The target gate measures line coverage and fails below a pinned bar on the
modules that decide security outcomes, rather than on the whole codebase. The bar
is a number in its checker, read from a clone rather than from a browser:
git clone --depth 1 https://github.com/Flowfin/jellyfin-plugin-sso ssoclone
cd ssoclone && git rev-parse --short HEAD
2b37832
grep -n '^SECURITY_LINE_BAR' scripts/check-coverage.py
68:SECURITY_LINE_BAR = 92.0
The pattern is anchored on purpose. Unanchored, that grep also returns the two
lines that use the constant, and a paste showing one line of a three-line output
is the shape this board is meant to refuse.
The reasoning behind that shape is worth keeping. A whole-codebase percentage can
be met by covering the easy half, and it can be missed by adding a large,
trivial, well-understood module. Keying the gate to the surface that decides
outcomes means a thin non-critical path cannot trip it and a regression on the
path that matters cannot slip through it.
The deviation and its reason: this repository has no authentication decision
surface of its own, so the pinned surface is different. Here it is the session
and token handling, the transport and its timeouts, the error mapping, the cache
keying, and the image format refusal, because those are the paths where a defect
is exploitable or silently wrong.
What this produces
A coverage run in the gate, a whole-repository number reported and tracked, and a
pinned bar on the named surface that fails the build below it.
The list of modules in the pinned surface kept as data, with a check that fails
when a new module is added to that surface without being listed, since a surface
list maintained by memory is a list that is wrong within a month.
The threshold step using set -o pipefail where its verdict comes through a
pipe, because the default shell for a bare run: is bash -e without it and the
gate would otherwise take the exit status of the last command in the pipe.
Done when
The bar is set with the measurement that justified its value, a deliberate
uncovered branch on the pinned surface reddens the check, an unlisted new module
on that surface reddens it, and the whole-repository number is published with the
command that produced it. Blocked on #16 and #80.
The target gate measures line coverage and fails below a pinned bar on the
modules that decide security outcomes, rather than on the whole codebase. The bar
is a number in its checker, read from a clone rather than from a browser:
The pattern is anchored on purpose. Unanchored, that grep also returns the two
lines that use the constant, and a paste showing one line of a three-line output
is the shape this board is meant to refuse.
The reasoning behind that shape is worth keeping. A whole-codebase percentage can
be met by covering the easy half, and it can be missed by adding a large,
trivial, well-understood module. Keying the gate to the surface that decides
outcomes means a thin non-critical path cannot trip it and a regression on the
path that matters cannot slip through it.
The deviation and its reason: this repository has no authentication decision
surface of its own, so the pinned surface is different. Here it is the session
and token handling, the transport and its timeouts, the error mapping, the cache
keying, and the image format refusal, because those are the paths where a defect
is exploitable or silently wrong.
What this produces
A coverage run in the gate, a whole-repository number reported and tracked, and a
pinned bar on the named surface that fails the build below it.
The list of modules in the pinned surface kept as data, with a check that fails
when a new module is added to that surface without being listed, since a surface
list maintained by memory is a list that is wrong within a month.
The threshold step using
set -o pipefailwhere its verdict comes through apipe, because the default shell for a bare
run:isbash -ewithout it and thegate would otherwise take the exit status of the last command in the pipe.
Done when
The bar is set with the measurement that justified its value, a deliberate
uncovered branch on the pinned surface reddens the check, an unlisted new module
on that surface reddens it, and the whole-repository number is published with the
command that produced it. Blocked on #16 and #80.