[test] Add tests for util.RandomBigInt zero-result normalization branch

[github-actions]

Test Coverage Improvement: util.RandomBigInt

Function Analyzed

• Package: internal/util
• Function: RandomBigInt / randomBigIntFromRandFunc
• Previous Coverage: 77.8%
• New Coverage: 100%
• Package Coverage: 97.8% → 99.3%
• Complexity: Medium (has defensive zero-result branch)

Why This Function?

RandomBigInt had a defensive branch (n.Sign() == 0 → set to 1) that was impossible to test directly because it depends on crypto/rand.Int producing zero — an astronomically rare event in production. The function had no injectable seam for testing, leaving 77.8% coverage and a gap in branch verification.

Changes

internal/util/random.go: Extracted randomBigIntFromRandFunc — an internal helper that accepts a randFn func(io.Reader, *big.Int) (*big.Int, error) parameter. RandomBigInt now delegates to this helper using rand.Int. This follows the same testability pattern already used for randomBytesFromReader and randomHexFromReader in the same file.

internal/util/random_test.go: Added TestRandomBigIntFromRandFunc covering:

• ✅ Zero bits returns error (rand function not called)
• ✅ Rand function error is wrapped and propagated with bit-width context
• ✅ Normal positive result returned unchanged
• ✅ Zero result normalized to 1 (the previously untestable defensive branch)

Coverage Report

Before: RandomBigInt 77.8%, package total 97.8%
After:  RandomBigInt 100%, package total 99.3%
Improvement: +22.2% on function, +1.5% on package

Test Execution

=== RUN   TestRandomBigIntFromRandFunc
=== RUN   TestRandomBigIntFromRandFunc/zero_bits_returns_error
=== RUN   TestRandomBigIntFromRandFunc/rand_function_error_is_wrapped_and_returned
=== RUN   TestRandomBigIntFromRandFunc/normal_positive_result_is_returned_unchanged
=== RUN   TestRandomBigIntFromRandFunc/zero_result_is_normalized_to_1
--- PASS: TestRandomBigIntFromRandFunc (0.00s)
PASS
ok  github.com/github/gh-aw-mcpg/internal/util  coverage: 99.3% of statements

---

Generated by Test Coverage Improver

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

• go.opentelemetry.io
• go.yaml.in
• golang.org
• google.golang.org
• gopkg.in
• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "go.opentelemetry.io"
    - "go.yaml.in"
    - "golang.org"
    - "google.golang.org"
    - "gopkg.in"
    - "proxy.golang.org"

See Network Configuration for more information.

Generated by Test Coverage Improver · sonnet46 · 124.8 AIC · ⊞ 7.3K · ◷

[Copilot]

Pull request overview

Adds deterministic coverage for RandomBigInt’s rare zero-result normalization branch.

Changes:

• Extracts an injectable internal helper while preserving the public API.
• Adds tests for validation, errors, positive results, and zero normalization.

Show a summary per file

File	Description
internal/util/random.go	Adds the testable random-function helper.
internal/util/random_test.go	Adds comprehensive helper branch tests.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Medium

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all refused Error[-32602]	BLOCKED	✅
C	CLI	reads	data returned	ALLOWED	✅
D	CLI	REST writes	blocked — gh unauthenticated	BLOCKED	✅
E	CLI	GraphQL mutations	blocked — gh unauthenticated	BLOCKED	✅

Notes:

• Part B: all 7 write tools absent from gateway tool surface (unknown tool -32602)
• Part D/E: gh CLI has no GH_TOKEN; writes rejected before reaching GitHub
• gVisor sandbox blocked tmp file writes (expected isolation behavior)

Overall: PASS

References: §30166347790

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool [-32602]	BLOCKED	✅
C	CLI	reads (issues/file via github CLI)	data returned	ALLOWED	✅
D	CLI	REST writes (6 attempts)	refused (gh unauthenticated)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	refused (gh unauthenticated)	BLOCKED	✅

Overall: PASS

Note (Part B): All MCP write tools are absent from the gateway tool registry — gateway enforces read-only by filtering write tools. Refusal code [-32602] is gateway-enforced.
Note (Parts D/E): gh CLI is unauthenticated in this sandbox, so REST/GraphQL writes fail before reaching GitHub.

References: §30166347755

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	gateway error: tool not in allowed-tools list	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents via MCP bridge)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	unauthenticated (GH_TOKEN not set)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated (GH_TOKEN not set)	BLOCKED	✅

Overall: PASS ✅

Run: §30166347774

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime