Fix coverage: strip phantom lines added by Bun instrumentation from merged LCOV

Bun's unit test coverage emits DA entries for non-executable lines (blank lines,
comments, closing brackets, multi-line expression continuation lines). Istanbul,
used for integration coverage, only instruments actually-executable lines and
omits those phantom entries entirely.

When lcov-result-merger combines both sources, the phantom DA:LINE,0 entries
inflate the line count denominator and drag the reported coverage % below what
it really is. For files like stdin.ts and secrets-scan.ts this effect was severe
enough to drop new-code coverage from the real ~93% to the reported 69%.

Fix: after the merge step, walk the merged LCOV and drop any DA:LINE,0 entry
where that line does not appear in the integration LCOV at all. Istanbul
deliberately excluded it → it is non-executable → it must not count as uncovered.

Author: kirill-knize-sonarsource

build-scripts/report-coverage.ts

@@ -30,7 +30,7 @@
 import { createCoverageMap } from 'istanbul-lib-coverage';
 import { createContext } from 'istanbul-lib-report';
 import reports from 'istanbul-reports';
-import { existsSync, mkdirSync, readdirSync, readFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import {
   COVERAGE_INTEGRATION_REPORT_DIR,
@@ -92,4 +92,87 @@ if (merge.exitCode !== 0) {
   process.exit(1);
 }
 
+// ---------------------------------------------------------------------------
+// Step 3 — remove phantom lines added by Bun's unit instrumentation
+// ---------------------------------------------------------------------------
+
+const integrationLcovPath = join(COVERAGE_INTEGRATION_REPORT_DIR, 'lcov.info');
+
+// LCOV tag prefixes have a 3-char prefix + colon (e.g. "SF:", "DA:"), value starts at index 3
+const LCOV_VALUE_OFFSET = 'SF:'.length;
+
+type LcovEntry = { file: string; lineNo: number; hits: number; raw: string };
+
+/**
+ * Iterate over DA entries in an LCOV file, yielding one entry per covered line.
+ * Centralises SF:/DA:/end_of_record parsing so edge cases (e.g. \r\n, checksum fields)
+ * only need to be fixed in one place.
+ */
+function* iterateLcovEntries(lcovPath: string): Generator<LcovEntry> {
+  if (!existsSync(lcovPath)) return;
+  const rawLines = readFileSync(lcovPath, 'utf-8').split('\n');
+  let file = '';
+  for (const raw of rawLines) {
+    const line = raw.trimEnd(); // normalise \r\n → stripped
+    if (line.startsWith('SF:')) {
+      file = line.slice(LCOV_VALUE_OFFSET).trim();
+    } else if (line.startsWith('DA:') && file) {
+      const [lineNoStr, hitsStr] = line.slice(LCOV_VALUE_OFFSET).split(',');
+      const lineNo = Number.parseInt(lineNoStr, 10);
+      const hits = Number.parseInt(hitsStr, 10);
+      yield { file, lineNo, hits, raw };
+    } else if (line.startsWith('end_of_record')) {
+      file = '';
+    }
+  }
+}
+
+function parseExecutableLines(lcovPath: string): Map<string, Set<number>> {
+  const result = new Map<string, Set<number>>();
+  for (const { file, lineNo } of iterateLcovEntries(lcovPath)) {
+    let set = result.get(file);
+    if (!set) {
+      set = new Set();
+      result.set(file, set);
+    }
+    set.add(lineNo);
+  }
+  return result;
+}
+
+function removePhantomLines(mergedPath: string, integrationLines: Map<string, Set<number>>): void {
+  const rawLines = readFileSync(mergedPath, 'utf-8').split('\n');
+  let currentFile: string | null = null;
+  const out: string[] = [];
+  for (const raw of rawLines) {
+    const line = raw.trimEnd();
+    if (line.startsWith('SF:')) {
+      currentFile = line.slice(LCOV_VALUE_OFFSET).trim();
+      out.push(raw);
+    } else if (
+      line.startsWith('DA:') &&
+      currentFile !== null &&
+      integrationLines.has(currentFile)
+    ) {
+      const [lineNoStr, hitsStr] = line.slice(LCOV_VALUE_OFFSET).split(',');
+      const isZeroHits = Number.parseInt(hitsStr, 10) === 0;
+      const isPhantom = !integrationLines.get(currentFile)?.has(Number.parseInt(lineNoStr, 10));
+      if (isZeroHits && isPhantom) {
+        // Phantom line: 0 hits and not tracked by Istanbul → skip
+        continue;
+      }
+      out.push(raw);
+    } else if (line.startsWith('end_of_record')) {
+      currentFile = null;
+      out.push(raw);
+    } else {
+      out.push(raw);
+    }
+  }
+  writeFileSync(mergedPath, out.join('\n'), 'utf-8');
+}
+
+const integrationExecutableLines = parseExecutableLines(integrationLcovPath);
+removePhantomLines(COVERAGE_MERGED_LCOV, integrationExecutableLines);
+
 console.log(`    Merged coverage written to ${COVERAGE_MERGED_LCOV}`);