c, psnr.c, and vif_tools.c (four memcpy size expressions). Add stddef.h to convolve.c for ptrdiff_t. - cpp/incomplete-parity-check (3): change `% 2 == 1` to `% 2 != 0` in vif_tools.c (assert), svm.cpp (powi loop), pdjson.c (JSON object key/value alternation). The == 1 form is wrong for negative operands; != 0 is always correct. - cpp/wrong-type-format-argument (2): fix float_vif.c error log that printed size_t fields scaled_w/scaled_h with %d; change to %zu. - cpp/world-writable-file-creation (1): in vmaf.cpp replace bare fopen("wb") with open(O_WRONLY|O_CREAT|O_TRUNC, 0644)+fdopen() on POSIX so the created file is never world-writable independent of the caller's umask. Add <fcntl.h>. - cpp/path-injection (4): in test_output.c resolve the mkstemp-created path through realpath() immediately after creation, breaking the taint chain from getenv("TMPDIR") to the vmaf_write_output call site. - cpp/toctou-race-condition (2): skipped — both sites are in test cleanup (RMDIR after stat assertion). The stat result drives a test assertion, not a security-sensitive access decision; no atomic replacement of open() is applicable to rmdir. Reported as skipped. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(codeql): resolve security-python-and-ci CodeQL alerts Fixes 18 open CodeQL alerts across the Python and CI categories: - yaml.github-actions.security.run-shell-injection (#661): move github.event_name, github.base_ref, and github.event.before from inline ${{...}} interpolation to env: vars in the SYCL clang-tidy detect step of lint-and-format.yml. - python.lang.security.use-defused-xml-parse (#216, #217): replace xml.etree.ElementTree with defusedxml.ElementTree in feature_extractor.py and quality_runner.py; add defusedxml>=0.7.1 to python/pyproject.toml and python/requirements.txt. - py/undefined-export (#352, #353, #354, #616): restructure aiutils/__init__.py to do a conditional eager import of the parquet helpers so the names are defined when pyarrow is present, and only include them in __all__ when the import succeeded. - py/stack-trace-exposure (#178, #179, #585): log exception detail server-side and return a generic message to the HTTP client in http_transport.py _handle_score (invalid JSON, bad params, scorer error branches). - python.lang.security.audit.dangerous-subprocess-use-tainted-env-args (#227, #372): add shlex.quote() around user-supplied path arguments passed into shell strings in extract_ugc_features.py and test_bbb_e2e_v5_bug_cluster.py. - py/file-not-closed (#677, #678): replace bare open() calls with context managers in test_coverage_round3.py. - py/redundant-comparison (#427, #431): remove redundant assert not (x != y) lines that duplicate the preceding assert x == y. - py/equals-hash-mismatch (#182): convert RdPoint to frozen=True dataclass so __eq__ and __hash__ are generated consistently. - py/inheritance/signature-mismatch (#197): add result_dict=None default to EnsembleVmafQualityRunner._populate_result_dict so the signature is compatible with the base class. - py/multiple-definition (#201): drop redundant assignment to feature_found in feature_extractor.py wildcard discovery path. - py/str-format/surplus-named-argument (#204): remove unused dataset= kwarg from the format() call in routine.py. Skipped: python.lang.security.audit.insecure-file-permissions (#373) — the Unix socket at 0o660 is intentional (Go sidecar node must write to it and runs as the same UNIX group); tightening to 0o644 would break the IPC channel. Skipped: py/path-injection (#180, #181) — _validate_path() already resolves the path and checks it against an allowlist before any file operation; the data flow is secure and the CodeQL dataflow trace is a false positive on this allowlisted pattern. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Lusoris <lusoris@pm.me> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
_test.gofiles (570 LOC) targeting packages with lowest coverage:cmd/vmafx-operator/internal/controller(+38 pp, 7→45 %),pkg/observability(+19 pp),pkg/score(+21 pp),cmd/vmafx-controller/queue(+16 pp),cmd/vmafx-node(+15 pp).vmafx-server/grpc_server.go,int/int32type mismatch in operator controller, missingprobeHealthzmethod, nil*grpc.UnaryServerInfodereference in auth interceptor, stale test API calls in controller/node tests.handleVmafScore/handleDescribeModeldid not route to the direct cgo path whenVMAFX_MCP_DIRECT=1;inferBackendFromSymmissing_vulkansuffix;inferBackendFromPayloadmissing the>=30 metrics → vulkanheuristic.auth.ContextWithClaimsto allow gRPC handler unit tests to inject a tenant context without a live JWT stack.Coverage delta (key packages)
cmd/vmafx-operator/internal/controllerpkg/scorepkg/observabilitycmd/vmafx-controller/queuecmd/vmafx-nodeTest plan
Expected: all packages
ok, noFAILlines.ADR-0108 deliverables
AGENTS.mdinvariant note: no rebase-sensitive invariants introducedgo test -cover ./cmd/... ./pkg/...— see test plan abovechangelog.d/fragment:changelog.d/added/go-coverage-push.mddocs/rebase-notes.md: entry added undertest/go-coverage-push (2026-06-04)State / bug tracking
no state.md update needed: no bugs opened or closed; this PR adds tests and fixes pre-existing build/logic regressions that were not tracked bugs.
FFmpeg patches
no ffmpeg-patches update needed: no public C API, CLI flag, or meson_options.txt changes.
🤖 Generated with Claude Code