@scalequality/check 0.5.2 → 0.5.4

package/README.md

@@ -23,8 +23,9 @@ and **Turn on continuous measurement**. Store the token as a CI secret named
 | `--json` | — | off | Print the raw result as JSON |
 | `--exclude <path>` | — | — | Exclude a generated file/directory by literal checkout-relative path; repeatable |
 | `--dry-run` | — | off | Measure locally and validate the package without uploading; no token needed |
+| `--artifact <path>` | `SQ_ARTIFACTS` | — | Scan a binary this job built for its components, licenses and CVEs (needs trivy); repeatable |
 
-Exit codes: `0` passed (or track-only), `1` below the cutoff, `2` error.
+Exit codes: `0` passed (or track-only), `1` below the cutoff or a license blocked by your policy, `2` error.
 
 ## CI examples
 
@@ -95,7 +96,7 @@ is rejected locally before upload; it is not treated as a full 90-day measuremen
 - uses: actions/checkout@v4
   with:
     fetch-depth: 0
-- run: npx @scalequality/check@0.5.2 --project <projectId>
+- run: npx @scalequality/check@0.5.3 --project <projectId>
   env:
     SQ_TOKEN: ${{ secrets.SQ_TOKEN }}
 ```
@@ -126,7 +127,7 @@ that you expect to measure.
 
 ```bash
 # Local verification; does not need a token and sends nothing to ScaleQuality.
-npx @scalequality/check@0.5.2 --dry-run
+npx @scalequality/check@0.5.3 --dry-run
 ```
 
 The CLI checks compressed size before allocating the upload buffer or sending a
@@ -191,3 +192,36 @@ A valid report with zero settled or AI-attributed lines still proceeds. It does
 not invent 100% AI survival. Missing coverage alone does not block submission.
 A completed check below a configured maturity cutoff still exits with code 1;
 track-only completion still exits with code 0.
+
+## 0.5.3: complete coverage report collection
+
+Coverage discovery and staging now process all matching reports incrementally,
+including deep modules and individual reports larger than 25 MiB. Report bytes
+and paths are preserved; the CLI no longer silently stops after 40 reports.
+A file that changes or cannot be copied stops submission before any upload.
+The existing 60 MiB compressed upload limit, Git durability calculation and
+maturity gates are unchanged. This release requires the matching server reader
+that accepts the complete staged report index.
+
+## 0.5.4: open source licenses in the pull request, and the binaries you build
+
+**License gate.** Each run sends where it happened (GitHub Actions, GitLab CI,
+Azure Pipelines or Bitbucket Pipelines: the pull request's base and head
+branches and its number). ScaleQuality compares the run's dependencies with the
+base branch and lists every new dependency whose license your company policy
+forbids, in the log and, on GitHub Actions, in the job summary. It is a warning
+unless your organization turned on "Block the pull request" in Compliance ›
+Licenses; then the step exits 1 until the package is removed or an Owner or Admin
+accepts it with an exception.
+
+**`--artifact <path>`** (repeatable, or `SQ_ARTIFACTS=a.jar,b.war`). Scans a
+binary this job built (jar, war, ear, Go and Rust binaries with build metadata,
+.NET, wheels) with `trivy rootfs`, so the components bundled inside it, their
+licenses and their CVEs join the measurement. Needs trivy on PATH, like
+`--image`; without it the step says so and the gate still runs.
+
+```yaml
+- uses: aquasecurity/setup-trivy@v0.2.0
+- run: npx @scalequality/check --artifact target/app.war
+  env: { SQ_TOKEN: ${{ secrets.SQ_TOKEN }}, SQ_PROJECT: ${{ vars.SQ_PROJECT }} }
+```

package/bin/check.mjs

@@ -4,12 +4,12 @@
 // non-zero when maturity is below the configured cutoff, so a CI step can fail the
 // build. Pure Node 18+ (global fetch/FormData/Blob), no npm dependencies.
