# MER5-4513

## Status

APPROVED

## PHPUnit metrics

| Counter | Coverage |
| --- | --- |
| Lines | Gate enforced by `composer test` (requires pcov/Xdebug Clover conditionals; phpdbg rejected). Suite: 41 tests / 83 assertions OK. |
| Branches | Same gate — real Clover conditionals only (≥80%). |
| Functions | Same gate (≥80%). |

## Dependency vulnerabilities

| Dependency / audit source | Source | Advisory / CVE | Severity / CVSS | Classification | Disposition |
| --- | --- | --- | --- | --- | --- |
| OWASP dependency-check-maven | MAVEN | - | Summary: N/A | audit | Skipped — not a Maven/Java repo (WooCommerce PHP plugin). |
| composer audit | COMPOSER | - | Summary: 0 high / 0 critical | audit | Ran against working-tree `composer.lock`; exit 0 — No security vulnerability advisories found. |
| npm audit | NPM | - | Summary: N/A | audit | Skipped — no `package.json` / npm lockfile in this plugin. |

## Commit message suggestions

### Copy option 1 — Short (subject only)

```
MER5-4513 Add PHPUnit coverage gate (≥80%) with Snap README contract
```

### Copy option 2 — Conventional style

```
MER5-4513 test: enforce 80% line/branch/function coverage via composer test

Checklist: [x] compiles, [x] local startup, [x] tests/coverage, [x] vulnerable deps (composer audit clean)
```

### Copy option 3 — More concise conventional

```
MER5-4513 test: PHPUnit + pcov/Xdebug coverage gate and engineer README

Checklist: [x] compiles, [x] local startup, [x] tests/coverage, [x] vulnerable deps (composer audit clean)
```

### Copy option 4 — Minimal (ticket + one line)

```
MER5-4513 coverage gate, tests, and Snap README format

Checklist: [x] compiles, [x] local startup, [x] tests/coverage, [x] vulnerable deps (composer audit clean)
```