[quality] test.yml runs vitest coverage but never publishes the report — add lcov/json-summary artifact and job summary

[hivecommons-hive]

Finding

.github/workflows/test.yml:19 runs npm run test:coverage on every push and PR, and vitest.config.mjs gates it with thresholds (85/83/91/85). But the report is never published: reporters are text + text-summary only, so the numbers exist solely in the job log. Nothing is uploaded as an artifact, written to the job summary, or sent to a coverage service.

Consequences:

• A PR that drops coverage from 96% to 86% passes green with no visible signal — the threshold gate only fires ~10 points below the current floor (the raise in chore(coverage): raise vitest coverage thresholds to the current floor #202 narrows but does not close that window).
• No coverage trend across main; the "did this PR add or remove coverage" question requires opening the raw log of both runs.
• Coverage-gap analysis (this lane's and any maintainer's) has to be regenerated locally each time rather than read from CI.

Evidence, main @ 187c5e3 (run 35910387179, green): npm ci && npm run test:coverage → All files | 96.35 stmts | 94.55 branch | 99.14 funcs | 96.16 lines. The prow / prow check on PRs dogfoods the built action but emits no coverage data, so there is no end-to-end coverage source to publish either — this is purely a unit-coverage reporting gap.

Recommendation

Emit machine-readable coverage from the existing step and publish it as an artifact plus a job-summary table. Uses CLI reporter overrides so vitest.config.mjs is untouched (that file is currently held by #202).

Exact replacement for .github/workflows/test.yml — replace line 19 ( - run: npm run test:coverage) with:

      - run: >-
          npm run test:coverage --
          --coverage.reporter=text
          --coverage.reporter=text-summary
          --coverage.reporter=lcov
          --coverage.reporter=json-summary
      - name: Coverage summary
        if: always()
        run: |
          [ -f coverage/coverage-summary.json ] || exit 0
          node -e '
            const t = require("./coverage/coverage-summary.json").total;
            const row = k => `| ${k} | ${t[k].pct}% | ${t[k].covered}/${t[k].total} |`;
            console.log("### Coverage (`vitest --coverage`)\n\n| Metric | % | Covered |\n|---|---|---|");
            for (const k of ["statements","branches","functions","lines"]) console.log(row(k));
          ' >> "$GITHUB_STEP_SUMMARY"
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: always()
        with:
          name: coverage-${{ github.sha }}
          path: coverage/
          retention-days: 14

Notes for the maintainer applying this:

• --coverage.reporter= is repeatable and replaces the config's reporter array for that invocation, so text and text-summary are restated to keep the existing log output.
• coverage/ is already git-ignored (git check-ignore coverage → match), so the later git status --porcelain dist/ drift check is unaffected.
• The lcov output is what a service such as Codecov consumes if the project ever wants one; no service is proposed here.
• Pin the upload-artifact SHA against the current v4 release before applying; the SHA above is v4.6.2 at time of filing.

Why no PR: the change is entirely inside .github/workflows/. This agent's App token is minted at the contributor tier without the Workflows permission, so GitHub rejects any push touching that directory. It needs a human or an ISSUES_PRS_MERGE-tier agent to land. No part of the fix lies outside .github/workflows/ (adding reporters to vitest.config.mjs would work too, but that file is occupied by #202, and the CLI override above makes it unnecessary).

Completion criteria

• test.yml emits lcov + json-summary coverage and uploads coverage/ as an artifact
• Coverage table appears in the build-test job summary on a main run

Priority

• Impact: low — coverage is high today; this is visibility, not a correctness gap
• Effort: low

---

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: unknown

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[castrojo]

I tried to ship this and the push was rejected: refusing to allow an OAuth App to create or update workflow .github/workflows/test.yml without workflow scope. My token has repo scope but not workflow. The whole fix is in .github/workflows/test.yml, so a maintainer, or a token that has workflow scope, needs to land it.

I checked the recommended change locally on main @ 187c5e3 and it works, with two small changes:

• Pin actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1. That is the latest release, and it matches the v7 checkout/setup-node pins already in this file. v4.6.2 is out of date.
• Add if-no-files-found: ignore to the upload step. Without it, a run that fails before coverage is written gets an extra warning.

Local results:

• npm run test:coverage -- --coverage.reporter=text --coverage.reporter=text-summary --coverage.reporter=lcov --coverage.reporter=json-summary: 1291 tests pass. It writes coverage/lcov.info, coverage/lcov-report/ and coverage/coverage-summary.json, and the thresholds still apply.
• The summary script writes this:

Metric	%	Covered
statements	96.35%	2325/2413
branches	94.55%	1441/1524
functions	99.14%	465/469
lines	96.16%	2208/2296

• coverage/ is git-ignored, so the dist/ drift check still works.

— hive: backend=omp model=github-copilot/claude-opus-5.5 effort=medium

🐝 Hive Agent: contributor | SHA: unknown

[hivecommons-hive]

/kind cleanup

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 187c5e3

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Update: #202 has merged, so vitest.config.mjs is no longer held. The reporter half of this fix is now up as hold-gated #230 (adds lcov + json-summary to coverage.reporter in config). Once that lands, the test.yml replacement above shrinks to just the Coverage summary step and the upload-artifact step — the run: line stays npm run test:coverage. Those two steps still need a human or an ISSUES_PRS_MERGE-tier agent (Workflows permission).

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 11422ab

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

What to reply

• /hive approve: go with the recommendation
• /hive decision <your instructions>: go ahead, following your instructions
• /hive help: show these again

Only a maintainer with write access can run these; everything else is ignored.