From 3fdbcae0a4800082ddef7ad7cc3e834778170e14 Mon Sep 17 00:00:00 2001 From: leynos Date: Tue, 14 Jul 2026 02:07:42 +0200 Subject: [PATCH] Wire the CodeScene coverage gate into CI CodeScene (project 70277) already posts a Code Health Review check but never receives coverage data: the guarded upload step in coverage.yml defaults to `mode: upload`, which CodeScene only accepts for branches it analyses, so it would fail outright on pull-request heads the moment CS_ACCESS_TOKEN is set. Bump the shared-actions pin to 927edd4 (the shared-actions#333/#334 fixes), enable the coverage ratchet, and add coverage-main.yml so main-branch pushes upload coverage with `mode: upload` while pull requests only generate coverage. The changed-line `mode: check` gate is deferred: project 70277 has no coverage-gates configuration yet, which is a CodeScene-side setting outside CI's control. --- .github/workflows/coverage-main.yml | 46 +++++++++++++++++++++++++++++ .github/workflows/coverage.yml | 30 ++++++++++++------- .github/workflows/release.yml | 2 +- 3 files changed, 67 insertions(+), 11 deletions(-) create mode 100644 .github/workflows/coverage-main.yml diff --git a/.github/workflows/coverage-main.yml b/.github/workflows/coverage-main.yml new file mode 100644 index 00000000..66e4b053 --- /dev/null +++ b/.github/workflows/coverage-main.yml @@ -0,0 +1,46 @@ +name: Coverage (main) + +# CodeScene accepts `cs-coverage upload` only for analysed branches, so +# main-branch coverage is uploaded here on push; pull requests only +# generate coverage in coverage.yml (the changed-line gate is deferred +# until CodeScene enables the coverage-gates configuration for project +# 70277 — see the comment in coverage.yml). This workflow also advances +# the coverage ratchet baseline: caches saved on main are readable by +# every pull-request run, so the baseline written here is the one PR +# ratchet checks compare against. +# +# workflow_dispatch lets the upload be re-run on demand: merges +# performed by the automerge workflow's GITHUB_TOKEN do not fire +# push-event workflows, so automerged changes to main only get coverage +# via a manual dispatch. + +on: + push: + branches: [main] + workflow_dispatch: + +jobs: + coverage-upload: + runs-on: ubuntu-latest + env: + CARGO_TERM_COLOR: always + CS_ACCESS_TOKEN: ${{ secrets.CS_ACCESS_TOKEN }} + CODESCENE_CLI_SHA256: ${{ vars.CODESCENE_CLI_SHA256 }} + steps: + - uses: actions/checkout@v5 + - name: Setup Rust + uses: leynos/shared-actions/.github/actions/setup-rust@927edd45ae77be4251a8a18ca9eb5613a2e32cbd + - name: Generate coverage + uses: leynos/shared-actions/.github/actions/generate-coverage@927edd45ae77be4251a8a18ca9eb5613a2e32cbd + with: + output-path: lcov.info + format: lcov + use-cargo-nextest: 'false' + with-ratchet: 'true' + - name: Upload coverage data to CodeScene + if: ${{ env.CS_ACCESS_TOKEN != '' }} + uses: leynos/shared-actions/.github/actions/upload-codescene-coverage@927edd45ae77be4251a8a18ca9eb5613a2e32cbd + with: + format: lcov + access-token: ${{ env.CS_ACCESS_TOKEN }} + installer-checksum: ${{ vars.CODESCENE_CLI_SHA256 }} diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index c65e633d..20fb197a 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -13,24 +13,34 @@ jobs: CODESCENE_CLI_SHA256: ${{ vars.CODESCENE_CLI_SHA256 }} steps: - uses: actions/checkout@v5 + with: + fetch-depth: 0 - name: Setup Rust - uses: leynos/shared-actions/.github/actions/setup-rust@69f9c29d18a28b6bdf4b02dcd743ef416817ba18 + uses: leynos/shared-actions/.github/actions/setup-rust@927edd45ae77be4251a8a18ca9eb5613a2e32cbd - name: Format run: make check-fmt - name: Lint run: make lint - name: Generate coverage - uses: leynos/shared-actions/.github/actions/generate-coverage@69f9c29d18a28b6bdf4b02dcd743ef416817ba18 + uses: leynos/shared-actions/.github/actions/generate-coverage@927edd45ae77be4251a8a18ca9eb5613a2e32cbd with: output-path: lcov.info format: lcov - - name: Upload coverage data to CodeScene - if: ${{ env.CS_ACCESS_TOKEN != '' }} - uses: leynos/shared-actions/.github/actions/upload-codescene-coverage@69f9c29d18a28b6bdf4b02dcd743ef416817ba18 - with: - format: lcov - access-token: ${{ env.CS_ACCESS_TOKEN }} - installer-checksum: ${{ vars.CODESCENE_CLI_SHA256 }} + use-cargo-nextest: 'false' + with-ratchet: 'true' + # The `mode: check` step is deliberately not wired in yet: CodeScene + # project 70277 has no coverage-gates configuration, so + # `cs-coverage check` would fail every run with "HTTP call + # succeeded, but the received project-config isn't valid. Lacks the + # gates configuration." — a CodeScene-side per-project setting, not + # a CI defect (see ddlint#287 and chutoro#156, which hit the + # byte-identical error). Add the check step in a fast-follow PR + # once coverage-main.yml has uploaded to main at least once and the + # gate is confirmed to resolve, or once CodeScene confirms the + # project's coverage gate is enabled. `cs-coverage upload` is not + # run here either: CodeScene only accepts uploads for branches it + # analyses (main), so uploading from a pull-request head fails; + # main-branch coverage is uploaded by coverage-main.yml instead. # Exercise the experimental REST-based resolve path, ensuring lints and tests # pass when the `unstable-rest-resolve` feature is enabled. @@ -39,7 +49,7 @@ jobs: steps: - uses: actions/checkout@v5 - name: Setup Rust - uses: leynos/shared-actions/.github/actions/setup-rust@69f9c29d18a28b6bdf4b02dcd743ef416817ba18 + uses: leynos/shared-actions/.github/actions/setup-rust@927edd45ae77be4251a8a18ca9eb5613a2e32cbd - name: Install OpenSSL run: sudo apt-get update && sudo apt-get install -y openssl ca-certificates - name: Lint (feature-gated) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d36c2642..fb086120 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -43,7 +43,7 @@ jobs: fi echo "Release tag $tag matches Cargo.toml version." - name: Setup Rust - uses: leynos/shared-actions/.github/actions/setup-rust@69f9c29d18a28b6bdf4b02dcd743ef416817ba18 + uses: leynos/shared-actions/.github/actions/setup-rust@927edd45ae77be4251a8a18ca9eb5613a2e32cbd - name: Add Rust target run: rustup target add ${{ matrix.target }} - name: Install AArch64 linker