From 84bcae95a0b7681ef2a1ebb33e69e15858f1ccec Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Sun, 7 Jun 2026 00:17:20 +0200
Subject: [PATCH] fix(ci): fail closed on partial kova reports

---
 scripts/lib/kova-report-gate.mjs      | 17 +++++++++---
 test/scripts/kova-report-gate.test.ts | 40 +++++++++++++++++++++++++++
 2 files changed, 53 insertions(+), 4 deletions(-)

diff --git a/scripts/lib/kova-report-gate.mjs b/scripts/lib/kova-report-gate.mjs
index 7e526bccff1a..67b77d8730e3 100644
--- a/scripts/lib/kova-report-gate.mjs
+++ b/scripts/lib/kova-report-gate.mjs
@@ -3,6 +3,9 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 function numericCount(value) {
+  if (typeof value !== "number") {
+    return undefined;
+  }
   const count = Number(value);
   return Number.isFinite(count) ? count : undefined;
 }
@@ -16,15 +19,21 @@ export function evaluateToleratedPartialKovaReport(report) {
     return { ok: false, reason: `gate verdict was ${JSON.stringify(gate.verdict)}` };
   }
 
-  const blockingCount = numericCount(gate.blockingCount ?? 0);
-  if (blockingCount === undefined || blockingCount !== 0) {
+  const blockingCount = numericCount(gate.blockingCount);
+  if (blockingCount === undefined) {
+    return { ok: false, reason: "missing blocking count" };
+  }
+  if (blockingCount !== 0) {
     return { ok: false, reason: `blocking count was ${JSON.stringify(gate.blockingCount)}` };
   }
 
   const baselineRegressionCount = numericCount(
-    report?.baseline?.comparison?.regressionCount ?? report?.gate?.baseline?.regressionCount ?? 0,
+    report?.baseline?.comparison?.regressionCount ?? report?.gate?.baseline?.regressionCount,
   );
-  if (baselineRegressionCount === undefined || baselineRegressionCount !== 0) {
+  if (baselineRegressionCount === undefined) {
+    return { ok: false, reason: "missing baseline regression count" };
+  }
+  if (baselineRegressionCount !== 0) {
     return {
       ok: false,
       reason: `baseline regression count was ${JSON.stringify(baselineRegressionCount)}`,
diff --git a/test/scripts/kova-report-gate.test.ts b/test/scripts/kova-report-gate.test.ts
index ccef9d08f319..edbe765efbe6 100644
--- a/test/scripts/kova-report-gate.test.ts
+++ b/test/scripts/kova-report-gate.test.ts
@@ -47,6 +47,46 @@ describe("scripts/lib/kova-report-gate.mjs", () => {
     ).toEqual({ ok: false, reason: "missing status summary" });
   });
 
+  it("rejects partial reports without explicit blocking counts", () => {
+    expect(
+      evaluateToleratedPartialKovaReport(
+        partialReport({
+          gate: { verdict: "PARTIAL" },
+        }),
+      ),
+    ).toEqual({ ok: false, reason: "missing blocking count" });
+  });
+
+  it("rejects partial reports with malformed zero-like blocking counts", () => {
+    expect(
+      evaluateToleratedPartialKovaReport(
+        partialReport({
+          gate: { blockingCount: "", verdict: "PARTIAL" },
+        }),
+      ),
+    ).toEqual({ ok: false, reason: "missing blocking count" });
+  });
+
+  it("rejects partial reports without explicit baseline regression counts", () => {
+    expect(
+      evaluateToleratedPartialKovaReport(
+        partialReport({
+          baseline: {},
+        }),
+      ),
+    ).toEqual({ ok: false, reason: "missing baseline regression count" });
+  });
+
+  it("rejects partial reports with malformed zero-like baseline regression counts", () => {
+    expect(
+      evaluateToleratedPartialKovaReport(
+        partialReport({
+          baseline: { comparison: { regressionCount: null } },
+        }),
+      ),
+    ).toEqual({ ok: false, reason: "missing baseline regression count" });
+  });
+
   it("rejects partial reports without PASS records", () => {
     expect(
       evaluateToleratedPartialKovaReport(