Test coverage leverage

“Write more tests” is useless advice. Which test, first, is a question with a real answer: some functions sit at the top of a call graph and pull hundreds of others behind them, and some are leaves nothing else depends on. Test coverage leverage ranks your functions by how much of the application a single test driving that function would transitively exercise, so the first few tests you write are the ones that buy the most.

The ranking is a greedy set-cover over the whole-program call graph. It is entirely deterministic - the same tree always produces the same ranking - and no model is involved at any point.

What this is not

This is not a coverage percentage

This does not measure how much of your code your tests currently execute, and it is not comparable to the number your CI prints. AlertaVuln never runs your test suite.

What you get is the opposite question: not “how much is covered” but “where would one more test buy the most”. The two are complements - one tells you where you are, this tells you where to go next.

Nothing here is an estimate of your existing coverage. A static call graph cannot see inside a function body, so it cannot know that a test reaches a function but never touches its five error branches - which is exactly where real coverage is usually lost. Reporting a number derived that way would sit next to your CI’s number and be wrong by double digits, so we do not report one.

What it analyses

The node universe is the functions defined in your repository. Standard library and dependency functions are call targets, never nodes, so the percentages describe your application rather than the whole world. Test files and vendored trees are excluded, and the repo’s .alertavuln-ignore is honoured.

The Go module does not have to be at the top of the repository. Most repositories are polyglot - the module lives in cli/, service/, src/go/ beside a web app and docs - so the shallowest non-vendored module is found automatically and every location is reported relative to the repo root.

v1 analyses Go only. Honest percentages need a sound whole-program call graph, and that is where we have one today.

Running it yourself

# Rank the highest-leverage functions in this repository
av coverage suggest --path . --top 5

# Machine-readable
av coverage suggest --path . --format json

suggest is local and advisory: it never touches the network, never changes your findings, and always exits 0. A run prints the ranked functions with the share of the application each one reaches:

RANK  FUNCTION                FILE:LINE                       +MARGINAL%  CUMULATIVE%  ENTRY
1     cmd/reach-runner.main   cmd/reach-runner/main.go:138    +28.1       28.1         yes
2     internal/dast/scan.Run  internal/dast/scan/scan.go:41   +7.2        35.3         yes

entry:no marks a high-leverage function that nothing reaches from an entry point - either dead code, or a missing entry point in your reachability config, and both are worth knowing.

To draft the tests themselves, --prompt emits a brief for your own AI assistant. It contains the target, its blast radius and your existing test style - no model of ours is called, and your source does not leave your machine.

Seeing it in the app

av coverage upload --project <id> sends the ranking - function names, locations and leverage numbers only, never source - so the Test Coverage page can show it.

If your project is scanned on our infrastructure, the page fills in on its own after the next scan: the hosted reachability run already builds the exact same call graph, so the ranking comes free with it and the page will say it was scanned for you.

Hosted runs analyse what compiles

The hosted sandbox has no network access while it analyses, so a repository that neither vendors nor caches its dependencies contributes only the packages that still type-check. The percentages stay internally consistent - they are relative to the functions analysed, which the page reports - but a partial build means a partial universe. Running the CLI locally, where your module cache is warm, always sees everything.

Reference

ReachabilityThe call graph this shares with the reachability gate.

Code scanning (SAST)The scan that builds the graph this ranking reuses.

Run av coverage suggest --help for the full flag set.