feat(coverage): validate that file paths are within repository boundary by brynary · Pull Request #2550 · qltysh/qlty

brynary · 2025-12-02T03:05:50Z

Summary

Add workspace containment validation to coverage uploads
Files that exist on disk but are outside the repository are now tracked separately as "outside workspace"
Such files count as "not present" for validation threshold calculation
CLI displays outside-workspace files when present (non-empty)
Validation failure message includes them when count is non-zero

Changes

qlty-coverage/src/publish/plan.rs - Added workspace_root: Option<PathBuf> field
qlty-coverage/src/publish/planner.rs - Updated new() to accept workspace_root, pass it to Plan
qlty-coverage/src/publish/report.rs - Added outside_workspace_files: HashSet<String> field
qlty-coverage/src/publish/processor.rs - Added is_within_workspace() check, populates outside_workspace_files
qlty-coverage/src/validate.rs - Added workspace_root to Validator, files_outside_workspace to ValidationResult, containment check
qlty-cli/src/commands/coverage/publish.rs - Gets workspace root, passes to Planner/Validator, displays outside-workspace files

Test plan

Added 4 new unit tests for outside-workspace detection in validate.rs
All 201 tests in qlty-coverage pass
cargo check passes
qlty fmt and qlty check --level=low --fix pass with no issues

🤖 Generated with Claude Code

Add workspace containment validation to coverage uploads. Previously, a path like `../../../foo/bar.sh` that existed on disk but was outside the repository would pass validation. Now such files are detected and tracked separately as "outside workspace" files. Changes: - Add workspace_root field to Plan and pass through from Planner - Add outside_workspace_files tracking to Report and Processor - Add is_within_workspace() check in Processor to categorize files - Update Validator to track files_outside_workspace in ValidationResult - Update CLI to display outside-workspace files when present - Files outside workspace count as "not present" for validation threshold 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

github-actions · 2025-12-02T03:06:01Z

No issue mentions found. Please mention an issue in the pull request description.

Use GitHub automation to close the issue when a PR is merged

Copilot

Pull request overview

This PR adds workspace boundary validation to coverage uploads to prevent files outside the repository from being counted towards coverage validation thresholds.

Files existing outside the repository workspace are now tracked separately as "outside workspace"
The validation threshold calculation excludes these files (treating them similarly to missing files)
CLI provides clear feedback about files outside the workspace when present

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
qlty-coverage/src/validate.rs	Added workspace containment check in validator with `is_within_workspace()` method and new field `files_outside_workspace` in `ValidationResult`
qlty-coverage/src/publish/processor.rs	Added workspace boundary checking during file processing with `is_within_workspace()` method to populate `outside_workspace_files`
qlty-coverage/src/publish/report.rs	Added `outside_workspace_files` field to track files outside workspace
qlty-coverage/src/publish/planner.rs	Updated to accept and pass `workspace_root` parameter through to Plan
qlty-coverage/src/publish/plan.rs	Added `workspace_root` field to store workspace boundary
qlty-cli/src/commands/coverage/publish.rs	Updated to obtain workspace root, display outside-workspace files, and include them in validation error messages

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-02T03:08:15Z

qlty-coverage/src/validate.rs

+    fn is_within_workspace(&self, file_path: &Path) -> bool {
+        let Some(ref workspace_root) = self.workspace_root else {
+            return true;
+        };
+
+        match (file_path.canonicalize(), workspace_root.canonicalize()) {
+            (Ok(canonical_file), Ok(canonical_root)) => canonical_file.starts_with(&canonical_root),
+            _ => false,
+        }
+    }


The is_within_workspace method is duplicated identically in processor.rs (lines 95-104). Consider extracting this logic into a shared utility function to maintain DRY (Don't Repeat Yourself) principle and ensure consistent behavior across the codebase.