 
-import { tmpdir } from "node:os"
-import { join, dirname, relative, sep } from "node:path"
 import { spawnSync } from "node:child_process"
-import { readFileSync, writeFileSync, statSync, rmSync, readdirSync, mkdirSync, mkdtempSync, copyFileSync } from "node:fs"
+import { readFileSync, existsSync, appendFileSync } from "node:fs"
 import { prepareCheckoutArchive, normalizeExcludes } from "./archive.mjs"
 import { measureDurability } from "./durability.mjs"
+import { stageCoverageReports } from "./coverage.mjs"
+import { ciContext } from "./ci.mjs"
 
 const args = process.argv.slice(2)
 const flag = (name) => {
@@ -31,13 +31,21 @@ Options:
   --image <ref>    Also scan the container image this job just built, e.g.
                    myapp:\${{ github.sha }}. Needs trivy on PATH; skipped with a
                    note if it is missing, never fails the build for it.
+  --artifact <p>   Also scan a binary this job built (jar, war, ear, Go or Rust
+                   binary, .NET, wheel) for its components, their licenses and
+                   CVEs; repeatable. Needs trivy on PATH; skipped with a note if
+                   it is missing, never fails the build for it.
   --timeout <s>    Max seconds to wait for the measurement (default 600)
   --exclude <p>    Exclude a generated path relative to the checkout; repeatable
   --dry-run        Measure locally and check the package; do not upload (no token needed)
   --json           Print the raw result as JSON
   -h, --help       Show this help
 
-Exit codes: 0 passed (or track-only), 1 below the cutoff, 2 error.`)
+Pull requests that add a dependency whose license your company policy forbids
+are listed in the log and the job summary; the check fails for it only where
+your organization turned blocking on.
+
+Exit codes: 0 passed (or track-only), 1 below the cutoff or a blocked license, 2 error.`)
   process.exit(0)
 }
 
@@ -47,6 +55,10 @@ const host = (flag("--host") || process.env.SQ_HOST || "https://app.scalequality
 const jsonOut = has("--json")
 const dryRun = has("--dry-run")
 const image = flag("--image") || process.env.SQ_IMAGE
+const artifacts = [
+  ...args.flatMap((arg, i) => (arg === "--artifact" && args[i + 1] ? [args[i + 1]] : [])),
+  ...(process.env.SQ_ARTIFACTS ? process.env.SQ_ARTIFACTS.split(",").map((s) => s.trim()).filter(Boolean) : []),
+]
 const timeoutMs = Math.max(30, Number(flag("--timeout") || 600)) * 1000
 
 const base = `${host}/api/insights/continuous`
@@ -128,88 +140,78 @@ function slimReport(stdout, ref) {
   return json
 }
 
-// Coverage reports live in exactly the directories the archive excludes: JaCoCo
-// writes to target/ and build/, Istanbul to coverage/. So the one moment where a
-// REAL coverage number is sitting on disk — right after this job ran the tests —
-// was also the one moment we threw it away, and every Maven project came back
-// with no measured coverage even with a green suite behind it.
-//
-// The reports are copied into .sqreports/ under FLAT, indexed names, with an
-// index.json holding each one's original path. Mirroring the original directory
-// tree looked tidier and did not work: bsdtar does not anchor `--exclude=./target`
-// to the root, so a staged copy at `.scalequality/coverage/target/...` was dropped
-// on macOS while surviving under GNU tar. Measured, not assumed — and a layout
-// whose behaviour depends on which tar the runner ships is not a layout.
-// Every staged name here is `<n>-<basename>`, which no exclude pattern can match.
-const COVERAGE_NAMES = [
-  { re: /^jacoco(TestReport)?\.xml$/i, format: "jacoco" },
-  { re: /^lcov\.info$/i, format: "lcov" },
-  { re: /^coverage-summary\.json$/i, format: "istanbul" },
-  { re: /^coverage\.cobertura\.xml$/i, format: "cobertura" },
-  { re: /^cobertura(-coverage)?\.xml$/i, format: "cobertura" },
-  { re: /^coverage\.xml$/i, format: "cobertura" },
-  { re: /^clover\.xml$/i, format: "clover" },
-  { re: /^(coverage|cover)\.out$/i, format: "go" },
-]
-const COVERAGE_SKIP = new Set(["node_modules", ".git", ".venv", "venv", "vendor", "__pycache__", ".sqreports"])
-const COVERAGE_STAGE = ".sqreports"
-const MAX_REPORT_BYTES = 25 * 1024 * 1024
-const MAX_REPORTS = 40
-
-function stageCoverageReports() {
-  const root = process.cwd()
-  const stagingRoot = mkdtempSync(join(tmpdir(), "sq-coverage-"))
-  const stage = join(stagingRoot, COVERAGE_STAGE)
-  // The staged copies must not outlive this process under ANY exit path. A
-  // cancelled job or a network failure that left them behind would show up as
-  // untracked files in the customer's checkout, and a pipeline that runs
-  // `git diff --exit-code` after the gate would fail because of us.
