ci: Add Codecov workflow and coverage badges

[enuno]

User description

Summary

🤖 Generated with Claude Code

• Added GitHub Actions workflow for automated test coverage reporting
• Set up complete testing infrastructure (Jest + TypeScript + ts-jest)
• Integrated Codecov with badge and sunburst visualization in README
• Added smoke tests to verify infrastructure works correctly
• Updated .gitignore for Node.js and testing artifacts

Changes

Testing Infrastructure

• package.json: Node.js project with Jest, TypeScript, and testing dependencies
• tsconfig.json: TypeScript configuration for test compilation
• tests/infrastructure.test.ts: Smoke tests to verify testing setup

CI/CD

• .github/workflows/codecov.yml: GitHub Actions workflow that:
  • Runs on every push
  • Installs dependencies
  • Executes tests with coverage collection
  • Uploads results to Codecov using pre-configured secret

Documentation

• README.md: Added Codecov badge in header and sunburst visualization in Quality Standards section
• .gitignore: Added Node.js artifacts (node_modules, coverage, dist, etc.)

Test Plan

• npm install - 279 packages installed successfully
• npm test - 3 smoke tests passing
• npm run test:coverage - coverage collection working
• TypeScript type checking passes (tsc --noEmit)
• GitHub Actions workflow runs successfully on push
• Codecov upload succeeds and badge displays

Notes

Current tests are intentionally minimal smoke tests to verify infrastructure. Future PRs can add:

• Template validation tests (YAML/TOML parsing)
• Variable consistency checks
• Docker Compose syntax validation
• Real behavior testing per TDD principles

Code Review

Self-review completed with nori-code-reviewer. Identified potential enhancements for future PRs:

• Consider specifying Node.js version in workflow for reproducibility
• Add workflow path filters to skip on documentation-only changes
• Expand test coverage with real template validation

Current implementation is production-ready for initial Codecov integration.

Share Claude Code with your team: https://github.com/anthropics/claude-code

---

PR Type

Enhancement, Tests

---

Description

• Set up complete testing infrastructure with Jest, TypeScript, and ts-jest

• Add GitHub Actions workflow for automated test coverage reporting

• Integrate Codecov badge and sunburst visualization in README

• Create smoke tests to verify testing infrastructure functionality

---

Diagram Walkthrough

flowchart LR
  A["Testing Setup<br/>Jest + TypeScript"] --> B["GitHub Actions<br/>Workflow"]
  B --> C["Codecov<br/>Integration"]
  C --> D["README<br/>Badges & Visualization"]
  A --> E["Smoke Tests<br/>Infrastructure Verification"]

Loading

File Walkthrough

	Relevant files
Configuration changes	package.json Configure Jest and TypeScript testing dependencies              package.json Added Jest, TypeScript, and ts-jest as dev dependencies Configured npm scripts for test execution and coverage collection Set up Jest configuration with ts-jest preset for TypeScript support Configured coverage collection to exclude test files and node_modules +31/-0    tsconfig.json Set up TypeScript compiler configuration                                  tsconfig.json Created TypeScript configuration targeting ES2020 Enabled strict type checking mode Configured module resolution for Node.js environment Added Jest type definitions for test support +18/-0    codecov.yml Add GitHub Actions workflow for coverage reporting              .github/workflows/codecov.yml Created GitHub Actions workflow triggered on every push Configured steps to checkout code, set up Node.js, install dependencies Added test execution with coverage collection using Jest Integrated Codecov upload using pre-configured CODECOV_TOKEN secret +28/-0
Tests	infrastructure.test.ts Add infrastructure smoke tests for Jest                                    tests/infrastructure.test.ts Created smoke tests to verify Jest functionality Added TypeScript compilation verification test Implemented basic assertion tests for test framework validation Tests confirm testing infrastructure is properly configured +20/-0
Documentation	README.md Add Codecov badge and coverage visualization                          README.md Added Codecov badge in header with project-specific token Inserted Code Coverage Visualization section with sunburst graph Maintained existing Quality Standards section content Improved README formatting with consistent spacing +9/-3
Miscellaneous	CLAUDE.md Add Claude context metadata file                                                  .github/workflows/CLAUDE.md Created metadata file for Claude AI context tracking Initialized with empty recent activity section +7/-0      CLAUDE.md Add Claude activity metadata for tests                                      tests/CLAUDE.md Created metadata file documenting infrastructure test addition Recorded activity timestamp and test implementation details +11/-0

---

[gemini-code-assist]

Summary of Changes

Hello @enuno, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request establishes a robust continuous integration and testing framework for the project. It introduces automated test execution and code coverage reporting via GitHub Actions and Codecov, ensuring that code quality metrics are consistently tracked and visualized. This foundational work paves the way for more comprehensive testing and improved maintainability.

Highlights

• Automated Test Coverage: Implemented a GitHub Actions workflow for automated test coverage reporting, ensuring continuous monitoring of code quality.
• Testing Infrastructure Setup: Established a complete testing infrastructure utilizing Jest, TypeScript, and ts-jest to support robust unit and integration testing.
• Codecov Integration: Integrated Codecov for detailed coverage reporting, including a badge in the README header and a sunburst visualization for a clear overview of coverage metrics.
• Infrastructure Smoke Tests: Added initial smoke tests to validate the correct functioning of the newly configured Jest and TypeScript testing environment.
• Git Ignore Updates: Updated the .gitignore file to properly exclude Node.js modules, testing output directories (like coverage/), and build artifacts (dist/, build/).