Copilot · 2025-12-02T03:08:15Z

qlty-coverage/src/publish/processor.rs

+    fn is_within_workspace(&self, file_path: &Path) -> bool {
+        let Some(ref workspace_root) = self.plan.workspace_root else {
+            return true;
+        };
+
+        match (file_path.canonicalize(), workspace_root.canonicalize()) {
+            (Ok(canonical_file), Ok(canonical_root)) => canonical_file.starts_with(&canonical_root),
+            _ => false,
+        }
+    }


The is_within_workspace method is duplicated identically in validate.rs (lines 78-87). Consider extracting this logic into a shared utility function to maintain DRY (Don't Repeat Yourself) principle and ensure consistent behavior across the codebase.

qltysh · 2025-12-02T03:11:00Z

1 new issue

Tool	Category	Rule	Count
qlty	Structure	Function with high complexity (count = 20): compute	1

…update snapshot - Fix pluralization: "1 file" vs "X files" for both missing and outside repository counts - Update publish_validate.stderr snapshot to include the new detail line 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

qltysh · 2025-12-02T14:10:20Z

Diff Coverage for ubuntu-latest: The code coverage on the diff in this pull request is 73.9%.

Total Coverage for ubuntu-latest: This PR will decrease coverage by 0.05%.

File Coverage Changes

Path	File Coverage Δ	Indirect
qlty-cli/src/commands/coverage/publish.rs	-7.7
qlty-config/src/library.rs	0.5	√
qlty-coverage/src/ci/github.rs	-0.3	√
qlty-coverage/src/publish/planner.rs	0.1
qlty-coverage/src/publish/processor.rs	-4.1
qlty-coverage/src/utils.rs	-1.7

🛟 Help

Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.
Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.
File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)
- Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

qltysh · 2025-12-02T14:10:36Z

Diff Coverage for macos-15: The code coverage on the diff in this pull request is 73.9%.

Total Coverage for macos-15: This PR will decrease coverage by 0.05%.

File Coverage Changes

Path	File Coverage Δ	Indirect
qlty-cli/src/commands/coverage/publish.rs	-7.7
qlty-config/src/library.rs	0.5	√
qlty-coverage/src/ci/github.rs	-0.3	√
qlty-coverage/src/publish/planner.rs	0.1
qlty-coverage/src/publish/processor.rs	-4.1
qlty-coverage/src/utils.rs	-1.7

🛟 Help

Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.
Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.
File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)
- Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

Copilot

Pull request overview

Copilot reviewed 6 out of 8 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

qlty-coverage/src/validate.rs

Copilot

Pull request overview

Copilot reviewed 6 out of 8 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

qlty-coverage/src/utils.rs

- Add is_path_within_workspace function to utils.rs - Remove wrapper methods and call utility directly from validate.rs and processor.rs - Clean up unused Path imports 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings December 2, 2025 03:05

Copilot started reviewing on behalf of brynary December 2, 2025 03:06 View session

Copilot finished reviewing on behalf of brynary December 2, 2025 03:07

Copilot AI reviewed Dec 2, 2025

View reviewed changes

Copilot AI review requested due to automatic review settings December 2, 2025 14:21

Copilot started reviewing on behalf of brynary December 2, 2025 14:21 View session

Copilot finished reviewing on behalf of brynary December 2, 2025 14:24

Copilot AI reviewed Dec 2, 2025

View reviewed changes

qlty-coverage/src/validate.rs Show resolved Hide resolved

Copilot AI review requested due to automatic review settings December 2, 2025 14:45

Copilot started reviewing on behalf of brynary December 2, 2025 14:45 View session

Copilot finished reviewing on behalf of brynary December 2, 2025 14:48

Copilot AI reviewed Dec 2, 2025

View reviewed changes

qlty-coverage/src/utils.rs Show resolved Hide resolved

brynary force-pushed the feat/coverage-validate-workspace-containment branch from 691a925 to 020ddd0 Compare December 2, 2025 15:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(coverage): validate that file paths are within repository boundary#2550

feat(coverage): validate that file paths are within repository boundary#2550
brynary wants to merge 3 commits intomainfrom
feat/coverage-validate-workspace-containment

brynary commented Dec 2, 2025

Uh oh!

github-actions bot commented Dec 2, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Dec 2, 2025

Uh oh!

Copilot AI Dec 2, 2025

Uh oh!

qltysh bot commented Dec 2, 2025

Uh oh!

qltysh bot commented Dec 2, 2025 •

edited

Loading

Uh oh!

qltysh bot commented Dec 2, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

brynary commented Dec 2, 2025

Summary

Changes

Test plan

Uh oh!

github-actions bot commented Dec 2, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

qltysh bot commented Dec 2, 2025

1 new issue

Uh oh!

qltysh bot commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qltysh bot commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

qltysh bot commented Dec 2, 2025 •

edited

Loading

qltysh bot commented Dec 2, 2025 •

edited

Loading