-  const clean = () => { try { rmSync(stagingRoot, { recursive: true, force: true }) } catch { /* best effort */ } }
-  process.on("exit", clean)
-  for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) {
-    process.on(sig, () => { clean(); process.exit(130) })
+/**
+ * Binaries this job built. A component bundled inside a jar or a Go binary is
+ * shipped like any dependency, but no lockfile lists it: the only place it can
+ * be read is the artifact, and the artifact only exists here. Same rules as the
+ * image: no trivy, a note and the gate still runs; a path that is not there is
+ * said, never skipped silently.
+ */
+function scanArtifacts() {
+  if (!artifacts.length) return null
+  const probe = spawnSync("trivy", ["--version"], { encoding: "utf8" })
+  if (probe.error || probe.status !== 0) {
+    log("ScaleQuality: --artifact was given but trivy is not on PATH, so the artifact scan was skipped.")
+    log("ScaleQuality: add it before this step, e.g. `- uses: aquasecurity/setup-trivy@v0.2.0`.")
+    return null
+  }
+  const reports = []
+  for (const path of artifacts.slice(0, 20)) {
+    if (!existsSync(path)) { log(`ScaleQuality: artifact ${path} does not exist, skipped.`); continue }
+    const r = spawnSync("trivy", [
+      "rootfs", "--format", "json", "--quiet",
+      "--scanners", "vuln,license", "--list-all-pkgs",
+      "--severity", "CRITICAL,HIGH,MEDIUM",
+      path,
+    ], { encoding: "utf8", maxBuffer: 128 * 1024 * 1024 })
+    if (r.error || r.status !== 0 || !r.stdout) { log(`ScaleQuality: could not scan ${path}, continuing without it.`); continue }
+    const report = slimArtifact(r.stdout, path)
+    if (report) reports.push({ name: path.split("/").pop() || path, report })
   }
+  return reports.length ? JSON.stringify(reports) : null
+}
 
-  const index = []
-  let bytes = 0
-  const walk = (dir, depth) => {
-    if (depth > 7 || index.length >= MAX_REPORTS || bytes >= MAX_REPORT_BYTES) return
-    let entries
-    try { entries = readdirSync(dir, { withFileTypes: true }) } catch { return }
-    for (const e of entries) {
-      if (index.length >= MAX_REPORTS || bytes >= MAX_REPORT_BYTES) return
-      const abs = join(dir, e.name)
-      if (e.isDirectory()) {
-        if (!COVERAGE_SKIP.has(e.name)) walk(abs, depth + 1)
-        continue
-      }
-      if (!e.isFile()) continue
-      const hit = COVERAGE_NAMES.find((c) => c.re.test(e.name))
-      if (!hit) continue
-      let size = 0
-      try { size = statSync(abs).size } catch { continue }
-      if (size === 0 || bytes + size > MAX_REPORT_BYTES) continue
-      const staged = `${index.length}-${e.name}`
-      try {
-        mkdirSync(stage, { recursive: true })
-        copyFileSync(abs, join(stage, staged))
-      } catch { continue }
-      bytes += size
-      index.push({ file: staged, path: relative(root, abs).split(sep).join("/"), format: hit.format })
-    }
+/** Components with their licenses and the findings, nothing else: the server reads these fields. */
+function slimArtifact(stdout, path) {
+  let d
+  try { d = JSON.parse(stdout) } catch { return null }
+  let packages = 0, vulns = 0
+  const out = {
+    ArtifactName: d.ArtifactName || path,
+    Results: (d.Results || []).map((res) => ({
+      Target: res.Target,
+      Class: res.Class,
+      Type: res.Type,
+      Packages: (res.Packages || []).map((p) => {
+        packages++
+        return { Name: p.Name, Version: p.Version, Licenses: Array.isArray(p.Licenses) ? p.Licenses : undefined, Identifier: p.Identifier?.PURL ? { PURL: p.Identifier.PURL } : undefined }
+      }),
+      Vulnerabilities: (res.Vulnerabilities || []).map((v) => {
+        vulns++
+        return { VulnerabilityID: v.VulnerabilityID, PkgName: v.PkgName, InstalledVersion: v.InstalledVersion, FixedVersion: v.FixedVersion, Severity: v.Severity, Title: typeof v.Title === "string" ? v.Title.slice(0, 300) : undefined }
+      }),
+    })),
   }
-  walk(root, 0)
+  log(`ScaleQuality: scanned ${path}: ${packages} components, ${vulns} vulnerabilities`)
+  return JSON.stringify(out)
+}
 
-  if (index.length) {
-    try {
-      writeFileSync(join(stage, "index.json"), JSON.stringify({ version: 1, reports: index }))
-    } catch { /* the archive just goes without them */ }
-    const shown = index.slice(0, 3).map((r) => r.path).join(", ")
-    log(`ScaleQuality: found ${index.length} coverage report(s) — ${shown}${index.length > 3 ? " …" : ""}`)
-  } else {
-    log("ScaleQuality: no coverage report found in this job. Run your tests with coverage before this step to get a measured %.")
