[github-actions]

Test Coverage Improvement: WasmGuard dispatch methods

Function Analyzed

• Package: internal/guard
• File: internal/guard/wasm.go
• Previous Coverage: 79.2%
• New Coverage: 92.1%
• Improvement: +12.9%
• Complexity: High (WASM execution, host functions, memory protocol)

Why This Function?

The internal/guard package had the lowest coverage (79.2%) among testable packages, with several core dispatch functions at 0% coverage. These functions are the primary interface between the Go gateway and WASM security guard modules:

Function	Before	After
unmarshalWasmResponse	0.0%	100.0%
NewWasmGuard	0.0%	100.0%
hostLog	0.0%	100.0%
LabelResource	0.0%	83.3%
LabelAgent	0.0%	76.0%
hostCallBackend	27.3%	87.3%
LabelResponse	0.0%	59.1%

Tests Added

TestUnmarshalWasmResponse — 6 cases:

• ✅ Empty bytes → JSON error
• ✅ Invalid JSON → error with func name in message
• ✅ JSON array → error (cannot unmarshal into map)
• ✅ Valid JSON object → success
• ✅ Empty JSON object → success
• ✅ funcName appears in error message

TestNewWasmGuard — 3 cases:

• ✅ File not found → "failed to read WASM file" error
• ✅ File with invalid WASM bytes → error from instantiation
• ✅ Valid minimal WASM missing required guard exports → error

TestHostLog — 6 cases:

• ✅ Memory read failure (huge msgLen) → silent return, no panic
• ✅ logLevelDebug (0)
• ✅ logLevelInfo (1)
• ✅ logLevelWarn (2)
• ✅ logLevelError (3)
• ✅ Unknown log level → fallback format

TestLabelAgent — 5 cases:

• ✅ Nil policy → normalizePolicyPayload error
• ✅ Empty string policy → error
• ✅ Policy without allow-only → buildStrictLabelAgentPayload error
• ✅ Failed (trapped) guard → immediate error
• ✅ WASM returning empty → "label_agent returned empty response"

TestLabelResource — 3 cases:

• ✅ Failed guard → immediate error
• ✅ Function not exported from WASM module → error
• ✅ WASM returns empty bytes → unmarshalWasmResponse JSON error

TestLabelResponse — 4 cases:

• ✅ Failed guard → immediate error
• ✅ Function not exported → error
• ✅ WASM returns empty result → (nil, nil) (no labeling)
• ✅ WASM returns invalid JSON bytes → unmarshalWasmResponse error

TestHostCallBackend — 8 cases:

• ✅ Tool name memory read failure (oversized len)
• ✅ Args memory read failure (oversized argsLen)
• ✅ Invalid JSON args → JSON unmarshal error
• ✅ Backend call failure → -1 error sentinel
• ✅ Result too large with 4-byte hint buffer → -2 with hint
• ✅ Result too large with <4-byte buffer → -2 without hint
• ✅ Success with no args → positive result length
• ✅ Success with valid JSON args → positive result length

New WASM Fixtures

Three inline WASM byte-slice fixtures added (hand-computed from WAT, no compiler required):

• labelResourceReturnsZeroWasm — exports label_resource, returns 0 (empty result)
• labelResponseReturnsZeroWasm — exports label_response, returns 0 (empty result)
• labelResponseReturnsTwoWasm — exports label_response, returns 2 (claims 2 bytes in zeroed buffer = invalid JSON)

Coverage Report

Before: 79.2% coverage
After:  92.1% coverage
Improvement: +12.9%

Test Execution

All 30 new tests pass:

--- PASS: TestUnmarshalWasmResponse (0.00s)
--- PASS: TestNewWasmGuard (0.00s)
--- PASS: TestHostLog (0.00s)
--- PASS: TestLabelAgent_PolicyValidationErrors (0.00s)
--- PASS: TestLabelAgent_FailedGuard (0.00s)
--- PASS: TestLabelAgent_EmptyWasmResponse (0.00s)
--- PASS: TestLabelResource_FailedGuard (0.00s)
--- PASS: TestLabelResource_FunctionNotExported (0.00s)
--- PASS: TestLabelResource_EmptyWasmResponseTriggersMarshalError (0.00s)
--- PASS: TestLabelResponse_FailedGuard (0.00s)
--- PASS: TestLabelResponse_FunctionNotExported (0.00s)
--- PASS: TestLabelResponse_EmptyResultReturnsNil (0.00s)
--- PASS: TestLabelResponse_InvalidJsonResponseReturnsError (0.00s)
--- PASS: TestHostCallBackend_ToolNameReadFailure (0.00s)
--- PASS: TestHostCallBackend_ArgsReadFailure (0.00s)
--- PASS: TestHostCallBackend_InvalidArgsJSON (0.00s)
--- PASS: TestHostCallBackend_BackendCallFailure (0.00s)
--- PASS: TestHostCallBackend_ResultTooLarge (0.00s)
--- PASS: TestHostCallBackend_ResultTooLarge_BufferLessThan4 (0.00s)
--- PASS: TestHostCallBackend_SuccessWithNoArgs (0.00s)
--- PASS: TestHostCallBackend_SuccessWithValidArgs (0.00s)
ok  	github.com/github/gh-aw-mcpg/internal/guard	coverage: 92.1% of statements

---

Generated by Test Coverage Improver

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

• go.opentelemetry.io
• go.yaml.in
• golang.org
• google.golang.org
• gopkg.in
• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "go.opentelemetry.io"
    - "go.yaml.in"
    - "golang.org"
    - "google.golang.org"
    - "gopkg.in"
    - "proxy.golang.org"

See Network Configuration for more information.

Generated by Test Coverage Improver · 576.1 AIC · ⊞ 7.1K · ◷

[Copilot]

Pull request overview

Adds a dedicated test suite for internal/guard’s WasmGuard dispatch and host-call paths, increasing confidence in the WASM↔Go boundary behavior and improving package-level coverage.

Changes:

• Introduces wasm_dispatch_test.go with table/branch coverage for unmarshalWasmResponse, NewWasmGuard, hostLog, LabelAgent, LabelResource, LabelResponse, and hostCallBackend.
• Adds small inline WASM byte fixtures to hit specific dispatch edge cases (empty results / invalid JSON) without requiring a WASM toolchain.
• Exercises error/sentinel protocols for hostCallBackend (e.g., -1 error, -2 buffer-too-small) via direct host-function invocation.

Show a summary per file

File	Description
internal/guard/wasm_dispatch_test.go	Adds focused unit tests and WASM fixtures to cover WasmGuard dispatch methods and host-call behavior.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 3
• Review effort level: Low

[lpcox]

@copilot address review feedback and fix linting error https://github.com/github/gh-aw-mcpg/actions/runs/28254607796/job/83762156749?pr=8148

[Copilot]

@copilot address review feedback and fix linting error https://github.com/github/gh-aw-mcpg/actions/runs/28254607796/job/83762156749?pr=8148

Addressed in commit d212d08.

• Renamed the LabelResource test to use UnmarshalError wording.
• Strengthened TestHostCallBackend_ResultTooLarge to assert the required-size hint written to resultPtr when resultSize >= 4.
• Strengthened TestHostCallBackend_ResultTooLarge_BufferLessThan4 to prefill and verify the buffer is unchanged when resultSize < 4.
• Fixed the lint failure by formatting internal/guard/wasm_dispatch_test.go.

Validation run: targeted go test for updated cases, make lint, and full make agent-finished.