Fix/setup api client coverage gaps

[stranske]

No description provided.

[stranske-keepalive]

⚠️ Action Required: Unable to determine source issue for PR #1189. The PR title, branch name, or body must contain the issue number (e.g. #123, branch: issue-123, or the hidden marker ).

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 626e159283

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[agents-workflows-bot]

Automated Status Summary

Head SHA: bb0efa1
Latest Runs: ⏳ pending — Gate
Required contexts: Gate / gate, Health 45 Agents Guard / Enforce agents workflow protections
Required: core tests (3.11): ⏳ pending, core tests (3.12): ⏳ pending, docker smoke: ⏳ pending, gate: ⏳ pending

Workflow / Job	Result	Logs
(no jobs reported)	⏳ pending	—

Coverage Overview

• Coverage history entries: 1

Coverage Trend

Metric	Value
Current	93.12%
Baseline	85.00%
Delta	+8.12%
Minimum	70.00%
Status	✅ Pass

Top Coverage Hotspots (lowest coverage)

File	Coverage	Missing
src/cli_parser.py	81.8%	4
src/percentile_calculator.py	95.0%	1
src/aggregator.py	95.0%	2
src/__init__.py	100.0%	0
src/ndjson_parser.py	100.0%	0

Updated automatically; will refresh on subsequent CI/Docker completions.

---

Keepalive checklist

Scope

No scope information available

Tasks

• No tasks defined

Acceptance criteria

• No acceptance criteria defined

[stranske-keepalive]

🤖 Keepalive Loop Status

PR #1189 | Agent: Codex | Iteration 0/5

Current State

Metric	Value
Iteration progress	[----------] 0/5
Action	wait (missing-agent-label)
Disposition	skipped (transient)
Gate	success
Tasks	0/0 complete
Timeout	45 min (default)
Timeout usage	2m elapsed (6%, 43m remaining)
Keepalive	❌ disabled
Autofix	❌ disabled

🔍 Failure Classification

| Error type | infrastructure |
| Error category | resource |
| Suggested recovery | Confirm the referenced resource exists (repo, PR, branch, workflow, or file). |

[Copilot]

Pull request overview

Adds setup-api-client coverage in several workflows/jobs that use actions/github-script, and records an audit of the coverage/fix status.

Changes:

• Added setup-api-client + required sparse-checkout deps to multiple workflows/jobs using github-script.
• Added consumer checkout + setup-api-client initialization to additional jobs in reusable-20-pr-meta.yml.
• Added an audit CSV documenting coverage/fix status for targeted jobs.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
docs/fixes/setup-api-client-coverage-audit.csv	Tracks which workflow jobs use github-script and whether setup-api-client coverage is present.
.github/workflows/reusable-bot-comment-handler.yml	Adds sparse-checkout deps + setup-api-client step for the dispatch job.
.github/workflows/reusable-20-pr-meta.yml	Adds consumer checkout + setup-api-client steps to additional jobs.
.github/workflows/reusable-16-agents.yml	Adds sparse-checkout deps + setup-api-client step in preflight.
.github/workflows/reusable-10-ci-python.yml	Adds checkout + setup-api-client in logs_summary (was missing checkout).
.github/workflows/agents-bot-comment-handler.yml	Adds sparse-checkout deps + setup-api-client step in cleanup.
.github/workflows/agents-autofix-loop.yml	Adds sparse-checkout deps + setup-api-client step in metrics; minor whitespace cleanup.

Comments suppressed due to low confidence (3)

.github/workflows/reusable-20-pr-meta.yml:289

• The setup-api-client composite installs @octokit/* deps under $GITHUB_WORKSPACE/.github/scripts, but this job later loads JS helpers from $GITHUB_WORKSPACE/workflows-lib/.github/scripts. Node module resolution won’t pick up deps from .github/scripts/node_modules, so token_load_balancer’s import('@octokit/*') will still fail (token rotation won’t actually be enabled). Consider installing deps in workflows-lib/.github/scripts (or repo-root node_modules) and/or extending setup-api-client with an install_dir input. Also, service_bot_pat is lower-case in workflow_call secrets, so toJSON(secrets) won’t populate SERVICE_BOT_PAT unless you pass the action’s service_bot_pat input (or update parsing to handle lower-case keys).

      - name: Mint GitHub App token (preferred)
        id: app_token
        continue-on-error: true
        uses: actions/create-github-app-token@v2

.github/workflows/reusable-20-pr-meta.yml:365

• The setup-api-client composite installs @octokit/* deps under $GITHUB_WORKSPACE/.github/scripts, but this job loads shared scripts from $GITHUB_WORKSPACE/workflows-lib/.github/scripts. Node won’t resolve deps from .github/scripts/node_modules, so token_load_balancer’s import('@octokit/*') will still fail (no real token rotation). Consider installing deps in workflows-lib/.github/scripts (or repo-root node_modules) and/or extending setup-api-client with an install_dir input. Also, service_bot_pat is lower-case in workflow_call secrets, so toJSON(secrets) won’t populate SERVICE_BOT_PAT unless you pass the action’s service_bot_pat input (or update parsing to handle lower-case keys).

        with:
          script: |
            const scriptsPath = process.env.WORKFLOWS_SCRIPTS_PATH;
            const { evaluateKeepaliveGate } = require(`${scriptsPath}/.github/scripts/keepalive_gate.js`);
            const result = await evaluateKeepaliveGate({

.github/workflows/reusable-20-pr-meta.yml:510

• The setup-api-client composite installs @octokit/* deps under $GITHUB_WORKSPACE/.github/scripts, but this job loads shared scripts from $GITHUB_WORKSPACE/workflows-lib/.github/scripts. Node won’t resolve deps from .github/scripts/node_modules, so token_load_balancer’s import('@octokit/*') will still fail (no real token rotation). Consider installing deps in workflows-lib/.github/scripts (or repo-root node_modules) and/or extending setup-api-client with an install_dir input. Also, service_bot_pat is lower-case in workflow_call secrets, so toJSON(secrets) won’t populate SERVICE_BOT_PAT unless you pass the action’s service_bot_pat input (or update parsing to handle lower-case keys).

              github, context, core,
              inputs: {
                pr_number: process.env.PR_NUMBER,
                dry_run: process.env.DRY_RUN === 'true',
              },

[Copilot]

In this reusable workflow, workflow_call secrets like service_bot_pat / gh_app_id are lower-case. setup-api-client’s JSON parsing looks for upper-case keys (e.g., SERVICE_BOT_PAT, GH_APP_ID), so passing only secrets: ${{ toJSON(secrets) }} won’t export these tokens to the environment. Pass the action’s individual inputs (service_bot_pat, gh_app_id, gh_app_private_key, etc.) or update setup-api-client to also recognize lower-case secret keys.

Suggested change

	github_token: ${{ github.token }}
	github_token: ${{ github.token }}
	service_bot_pat: ${{ secrets.service_bot_pat }}
	gh_app_id: ${{ secrets.gh_app_id }}
	gh_app_private_key: ${{ secrets.gh_app_private_key }}

[Copilot]

workflow_call defines service_bot_pat as a lower-case secret name, but setup-api-client’s toJSON(secrets) parsing only extracts SERVICE_BOT_PAT (upper-case). As a result this step won’t export the service bot token unless you also pass the action’s service_bot_pat input (or update parsing to handle lower-case keys).

Suggested change

	github_token: ${{ github.token }}
	github_token: ${{ github.token }}
	service_bot_pat: ${{ secrets.service_bot_pat }}