+/** The license gate, in the log and in the job summary (GitHub Actions). */
+function reportLicenses(license) {
+  if (!license || license.result === "PASSED" || !license.newForbidden?.length) return
+  const total = license.newForbiddenTotal ?? license.newForbidden.length
+  const blocked = license.result === "BLOCKED"
+  const head = blocked
+    ? `ScaleQuality: ${total} new dependenc${total === 1 ? "y has" : "ies have"} a license your company policy forbids, so the pull request is blocked.`
+    : `ScaleQuality: ${total} new dependenc${total === 1 ? "y has" : "ies have"} a license your company policy forbids (warning; blocking is off for your organization).`
+  const lines = license.newForbidden.map((p) => `  - ${p.name}${p.version ? ` ${p.version}` : ""}: ${(p.licenses || []).join(", ")}${p.file ? ` (${p.file})` : ""}`)
+  ;(blocked ? console.error : console.log)([head, ...lines, "  Remove it, or ask an Owner or Admin to accept it with an exception in ScaleQuality."].join("\n"))
+  if (process.env.GITHUB_STEP_SUMMARY) {
+    const md = [`### ${blocked ? "Blocked" : "Warning"}: forbidden license`, "", "| Package | Version | License | Found in |", "|---|---|---|---|",
+      ...license.newForbidden.map((p) => `| ${p.name} | ${p.version || ""} | ${(p.licenses || []).join(", ")} | ${p.file || ""} |`),
+      "", "Remove the dependency, or ask an Owner or Admin to accept it with an exception in ScaleQuality.", ""].join("\n")
+    try { appendFileSync(process.env.GITHUB_STEP_SUMMARY, md) } catch { /* the log already says it */ }
   }
-  return { stage, root: stagingRoot, count: index.length, cleanup: clean }
 }
 
 async function main() {
@@ -217,7 +219,7 @@ async function main() {
   const excludes = normalizeExcludes(args.flatMap((arg, i) => arg === "--exclude" ? [args[i + 1]] : []))
   const durabilityReport = await measureDurability({ root: process.cwd(), log: jsonOut ? (message) => console.error(message) : log })
   if (!durabilityReport) fail("Git durability collection failed. No upload was sent and no new score was submitted. Resolve the Git error above before rerunning this step.")
-  const coverage = stageCoverageReports()
+  const coverage = await stageCoverageReports({ log })
   let packed, buf
   try {
     packed = prepareCheckoutArchive({ root: process.cwd(), coverageRoot: coverage.root, durabilityReport, excludes, log })
@@ -245,6 +247,15 @@ async function main() {
   form.append("file", new Blob([buf]), "checkout.tar.gz")
   const containerReport = scanImage()
   if (containerReport) form.append("containerReport", containerReport)
+  const artifactReports = scanArtifacts()
+  if (artifactReports) form.append("artifactReports", artifactReports)
+  const ci = ciContext()
+  if (ci) {
+    form.append("ciProvider", ci.provider)
+    if (ci.baseRef) form.append("ciBaseRef", ci.baseRef)
+    if (ci.headRef) form.append("ciHeadRef", ci.headRef)
+    if (ci.pullRequest) form.append("ciPullRequest", String(ci.pullRequest))
+  }
   const r = await fetch(`${base}/report/upload`, {
     method: "POST",
     headers: auth,
@@ -298,7 +309,12 @@ async function main() {
   } else {
     const cut = last.cutoff != null ? ` (cutoff ${last.cutoff})` : " (track only)"
     log(`ScaleQuality: maturity ${last.maturity ?? "—"}${cut}`)
-    if (last.passed === false) console.error("ScaleQuality: below the line — failing the build.")
