[viceice]

Changes

Continues the coverage work from #46222 outside lib/modules/manager, which reached 100% branch coverage there. Branch coverage across the repository goes from 99.53% (25636/25755) to 99.73% (25690/25759) — 50 of 119 uncovered branches closed — and the threshold in build.yml moves from 99.51 to 99.71.

Statements, functions and lines were already at 100% and stay there. 27429 tests pass, with 1 expected failure.

Fully clean now: lib/config, lib/modules/datasource, lib/workers/global, and 27 of 30 in lib/modules/versioning.

The commits are split so each can be read on its own: test(...) commits add tests, refactor(...) commits remove code that no input can reach.

Covered by a test

Twenty-two branches, each with a concrete input:

• versioning — a converted range whose operators are already attached to their versions (cargo); a widen on a complex range ending in >=, which the underlying semver implementation declines (hashicorp, hex, poetry); a version list holding an unparseable entry (poetry); an open-ended range whose bound is not valid semver (swift); a leading token that is not a number, and satisfying-version loops that walk past a candidate no better than the one already held (gradle, ivy, nuget); a widen where the new version sits below the lower bound (elm); a concrete version paired with a channel name (rust-release-channel); and a ~=7 range, which is not valid pep440.
• config — hostRules[].allowInternal nested inside a packageRules[] entry, which is a plain configuration error rather than a security one, because nested host rules are never applied.
• datasource — a non-list manifest whose response carries no docker-content-digest header, so the digest falls back to the hash of the manifest body.
• workers/global — the config parsers rewrite legacy boolean spellings of dryRun, requireConfig and platformCommit, but nothing passed a value that was already current, so each chain's fall-through went untaken; covered from both the CLI and the environment. Plus a datasource env var naming no auth field, one with no value, an unreadable default config file, and the error isLimitReached throws without a branch config.

Two branches v8 could not count

config/decrypt.ts and datasource/docker/common.ts each picked a response with an await inside a ternary. v8 gives the branch that follows such a ternary a negative hit count, which every reporter reads as uncovered even though both paths run. Spelling the choice as an if/else makes the count come out right. Behaviour is unchanged; this is worth knowing if the shape turns up again.

Removed as unreachable

The rest were dead rather than untested, and the type or the control flow proves it:

• Dead by construction. The gitea, gitlab and forgejo changelog sources each declared files as an empty array and then guarded the only assignment to it with if (!files.length) — always true, one line after the declaration.
• Exhaustive chains. registryStrategy is one of three literals; ContentDescriptorSpec.mode is include | exclude; glasskube's schema admits exactly three kinds; gradle's token type is Number | String. Each trailing else if becomes a plain else.
• Guards a type rules out. npmrc starts as an object and is only reassigned to one; a floating nuget range always carries a major component; hermit's version regex makes major mandatory; rangeToStr only returns null for a null range; tokenize always yields at least one token; composer's getNewValue falls back to the new version so it never returns null; a docker prerelease is always a string; the additional-config-file parser returns early unless its env var is set.
• pep440 range handling. updateRangeValue handles !=, a .* prefix, ~=, == and <= itself, handleUpperBound handles <, and parseCurrentRange rejects ===. Only > and >= can reach handleLowerBound, so it never returns null. This drops a logger.error that was guarded by a comment saying it could not happen unless pep440 itself changed — worth a look if you would rather keep it.

Deliberately left uncovered

Three, where closing the branch means weakening a defensive path. I would rather you decide than have them merge on momentum:

• versioning/index.ts:30 — the fallback throw res.error when a schema issue is not the custom one. Removing it means throwing undefined if zod ever adds an issue type.
• versioning/conda/index.ts:99 — ?? null when pep440 declines a ==X.Y.* range. Five range strategies, a missing currentVersion and an out-of-range version all produce a value, so I could not construct the null; dropping the guard turns a silent skip into a throw.
• versioning/ruby/version.ts:16 — an existing istanbul ignore next on create(version) returning falsy, left as found.

Still open

Sixty-six branches remain, all in lib/workers/repository: dependency-dashboard (4), pr body and changelog (13), branch updates (10), onboarding, reconfigure and config-migration (12), process (7), and singles elsewhere. They are heavier than these — most need platform and http mocks rather than a table row — so they are left for a follow-up rather than making this any larger.

Verified with pnpm type-check and pnpm check --all over each touched directory, re-measuring every module after the change rather than relying on the tests passing.

Context

Please select one of the following:

• This closes an existing Issue, Closes: #
• This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

• No — I did not use AI for this contribution.
• Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
• Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
• Yes — other (please describe):

Claude Opus 5, via Claude Code: measured the gaps, proved each branch reachable or not, wrote the tests and the refactors, and wrote this description.

Use of AI in replying to PR comments

Who answers review comments:

• @viceice will read and reply directly. Name the account.
• An agent will draft replies and @username will read them before they are posted. Name the account.
• Nobody has explicitly committed to replying.

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests, but ran on a real repository, or
• Both unit tests + ran on a real repository

🤖 Generated with Claude Code

[github-actions]

🎉 This PR is included in version 44.94.0 🎉

The release is available on:

• GitHub release
• 44.94.0

Your semantic-release bot 📦🚀