Increase code coverage for PathHelpers and Validation

[Copilot]

Pull Request

Description

Adds unit tests for under-tested utility methods to increase code coverage:

Coverage Improvements

• PathHelpers.SafePathCombine: 66.7% → 100%

  • Path traversal validation (double dots)
  • Rooted path rejection
  • Platform-specific path handling (Unix and Windows absolute paths tested conditionally)

• Validation.WriteResultsFile: 0% → 93.8%

  • TRX and JUnit XML file generation
  • Unsupported format error handling
  • File write failure handling

Test Files Added

• PathHelpersTests.cs - 4 tests for path security validation using Assert.Throws pattern
• ValidationTests.cs - 4 tests for results file generation

GitHubRepoConnector Methods Not Covered

BuildLookupData, DetermineTargetVersion, and related baseline methods were not unit tested. These methods have complex Octokit type dependencies (Release, RepositoryTag, etc.) that are immutable DTOs unsuitable for mocking. They are already covered by integration tests in BuildInformationTests.cs.

Code Review Updates

• Removed unused using NSubstitute; statement from GitHubRepoConnectorTests.cs
• Refactored PathHelpersTests.cs to use cleaner Assert.Throws pattern instead of try-catch blocks
• Combined Unix/Windows absolute path tests into single test method with conditional Windows check

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Code quality improvement

Related Issues

Pre-Submission Checklist

Before submitting this pull request, ensure you have completed the following:

Build and Test

• Code builds successfully: dotnet build --configuration Release
• All tests pass: dotnet test --configuration Release
• Code produces zero warnings

Code Quality

• Code formatting is correct: dotnet format --verify-no-changes
• New code has appropriate XML documentation comments
• Static analyzer warnings have been addressed

Quality Checks

Please run the following checks before submitting:

• Spell checker passes: cspell "**/*.{md,cs}"
• Markdown linter passes: markdownlint "**/*.md"
• YAML linter passes: yamllint '**/*.{yml,yaml}'

Testing

• Added unit tests for new functionality
• Updated existing tests if behavior changed
• All tests follow the AAA (Arrange, Act, Assert) pattern
• Test coverage is maintained or improved

Documentation

• Updated README.md (if applicable)
• Updated ARCHITECTURE.md (if applicable)
• Added code examples for new features (if applicable)
• Updated requirements.yaml (if applicable)

Additional Notes

Total test count is 127 (increased from 119). Tests use the Assert.Throws pattern for cleaner exception validation. Windows-specific path tests run conditionally using OperatingSystem.IsWindows() without requiring skipped tests. CodeQL scan shows zero security alerts.

Original prompt

The code coverage numbers for the project are low. Specific areas are:

• GitHubRepoConnector.cs: BuildLookupData, DetermineTargetVersion, DetermineBaselineVersion, DetermineBaselineForPreRelease, DetermineBaselineForRelease.
• Validation.cs: WriteResultsFile
• PathHelpers: SafePathCombine (failure cases)

Please run code-coverage for the tests, then increase the coverage.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Malcolmnixon]

Is this change needed - it's the only change in the file.

[Copilot]

Removed in commit 25322e8. The using statement was added during test development but ended up not being needed.

[Malcolmnixon]

Please examine https://github.com/demaconsulting/SarifMark/blob/main/test/DemaConsulting.SarifMark.Tests/PathHelpersTests.cs which tests SafePathCombine but doesn't need to do the inconclusive tests for different operating systems. Please use its approach instead.

[Copilot]

Refactored in commit 25322e8 to use the cleaner Assert.Throws pattern from SarifMark. Combined Unix/Windows absolute path tests into a single method with conditional Windows check, eliminating the need for inconclusive tests.