[quality] ci.yml reports coverage but never enforces it: run the reporter's --check gate

[hivecommons-hive]

Finding

.github/workflows/ci.yml:28 measures unit coverage and then throws the result away as far as the build is concerned:

      - name: Run unit tests with coverage
        run: npm run test:unit:coverage | tee coverage-summary.txt
        shell: bash -o pipefail {0}

npm run test:unit:coverage invokes tests/tools/coverage-report.mjs with no --check, so the reporter prints a total and exits 0 regardless of what that total is. The summary is published to $GITHUB_STEP_SUMMARY and uploaded as the coverage-summary artifact, but nothing compares it to anything. Coverage can collapse from 98.94% to 40% and the Validate repository check stays green.

The reporter has supported a gate since it was written — --check <minLinePercent> exits 1 below the threshold — so this is one line away from being enforced.

Measured at rev a994a2e in a fresh clone after npm ci: npm run -s test:unit:coverage on node v26.8.2 reports all files | 98.94. Latest green CI run: 36009167129.

Recommendation

Once the test:unit:coverage:check script exists, replace the step body in .github/workflows/ci.yml. Exact replacement — the step keeps its name, its tee, its pipefail shell and its position, and only the npm script changes:

      - name: Run unit tests with coverage
        run: npm run test:unit:coverage:check | tee coverage-summary.txt
        shell: bash -o pipefail {0}

The Publish coverage summary and Upload coverage report steps that follow are already if: always(), so the summary and the artifact are still produced when the gate fails — which is exactly when someone wants to read them.

• .github/workflows/ci.yml runs test:unit:coverage:check
• a PR that drops line coverage below the threshold fails Validate repository
• the coverage summary and artifact are still published on a failing run

This needs a human to land

The change is confined to .github/workflows/ci.yml. The quality agent's GitHub App token is minted at the contributor tier, which does not carry the Workflows permission, so GitHub rejects any push whose diff touches .github/workflows/** server-side. This is a hard ceiling, not a judgement call: no PR this agent can open is capable of containing the change. It needs a human maintainer, or an agent whose token carries workflows.

The replacement text above is given in full so applying it is mechanical.

Priority

• Impact: high — the repository believes it has a coverage gate and does not have one
• Effort: low — one line, already written above

---

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5n31 | SHA: unknown

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

task-list sweep: 0 of 3 items ticked. Not closing yet — outstanding boxes remain.

Outstanding items:

• 🔲 .github/workflows/ci.yml runs test:unit:coverage:check
• 🔲 a PR that drops line coverage below the threshold fails Validate repository
• 🔲 the coverage summary and artifact are still published on a failing run

Merged PRs referencing this issue so far:

• test: cover the sandbox-aware coverage reporter and add a --check entry point #592 — test: cover the sandbox-aware coverage reporter and add a --check entry point

This comment is edited in place by the task-list sweep on every cycle; it is not duplicated.

[mrbobbytables]

Fixed in #659 (merged): the Run unit tests with coverage step in .github/workflows/ci.yml now runs npm run test:unit:coverage:check, which fails below the 97% line-coverage threshold, instead of the non-enforcing test:unit:coverage.