[TrezorHannes]

Summary of Changes

• CI/CD Workflow Improvements (.github/workflows/tests.yml, requirements-dev.txt, .gitignore):
  • Update Python test matrix from ["3.10", "3.11", "3.12"] to ["3.11", "3.12", "3.13"] (Python 3.10 is EOL and incompatible with pyTelegramBotAPI>=4.37.1 and configparser>=7.3.0, which require Python >=3.11).
  • Add permissions: contents: read, workflow concurrency cancellation, fail-fast: false across matrix jobs, and actions/setup-python@v6 pip caching (cache: "pip").
  • Install dev dependencies from requirements-dev.txt (adding pytest-cov) and report statement coverage during CI runs.
• Unblock TLS Dependency Updates (tests/test_ca_trust_hardening.py):
  • Replace brittle exact string equality (== ">=2026.10.19", == ">=2.34.2", == ">=2.8.0") with parsed version-tuple floor assertions (>= (2026, 10, 19), >= (2, 34, 2), >= (2, 8, 0)) so Dependabot version bumps (such as certifi>=2026.10.23 in chore(deps): update certifi requirement from >=2026.10.19 to >=2026.10.23 #64) pass without false-positive failures.
• Remove Redundant Tests Without Hitting Code Coverage (tests/):
  • Consolidate and remove 22 duplicate/subset test cases across test_amboss_pull.py, test_magma_market_fee.py, test_magma_sale_process.py, test_magma_simulation.py, test_swap_out_loop.py, test_ca_trust_hardening.py, test_fee_adjuster.py, and test_rebalance_guard.py (-500 lines).
  • Verified via coverage line and branch arc analysis that 0 statements and 0 branch arcs are lost across all repository modules (6844 statements, 4932 missed, 28% statement coverage / 87% amboss_pull, 63% swap_out-loop, 53% magma_sale_process, 36% rebalance_guard, 26% magma_market_fee, 19% fee_adjuster).

Verification

• pytest tests/ -v --cov=LNDg --cov=Magma --cov=Other --cov=Peerswap --cov=LNBits --cov-branch: 137 passed in 2.41s with identical statement and branch coverage across all modules.
• Note: Greptile not enabled for this repo; reviewed via TunnelSentinel (tunnelsentinel[bot]).

[tunnelsentinel]

🛡️⚡ TunnelSentinel Code Review

Verdict: APPROVE | Confidence: 5/5 | Risk Tier: MEDIUM
"Zero leaks. Fail-closed verification."

---

Latest commit: 10e621b | Status: success | Reviewed: 2026-10-27 09:37 UTC

Executive Summary

• Risk Tier: MEDIUM (prod_lines_changed=29, net_lines_changed=576, files=13, prod_files=3).
• Verdict: Clean pass (5/5 confidence). Zero P0/P1/P2/P3 findings identified.

Verification & Edge-Case Analysis

1. CI Workflow & Dependency Matrix (.github/workflows/tests.yml, requirements-dev.txt, .gitignore):
   • Verified matrix update from ["3.10", "3.11", "3.12"] to ["3.11", "3.12", "3.13"] aligns with pyTelegramBotAPI>=4.37.1 and configparser>=7.3.0 (Requires-Python >=3.11).
   • Verified least-privilege permissions: contents: read, workflow-level concurrency cancellation, fail-fast: false, and actions/setup-python@v6 pip caching (cache-dependency-path: "requirements*.txt").
   • Verified .gitignore covers .pytest_cache/, .coverage, .coverage.*, coverage.xml, and htmlcov/.
2. TLS Dependency Pin Floor Check (tests/test_ca_trust_hardening.py):
   • Verified _extract_min_version_tuple enforces >= or == operators via strict regex matching and compares parsed integer version tuples (>= (2026, 10, 19), >= (2, 34, 2), >= (2, 8, 0)), failing closed on weaker operators or lower versions while allowing newer Dependabot security bumps.
3. Redundant Test Consolidation & Coverage Parity (tests/):
   • Verified across all 8 test modules that consolidating 22 duplicate/subset test cases preserves 100% of statement and branch coverage (6844 statements, 4932 missed, 2266 branches, 241 partial, 137 passed).

Review history

• 10e621b: APPROVE, 5/5, MEDIUM risk, status success, 2026-10-27 09:37 UTC