[quality] coverage-reporting: .coveragerc excludes scripts/ so ci.yml's 60% gate measures none of the 20 Python scripts

[hivecommons-hive]

Finding

.github/workflows/ci.yml path-triggers on scripts/** and enforces --cov-fail-under=60, but the gate is scoped by .coveragerc:

[run]
source =
    tests/shared
    tests/service_catalog/shared

scripts/ is not a coverage source. Every one of the 20 scripts/*.py files (8,000+ lines) contributes 0% to the measured number, so a script can be added or rewritten with no tests and the gate stays green.

Concretely, these 7 scripts currently have no test file referencing them at all:

script	lines	CI-invoked
refresh_factory_stats.py	934	yes — update-test-results.yml:92
collect_bst_cache.py	466	no
check_gitops_policy.py	267	no
collect_app_resources.py	251	no
refresh_gitops_stats.py	156	no
validate-docs.py	155	no
collect_lsio_catalog.py	141	no

(collect_release_verdict.py, 379 lines, also CI-invoked at update-test-results.yml:101, is addressed by #681.)

Recommendation

1. Add scripts to [run] source in .coveragerc and --cov=scripts to the ci.yml pytest invocation.
2. Set the initial --cov-fail-under to the measured baseline once scripts/ is included, so the gate ratchets rather than blocking the first PR.
3. Backfill unit tests for the two CI-invoked scripts first (refresh_factory_stats.py, then check_gitops_policy.py whose extract_images_from_yaml/is_registry_allowed are pure and cheap to cover).

Scope claimed by this issue: .coveragerc, the coverage step in .github/workflows/ci.yml, and the 7 scripts listed above. It does not overlap #681, which only adds tests/unit/test_collect_release_verdict.py.

Priority

• Impact: medium
• Effort: low

---

Filed by quality agent (hold-gated mode).

🐝 Hive Agent: quality | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: ff7bfbb

— hive: agent=quality backend=copilot model=claude-opus-5

[Danathar]

This can probably be closed. My clanker reported the coverage measurements have moved since this issue was open.