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Ignored Files

• Ignored by pattern: .github/workflows/** (2)
  • .github/workflows/CLAUDE.md
  • .github/workflows/codecov.yml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jest@​29.7.0
	@​types/​jest@​29.5.14
	ts-jest@​29.4.6

View full report

[qodo-code-review]

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
⚪	Unpinned GitHub Actions Description: The workflow uses third-party GitHub Actions by mutable tags (e.g., actions/checkout@v4, actions/setup-node@v4, codecov/codecov-action@v5) instead of pinning to immutable commit SHAs, which creates a supply-chain risk if an action tag is hijacked or updated maliciously. codecov.yml [11-28] Referred Code - name: Checkout uses: actions/checkout@v4 with: fetch-depth: 2 - name: Set up Node uses: actions/setup-node@v4 - name: Install dependencies run: npm install - name: Run tests run: npx jest --coverage - name: Upload results to Codecov uses: codecov/codecov-action@v5 with: token: ${{ secrets.CODECOV_TOKEN }}
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
⚪	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Possible token exposure: The new Codecov badge and sunburst image URLs include a token query parameter which may be sensitive depending on repository/privacy settings and Codecov configuration. Referred Code [](https://codecov.io/github/enuno/dokploy) **Version:** 1.0.0 **Last Updated:** December 24, 2025 **Repository:** https://github.com/enuno/dokploy **Project Lead:** Ryno Crypto Mining Services - ServerDomes Network Engineering --- ## 📋 Overview This repository contains **production-ready Dokploy application templates** with integrated **Cloudflare services** (Workers, Pages, D1, R2, KV, Analytics Engine). The project is managed by a **unified multi-agent AI coding system** that ensures consistent quality, rapid iteration, and automated validation. ### Key Features - ✅ **Self-Contained Templates** - Each template is a complete Docker Compose + template.toml package - ✅ **Cloudflare Integration** - Workers, Pages, D1, R2, KV support built-in - ✅ **Production-Ready** - Tested, validated, staged before PR submission - ✅ **AI-Assisted** - Claude designs, Cursor implements, Cline validates, Windsurf orchestrates - ✅ **Automated Validation** - >80% test coverage, staging deployment, health checks - ✅ **Zero-Trust Standards** - AGENTS.md as centralized source of truth for all agents ... (clipped 479 lines) Learn more about managing compliance generic rules or creating your own custom rules
Update

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment

Thanks for integrating Codecov - We've got you covered ☂️

[gemini-code-assist]

Code Review

This pull request introduces test coverage reporting with Codecov by setting up a testing infrastructure with Jest and TypeScript, adding a GitHub Actions workflow, and updating the README with coverage badges. My review identified a critical security issue where a Codecov token is exposed in the README.md file. Additionally, I've pointed out a high-severity issue in the .gitignore file concerning the exclusion of package-lock.json, which can affect build reproducibility. The rest of the changes for setting up the testing framework look good.

[gemini-code-assist]

The Codecov token is exposed in the badge URL. This is a security risk, as tokens should be kept secret. For public repositories, the token is not required to display the badge. Please remove the token from the URL.

Suggested change

	[](https://codecov.io/github/enuno/dokploy)
	[](https://codecov.io/github/enuno/dokploy)

[gemini-code-assist]

The Codecov token is exposed in the sunburst graph URL. This is a security risk, as tokens should be kept secret. For public repositories, the token is not required to display the graph. Please remove the token from the URL.

Suggested change

	
	

[gemini-code-assist]

package-lock.json should not be in .gitignore. This file is crucial for ensuring that the exact same dependency versions are used across all environments (developer machines, CI/CD pipelines, etc.), which prevents "works on my machine" issues. By committing it, you guarantee reproducible builds.

[qodo-code-review]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Security	Remove exposed badge token Remove the hardcoded Codecov token from the badge URL in README.md. README.md [3] -[](https://codecov.io/github/enuno/dokploy) +[](https://codecov.io/github/enuno/dokploy) Apply / Chat Suggestion importance[1-10]: 8 __ Why: The suggestion correctly identifies a hardcoded token in a public file, which is a security risk, and proposes its removal.	Medium
Possible issue	Exclude test files from coverage Update the Jest configuration in package.json to exclude all test file patterns from code coverage calculation. package.json [24-29] "collectCoverageFrom": [ "**/*.ts", "!**/*.d.ts", "!**/node_modules/**", - "!**/__tests__/**" + "!**/__tests__/**", + "!**/*.test.ts", + "!**/*.spec.ts" ] Apply / Chat Suggestion importance[1-10]: 7 __ Why: The suggestion correctly identifies that test files matching testMatch patterns are not excluded from coverage collection, which could skew metrics. This improves the accuracy of the coverage report.	Medium
General	Add pull_request trigger Update the GitHub Actions workflow to trigger on pull_request events in addition to push events. .github/workflows/codecov.yml [3-4] on: push + pull_request Apply / Chat Suggestion importance[1-10]: 7 __ Why: This is a valuable suggestion that improves the CI/CD process by ensuring tests and coverage checks run on pull requests, which is a standard best practice.	Medium
Update