chore: add coverage enforcement

.github/workflows/test.yml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   test:
-    name: Test TypeScript CLI
+    name: Test CLI
     runs-on: ubuntu-latest
     services:
       altertable:
@@ -59,10 +59,17 @@ jobs:
           git diff --exit-code src/generated/openapi-types.ts
         working-directory: cli
 
-      - name: Unit tests
-        run: bun test
+      - name: Unit tests with coverage
+        run: bun run test:coverage
         working-directory: cli
 
+      - name: Upload coverage report
+        uses: actions/upload-artifact@v4
+        with:
+          name: cli-coverage-lcov
+          path: cli/coverage/lcov.info
+          if-no-files-found: error
+
       - name: Build JS bundle
         run: bun run build
         working-directory: cli
@@ -77,25 +84,25 @@ jobs:
           bin/altertable --version
           bin/altertable --help
 
-      - name: Run Configure Tests
+      - name: Run configure tests
         run: ./tests/configure_test.sh
 
-      - name: Run Management Tests
+      - name: Run management tests
         run: ./tests/management_test.sh
 
-      - name: Run Context Tests
+      - name: Run context tests
         run: ./tests/context_test.sh
 
-      - name: Run Catalogs Tests
+      - name: Run catalogs tests
         run: ./tests/catalogs_test.sh
 
-      - name: Run Scripting Tests
+      - name: Run scripting tests
         run: ./tests/scripting_test.sh
 
-      - name: Run Profile Tests
+      - name: Run profile tests
         run: ./tests/profile_test.sh
 
-      - name: Run Integration Tests
+      - name: Run integration tests
         run: ./tests/integration_test.sh
 
   compile:

AGENTS.md

@@ -20,7 +20,7 @@ Altertable CLI — a TypeScript/Bun command-line tool for querying and managing
 
 ```bash
 git submodule update --init --recursive   # first checkout only
-./scripts/verify.sh --quick               # focused CLI changes
+./scripts/verify.sh --quick               # focused CLI changes, including coverage
 ./scripts/verify.sh                         # full gate before PR (mirrors CI minus native compile)
 ./scripts/verify.sh --integration         # lakehouse HTTP paths (mock at :15000)
 ```

DEVELOPMENT.md

@@ -7,11 +7,13 @@ cd cli
 bun install
 bun run dev -- --help          # same as bin/altertable
 bun test
+bun run test:coverage          # coverage report
 bun run typecheck
 bun run lint                   # oxlint with type-aware rules (typescript-go)
 bun run lint:fix               # oxlint --fix
 bun run format                 # oxfmt
 bun run format:check           # CI formatting check
+bun run knip                   # required dead-code/unused-export check
 bun run generate               # regenerate OpenAPI types
 bun run build                  # bundle to cli/dist/cli.js
 bun run pack:check             # build + dry-run pack (verify publish contents)
@@ -102,7 +104,7 @@ Localhost HTTP works without `--allow-insecure-http`. For LAN or other non-local
 From repo root, one script mirrors CI (minus native binary compile):
 
 ```bash
-./scripts/verify.sh --quick        # typecheck, lint, format, knip, unit tests, openapi drift
+./scripts/verify.sh --quick        # typecheck, lint, format, knip, coverage, openapi drift
 ./scripts/verify.sh                # + build, pack:check, shell offline tests
 ./scripts/verify.sh --integration  # + integration_test.sh (requires mock at :15000)
 ```
@@ -140,6 +142,7 @@ Unit tests:
 
 ```bash
 cd cli && bun test
+cd cli && bun run test:coverage
 ```
 
 ## CLI spec conformance (lakehouse)

cli/AGENTS.md

@@ -15,7 +15,7 @@ Executor-oriented notes for working in the TypeScript CLI subtree.
 Preferred — from repo root:
 
 ```bash
-./scripts/verify.sh --quick    # CLI checks only (typecheck, lint, format, knip, unit tests, openapi drift)
+./scripts/verify.sh --quick    # CLI checks only (typecheck, lint, format, knip, coverage, openapi drift)
 ./scripts/verify.sh            # full gate (mirrors CI minus native compile)
 ./scripts/verify.sh --integration   # + integration_test.sh (mock at :15000)
 ```
@@ -27,6 +27,7 @@ bun run typecheck
 bun run lint
 bun run format:check
 bun test
+bun run test:coverage
 bun run knip
 ```
 

cli/bunfig.toml

@@ -0,0 +1,6 @@
+[test]
+coverageReporter = ["text", "lcov"]
+coverageDir = "coverage"
+coverageSkipTestFiles = true
+coverageThreshold = { line = 0.8, function = 0.8 }
+coveragePathIgnorePatterns = ["src/generated/**", "tests/**"]

cli/knip.json

@@ -1,9 +1,9 @@
 {
   "$schema": "https://unpkg.com/knip@6/schema.json",
-  "entry": ["src/cli.ts", "tests/**/*.test.ts", "scripts/**/*.ts"],
+  "entry": ["tests/**/*.test.ts", "scripts/**/*.ts"],
   "project": ["src/**/*.ts", "tests/**/*.test.ts", "scripts/**/*.ts"],
   "ignore": ["src/generated/**"],
   "ignoreExportsUsedInFile": true,
   "ignoreDependencies": ["undici"],
-  "ignoreBinaries": ["less", "security"]
+  "ignoreBinaries": ["less"]
 }

cli/package.json

@@ -27,6 +27,7 @@
     "format": "oxfmt",
     "format:check": "oxfmt --check",
     "test": "bun test",
+    "test:coverage": "bun test --coverage",
     "generate": "bun run scripts/generate-openapi-types.ts && bun run scripts/generate-openapi-index.ts",
     "build": "bun build src/cli.ts --outdir dist --target bun",
     "pack:check": "bun run build && bun pm pack --dry-run",

scripts/verify.sh

@@ -51,7 +51,7 @@ run_step "lint" bun run lint
 run_step "format:check" bun run format:check
 run_step "generate (openapi)" bun run generate
 run_step "openapi drift check" git diff --exit-code src/generated/openapi-types.ts src/generated/openapi-operations.ts
-run_step "unit tests" bun test
+run_step "unit tests with coverage" bun run test:coverage
 run_step "knip" bun run knip
 
 if [[ "${QUICK}" == true ]]; then