coverage.yml

name: Coverage

# Report-only code coverage measurement using cargo-llvm-cov + nextest.
# This job mirrors the CI test runner but instruments the build with
# source-based coverage, then publishes an LCOV artifact and a summary
# in the GitHub Actions job summary. It does NOT gate merges — once a
# baseline is established, a follow-up PR can add a regression threshold.
#
# See issue #3819 for context.

# Runs on push to main only. Coverage is a report-only trend metric: the
# full instrumented `cargo llvm-cov nextest --workspace` (~20-30 min) used
# to run on every PR, where it duplicated the per-PR test lane to produce
# a number that gates no merge. The main-branch series is all the trend
# needs; per-PR runs were pure waste. Use `workflow_dispatch` for an
# ad-hoc run (e.g. to refresh the LCOV artifact).
on:
  push:
    branches: [main]
    # Skip coverage when a main push's entire diff is non-runtime files —
    # it cannot shift the number, so the ~20-30 min run is pure waste.
    # `paths-ignore` skips only when *every* changed path matches.
    paths-ignore:
      - 'docs/**'
      - '**.md'
      - 'xtask/**'                    # build tooling, not runtime
      - '.github/workflows/**'        # pipeline YAML, not runtime
      - 'sdk/**'                      # generated SDKs (not rust-measured)
      - 'web/**'                      # web frontend (not rust)
      - 'crates/librefang-api/dashboard/**'  # react dashboard (not rust)
      - '**/*.svg'
      - '**/*.png'
      - '**/*.jpg'
      - '**/*.jpeg'
      - '**/*.gif'
      - '**/*.ico'
      - 'CODEOWNERS'
      - '.gitignore'
      - '.editorconfig'
      - '.secrets.baseline'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  # Each main commit's coverage is its own data point — never cancel an
  # in-progress run when a newer commit lands.
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

env:
  CARGO_TERM_COLOR: always
  # Coverage instrumentation generates many warnings inside generated
  # code; don't promote them to errors here (CI's main lane already
  # enforces -D warnings on the non-instrumented build).
  RUSTFLAGS: ""
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  coverage:
    name: Workspace coverage (llvm-cov)
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          components: llvm-tools-preview

      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          shared-key: coverage

      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@4616abf838e456930a67014fba647f87c185cc6c # cargo-llvm-cov
        with:
          tool: cargo-llvm-cov

      - name: Install nextest
        uses: taiki-e/install-action@4616abf838e456930a67014fba647f87c185cc6c # nextest

      - name: Install Tauri system deps
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libwebkit2gtk-4.1-dev \
            libgtk-3-dev \
            libayatana-appindicator3-dev \
            librsvg2-dev \
            libdbus-1-dev \
            libsecret-1-dev \
            pkg-config \
            patchelf

      - name: Ensure dashboard build dir exists
        run: mkdir -p crates/librefang-api/static/react

      - name: Generate coverage (LCOV)
        env:
          RUST_TEST_THREADS: "1"
        run: |
          # pipefail: tee always exits 0, so without this the cargo failure
          # would be masked and the job would falsely succeed.
          set -o pipefail
          # Tee combined stdout+stderr to a log so a follow-up step can
          # surface failing test names even when the run-log download API
          # is admin-only (HTTP 403 for non-admin readers).
          cargo llvm-cov nextest \
            --workspace \
            --no-fail-fast \
            --lcov \
            --output-path lcov.info 2>&1 | tee nextest-output.log

      - name: Surface failing tests
        if: failure()
        run: |
          {
            echo "## Failing tests (nextest)"
            echo ""
            echo '```'
            # nextest prints lines like "        FAIL [   0.123s] crate test::name"
            # in the run summary; TIMEOUT and LEAK are the other terminal states.
            grep -E '^\s+(FAIL|TIMEOUT|LEAK)\b' nextest-output.log \
              || echo "(no FAIL/TIMEOUT/LEAK lines found — inspect the nextest-output artifact)"
            echo '```'
            echo ""
            echo "### Last 200 lines of nextest output"
            echo '```'
            tail -n 200 nextest-output.log
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Generate coverage summary
        if: success()
        run: |
          cargo llvm-cov report --summary-only | tee coverage-summary.txt
          {
            echo "## Code coverage"
            echo ""
            echo '```'
            cat coverage-summary.txt
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Upload nextest output
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: nextest-output
          path: nextest-output.log
          if-no-files-found: warn
          retention-days: 14

      - name: Upload LCOV artifact
        if: success()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: coverage-lcov
          path: lcov.info
          if-no-files-found: error
          retention-days: 14