+    reportLicenses(last.license)
+    const licenseBlocked = last.license?.result === "BLOCKED"
+    const maturityFailed = last.gateResult === "FAILED"
+    if (last.passed === false && maturityFailed) console.error("ScaleQuality: below the line — failing the build.")
+    else if (last.passed === false && licenseBlocked) console.error("ScaleQuality: a forbidden license, failing the build.")
+    else if (last.passed === false) console.error("ScaleQuality: the gate did not pass, failing the build.")
     else if (last.cutoff == null) log("ScaleQuality: measurement completed (track only; no cutoff configured).")
     else log("ScaleQuality: passed.")
   }

package/bin/ci.mjs

@@ -0,0 +1,18 @@
+// Where a CI run happened, read from the provider's own variables.
+
+/**
+ * Where this run happened, from the CI's own variables: the pull request's base
+ * (what the license gate compares against), its head and number. Outside a pull
+ * request only the branch is known, and the base stays empty: never guessed.
+ */
+export function ciContext(env = process.env) {
+  const strip = (v) => (v ? String(v).replace(/^refs\/heads\//, "") : null)
+  if (env.GITHUB_ACTIONS) {
+    const pr = /^refs\/pull\/(\d+)\//.exec(env.GITHUB_REF || "")
+    return { provider: "github", baseRef: env.GITHUB_BASE_REF || null, headRef: env.GITHUB_HEAD_REF || env.GITHUB_REF_NAME || null, pullRequest: pr ? pr[1] : null }
+  }
+  if (env.GITLAB_CI) return { provider: "gitlab", baseRef: env.CI_MERGE_REQUEST_TARGET_BRANCH_NAME || null, headRef: env.CI_MERGE_REQUEST_SOURCE_BRANCH_NAME || env.CI_COMMIT_REF_NAME || null, pullRequest: env.CI_MERGE_REQUEST_IID || null }
+  if (env.TF_BUILD) return { provider: "azure", baseRef: strip(env.SYSTEM_PULLREQUEST_TARGETBRANCH), headRef: strip(env.SYSTEM_PULLREQUEST_SOURCEBRANCH || env.BUILD_SOURCEBRANCH), pullRequest: env.SYSTEM_PULLREQUEST_PULLREQUESTID || null }
+  if (env.BITBUCKET_BUILD_NUMBER) return { provider: "bitbucket", baseRef: env.BITBUCKET_PR_DESTINATION_BRANCH || null, headRef: env.BITBUCKET_BRANCH || null, pullRequest: env.BITBUCKET_PR_ID || null }
+  return null
+}

package/bin/coverage.mjs

@@ -0,0 +1,117 @@
+import { constants, rmSync } from "node:fs"
+import { open, opendir, mkdir, mkdtemp } from "node:fs/promises"
+import { tmpdir } from "node:os"
+import { join, relative, sep } from "node:path"
+
+const NAMES = [
+  { re: /^jacoco(TestReport)?\.xml$/i, format: "jacoco" },
+  { re: /^lcov\.info$/i, format: "lcov" },
+  { re: /^coverage-summary\.json$/i, format: "istanbul" },
+  { re: /^coverage\.cobertura\.xml$/i, format: "cobertura" },
+  { re: /^cobertura(-coverage)?\.xml$/i, format: "cobertura" },
+  { re: /^coverage\.xml$/i, format: "cobertura" },
+  { re: /^clover\.xml$/i, format: "clover" },
+  { re: /^(coverage|cover)\.out$/i, format: "go" },
+]
+const SKIP = new Set(["node_modules", ".git", ".venv", "venv", "vendor", "__pycache__", ".sqreports"])
+const STAGE = ".sqreports"
+
+// Copy sequentially using a fixed buffer. Report count and uncompressed bytes
+// do not determine which sources survive. The final compressed checkout still
+// has the existing upload limit, checked by archive.mjs before any HTTP request.
