Run live Chrome coverage in release preparation

[senamakel]

Summary

The release prepare job failed before tagging because its coverage run left the hermetic Chrome suites opted out. The resulting report counted production browser paths at 7-22% even though the existing live tests exercise them. Keep the 90% per-file production threshold, explicitly install Chrome in CI and release jobs, and opt into the loopback-only live suites during coverage collection. A separate report checker excludes test-only source files and vendored/generated code from the per-file gate while retaining every handwritten production file, including the TinyBus module adapter.

Related issue

Follow-up to failed Release run 36047353281.

API or behavior changes

No product API or runtime behavior change. CI and release coverage now run real Chrome against local test pages and fail when the configured browser is missing.

Validation

• cargo fmt --all -- --check: pass
• cargo clippy --locked --all-targets --all-features -- -D warnings: pass
• cargo build --locked --all-targets --all-features: pass
• cargo test --locked --all-features --quiet: pass
• TINYBROWSER_LIVE_TESTS=1 .github/scripts/check-file-coverage.sh 90 target/coverage-opted-in.json: pass on canonical main d95b3b7 with local Chrome; lowest production file 91.03% (extract/mod.rs, 71/78)
• TINYBROWSER_LIVE_TESTS=1 cargo llvm-cov on PR Reset completed fill guard on page changes #20 head 4445798, then the new 90% report checker: pass; lowest production file 91.03%
• .github/scripts/test-check-file-coverage.sh: pass
• actionlint, shellcheck, bash -n, git diff --check: pass

Tests

Added synthetic report tests for a 90% production file, a below-threshold production file, a report with no production files, and exclusion of colocated/integration tests and vendor code. The wrapper test uses a fake cargo executable to assert explicit live-test opt-in; missing opt-in, a missing configured Chrome path, and invocation outside the repository root must fail. CI and release jobs set the opt-in and install Chrome explicitly.

Documentation

Updated AGENTS.md, CONTRIBUTING.md, and the release spec to describe the unchanged 90% production-file gate and its Chrome requirement.

Checklist

• The change is focused on one logical change
• No new allow attributes, ignored tests, or relaxed lints
• No secrets, tokens, or environment files in the diff or description

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper completed its review; deterministic results follow.

State: Changes requested
Priority: high
Reviewed head: 566cc8b91c20
Updated: 1790282547 (Unix time)

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	1
Tests	1	Noted findings	0
Documentation	3	Resolved findings	18
Configuration	4	Pending checks/questions	0

Completeness: Complete
Test assessment: Test coverage is assessed from changed tests and lane evidence; execution is not claimed without trusted check data.

What changed

No supported behavioral explanation was produced.

Features

None identified with supported citations.

Tests

• script test — Checks that a report containing only test files (no production files) is rejected with an appropriate error.: Correctly handles empty production‑file reports. (.github/scripts/test-check-file-coverage.sh)

Findings

• high · security · Keep coverage independent of live Chrome — This fake `cargo` implementation makes the test suite require `TINYBROWSER_LIVE_TESTS=1`, and the surrounding assertions explicitly treat missing opt-in as an error. As a result, t (\.github/scripts/test\-check\-file\-coverage\.sh:77)

Resolved this pass

• Pin the Chrome setup action to an immutable commit
• Pin the Chrome setup action to an immutable revision
• Describe the live Chrome suite as opt-in
• Resolve the workspace root independently of the caller's directory
• Do not force live Chrome tests in the coverage gate
• Keep coverage independent of live Chrome
• Keep live Chrome tests out of the coverage gate
• Resolve the workspace root independently of the caller's directory
• Pin the Chrome setup action to an immutable commit
• Pin the Chrome setup action to an immutable revision
• Describe the live Chrome suite as opt-in
• Resolve the workspace root independently of the caller's directory
• Do not force live Chrome tests in the coverage gate
• Do not force live Chrome tests in the coverage gate
• Do not force live Chrome tests in the coverage gate
• Keep coverage independent of live Chrome
• Do not force live Chrome tests in the coverage gate
• Keep live Chrome tests out of the coverage gate

Before merge

• Address Keep coverage independent of live Chrome (\.github/scripts/test\-check\-file\-coverage\.sh).

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The added self-test script is anchored to the repository root and verifies the coverage wrapper's main success and failure paths. The change looks safe to merge, and the earlier coverage-gate concerns are fixed by the current opt-in and root-resolution checks. _The code index is behind this pull request (indexed at `5aafc0985138`), so retrieved context may be out of date._ _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

security

• Conclusion: Failure
• Scope reviewed: all assigned evidence
• Lane summary: The script adds useful coverage-report fixtures and validates caller-independent path handling, but it also locks the coverage gate to requiring live Chrome tests. That makes the change unsafe to merge until coverage remains usable on browserless runners. (8 earlier finding(s) still open) _The code index is behind this pull request (indexed at `5aafc0985138`), so retrieved context may be out of date._ _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._
• Evidence: \.github/scripts/test\-check\-file\-coverage\.sh — Keep coverage independent of live Chrome

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Adds a test script for the coverage gate, verifying correct production-file filtering, opt-in enforcement, and Chrome presence checks. Prior concerns about live Chrome inclusion have been addressed or were rejected upstream. _The code index is behind this pull request (indexed at `5aafc0985138`), so retrieved context may be out of date._ _3 memory call(s) failed (model: cortex: v1/answer answered 502 Bad Gateway), so this review saw part of what the engine holds._

e2e

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

Evidence and run details

• Models: ladder/vectors, gpt-5.6-luna, deepseek-v4-flash
• Spend: $0.003492
• Tokens: 136315 input · 10742 output · 21404 cached · 668 embedding

Head	State	Pass summary
5d4180699d3e	changes requested	7 active finding(s), 0 resolved finding(s) (at 1790280158)
5d4180699d3e	ready for maintainer review	6 active finding(s), 0 resolved finding(s) (at 1790281145)
c310cc263ad6	changes requested	4 active finding(s), 48 resolved finding(s) (at 1790281874)
5aafc0985138	changes requested	3 active finding(s), 24 resolved finding(s) (at 1790282303)
566cc8b91c20	changes requested	1 active finding(s), 18 resolved finding(s) (at 1790282547)

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 8 billable files and costs up to $2.00.}

Or wait 8 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 947a9dda-f89d-4953-8297-33537f68cc4d

📥 Commits

Reviewing files that changed from the base of the PR and between d95b3b7 and 566cc8b.

📒 Files selected for processing (8)

• .github/scripts/check-file-coverage-report.sh
• .github/scripts/check-file-coverage.sh
• .github/scripts/test-check-file-coverage.sh
• .github/workflows/ci.yml
• .github/workflows/release.yml
• AGENTS.md
• CONTRIBUTING.md
• docs/specs/tinybus-module-release.md

---

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0105 · 420,268 in / 22,443 out · 59,413 cached (14%) · flash, ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 609 embedded
critique:    $0.0063 · 258,655 in / 9,170 out  · 37,494 cached (14%) · gpt-5.6-luna, deepseek-v4-flash
security:    $0.0037 · 139,702 in / 4,290 out  · 9,119 cached (7%)   · gpt-5.6-luna
description: $0.0003 · 9,075 in   / 4,303 out  · 1,024 cached (11%)  · deepseek-v4-flash

[tinysweeper]

Requesting changes: 2 lane(s) blocking, worst finding is high.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

             $0.0097 · 353,397 in / 25,942 out · 46,027 cached (13%) · ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 651 embedded
critique:    $0.0052 · 195,443 in / 10,220 out · 23,250 cached (12%) · gpt-5.6-luna, deepseek-v4-flash
security:    $0.0038 · 129,120 in / 8,279 out  · 14,585 cached (11%) · gpt-5.6-luna
description: $0.0004 · 12,667 in  / 5,902 out  · 1,024 cached (8%)   · deepseek-v4-flash

[tinysweeper]

Requesting changes: 2 lane(s) blocking, worst finding is high.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

             $0.0078 · 296,391 in / 15,263 out · 25,267 cached (9%) · ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 666 embedded
critique:    $0.0049 · 182,755 in / 7,777 out  · 12,915 cached (7%) · gpt-5.6-luna, deepseek-v4-flash
security:    $0.0023 · 83,791 in  / 2,921 out  · 3,648 cached (4%)  · gpt-5.6-luna
description: $0.0003 · 13,300 in  / 1,761 out  · 1,024 cached (8%)  · deepseek-v4-flash

[tinysweeper]

Requesting changes: 1 lane(s) blocking, worst finding is high.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

             $0.0035 · 136,315 in / 10,742 out · 21,404 cached (16%) · ladder/vectors, gpt-5.6-luna, deepseek-v4-flash · 668 embedded
critique:    $0.0014 · 53,501 in  / 1,923 out  · 6,204 cached (12%)  · gpt-5.6-luna
security:    $0.0015 · 52,843 in  / 2,504 out  · 5,472 cached (10%)  · gpt-5.6-luna
description: $0.0003 · 13,415 in  / 2,487 out  · 2,048 cached (15%)  · deepseek-v4-flash

This review concerned unconditional live Chrome coverage on an earlier head. Commit 5aafc09 moved opt-in to the explicitly Chrome-provisioned CI and release jobs; the wrapper now requires an explicit opt-in instead of enabling it. All inline threads were answered and resolved, and the 90% per-file gate passed locally and on Ubuntu CI. Re-request to tinysweeper is unavailable because GitHub cannot resolve that bot login. Dismissing only this addressed stale verdict.