SPA coverage to 100% lines, and the dependency gates this branch never had - #118
Merged
bgard68 merged 5 commits intoAug 25, 2026
Merged
Conversation
package.json declared istanbul-lib-instrument but the matching
package-lock.json update could not be pushed from this environment, and
`npm ci` refuses to install when the two disagree - so CI would have failed at
the install step before running a single spec.
Reverting package.json restores the pair to a consistent state. The 105 specs
do not need the package; only `ng test --code-coverage` does, because
@angular/build's karma builder resolves the instrumenter from the top level and
the lock file carries it only nested under karma-coverage.
To make coverage runnable from a clean clone, run this in lottery-web and
commit both files:
npm install --save-dev istanbul-lib-instrument
…-prs-security-quality-frze77-frontend
bgard68
deleted the
claude/lotteryapp-prs-security-quality-frze77-frontend
branch
August 25, 2026 03:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The branch had no dependency-vulnerability gate at all
This branch deploys to production, and nothing was checking what it installs:
dependency-reviewexisted only onmain. For a pull request GitHub resolves the workflow from the base branch, so a PR targetingfrontend— the branch carrying the entire npm tree — was reviewed by nothing. Added here, scoped to this branch.dependency-reviewcovers what a PR adds;npm audit --audit-level=moderatenow covers what is already there, at the same threshold the backend uses.Directory.Build.propswas missing theNuGetAuditpropertiesmainhas. This branch carriessrc/Lottery.Apiand its CI restores, builds and tests it, so a package with a published advisory restored silently here while the same change againstmainwas rejected.npx --yes openapi-typescriptresolved and executedlatestfrom the registry on every push and pull request — the one piece of unpinned remote code execution in a repo that otherwise SHA-pins every action and restores from lock files. Pinned to 7.13.0.Two more consistency fixes
ci.yml's Start API ran in Development. Without--no-launch-profile,launchSettings.jsonforces Development and overridesASPNETCORE_ENVIRONMENT— so this check proved a different configuration from the identically-named required check onmain, while branch protection showed the same green name on both. Also asserts readiness, since the wait loop exits 0 whether or not the API came up.dependabot.ymlhere was never evaluated (Dependabot reads the default branch only) while declaringnugetcoverage that did not exist. Reduced to an empty file with a pointer tomain's copy, where the realtarget-branch: frontendentry now lives.Coverage
Coverage did not work at all before this:
@angular/build's karma builder needsistanbul-lib-instrument, and the lock file carries it only nested underkarma-coverage, so--code-coveragefailed before instrumenting anything.53 specs → 105. The worst files —
api-base-url.ts(11%),viewport.ts(25%),ticket-checker.ts(69.7%),dashboard-store.ts(83.3%) — are all at 100% now.Two branches are deliberately left uncovered: a
?? []inticket-checker.tsthat neither call site can reach (both sit inside an@ifthat already guarantees non-null), and a default parameter on a test double. Both are noted rather than contorted around.One thing to finish
Making coverage reproducible from a clean clone needs one command, which is not in this PR:
It was declared here initially, but the regenerated 308 KB lock file could not be pushed through the API-only write path available at the time, and leaving
package.jsonahead of the lock file would have brokennpm ci. Reverted to a consistent pair rather than ship a branch that fails at install.Verification
npm ci,npm audit(0 vulnerabilities), 105/105 specs,ng build, andcheck:swa(5 security headers declared, no inline script) all pass against the pushed HEAD, withfrontendmerged in after #108.🤖 Generated with Claude Code