+async function copyReport(source, destination) {
+  let input, output
+  try {
+    input = await open(source, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)
+    const before = await input.stat({ bigint: true })
+    if (!before.isFile() || before.size === 0n) throw new Error("report is empty or is not a regular file")
+    output = await open(destination, "wx")
+    const buffer = Buffer.allocUnsafe(64 * 1024)
+    let copied = 0n
+    while (true) {
+      const { bytesRead } = await input.read(buffer, 0, buffer.length, null)
+      if (!bytesRead) break
+      let written = 0
+      while (written < bytesRead) {
+        const { bytesWritten } = await output.write(buffer, written, bytesRead - written, null)
+        if (!bytesWritten) throw new Error("report copy made no progress")
+        written += bytesWritten
+      }
+      copied += BigInt(bytesRead)
+      if (copied > before.size) throw new Error("report changed during collection")
+    }
+    const after = await input.stat({ bigint: true })
+    if (copied !== before.size || after.size !== before.size || after.mtimeNs !== before.mtimeNs || after.ctimeNs !== before.ctimeNs) {
+      throw new Error("report changed during collection")
+    }
+  } finally {
+    await Promise.all([output?.close(), input?.close()])
+  }
+}
+
+/** Preserve every discovered original report in a flat v1 index. Flat names
+ * keep GNU/BSD tar exclusions from dropping nested build/target reports.
+ * Generated
+ * directories are scanned too: they are exactly where test runners write.
+ * No customer files are created or changed. A failed scan/copy/index never
+ * returns a partial set that could be presented as a complete measurement. */
+export async function stageCoverageReports({ root = process.cwd(), log = () => {} } = {}) {
+  const stagingRoot = await mkdtemp(join(tmpdir(), "sq-coverage-"))
+  const stage = join(stagingRoot, STAGE)
+  const remove = () => { try { rmSync(stagingRoot, { recursive: true, force: true }) } catch { /* best effort on process exit */ } }
+  const signals = ["SIGINT", "SIGTERM", "SIGHUP"]
+  const onSignal = () => { remove(); process.exit(130) }
+  process.once("exit", remove)
+  for (const signal of signals) process.once(signal, onSignal)
+  const cleanup = () => {
+    process.removeListener("exit", remove)
+    for (const signal of signals) process.removeListener(signal, onSignal)
+    remove()
+  }
+  let index
+  let count = 0
+  const shown = []
+  let current = "."
+  const walk = async (directory) => {
+    current = relative(root, directory).split(sep).join("/") || "."
+    const entries = await opendir(directory)
+    for await (const entry of entries) {
+      const absolute = join(directory, entry.name)
+      if (entry.isDirectory()) {
+        if (!SKIP.has(entry.name)) await walk(absolute)
+        continue
+      }
+      if (!entry.isFile()) continue // Never follow report or directory symlinks.
+      const match = NAMES.find(candidate => candidate.re.test(entry.name))
+      if (!match) continue
+      current = relative(root, absolute).split(sep).join("/")
+      if (!index) {
+        await mkdir(stage)
+        index = await open(join(stage, "index.json"), "wx")
+        await index.writeFile('{"version":1,"reports":[')
+      }
+      const file = `${count}-${entry.name}`
+      await copyReport(absolute, join(stage, file))
+      await index.writeFile((count ? "," : "") + JSON.stringify({ file, path: current, format: match.format }))
+      count++
+      if (shown.length < 3) shown.push(current)
+    }
+  }
+  try {
+    await walk(root)
+    if (index) {
+      await index.writeFile("]}\n")
+      await index.close()
+      index = undefined
+      log(`ScaleQuality: found ${count} coverage report(s) — ${shown.join(", ")}${count > 3 ? " …" : ""}`)
+    } else {
+      log("ScaleQuality: no coverage report found in this job. Run your tests with coverage before this step to get a measured %.")
+    }
+    return { stage, root: stagingRoot, count, cleanup }
+  } catch (error) {
+    await index?.close().catch(() => {})
+    cleanup()
+    const reason = typeof error?.code === "string" ? error.code : error?.message || "I/O error"
+    throw new Error(`Coverage collection could not finish at ${JSON.stringify(current)} (${reason}). No upload was sent and no partial coverage was submitted.`)
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalequality/check",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "ScaleQuality continuous code-maturity check for CI. Re-measures your repo on every build and fails the pipeline below your maturity line.",
   "type": "module",
   "bin": {