From 31502e59bffb2a89d6f125e3a3c70b11b8a8aba9 Mon Sep 17 00:00:00 2001 From: Ion Alpha Date: Mon, 2 Nov 2026 12:39:58 +0000 Subject: [PATCH] ci: upload Windows coverage and fix the Codecov patch target Only the ubuntu leg uploaded coverage, so the Windows-only code (about 2,300 lines of *_windows.go and every runtime.GOOS == "windows" branch in shared code) read as uncovered on every pull request that touched it, though the Windows leg runs those tests. The Windows test leg now runs with coverage and uploads it under a Windows flag; Codecov counts a line covered when either report covers it. macOS stays without coverage: its platform-only code is about 140 lines. The patch target was Codecov's default, the project's own coverage (94.4% at the time), so a few untested error paths in a small diff failed it. It is now a fixed 90%, just under dev/coverage-floor. The project status is off; dev/coverfloor is the project gate. wait_for_ci is stated explicitly so the status posts once, after both uploads. sandbox/egress_linux.go and sandbox/forward_linux.go come out of the ignore list. They were ignored because the runner skipped their tests (10% and 50%), but the test job now lifts the user-namespace restriction and requires confinement; main's latest profile has them at 84.4% and 72.2%. Signed-off-by: Ion Alpha --- .github/workflows/ci.yml | 16 +++++++++++----- codecov.yml | 37 +++++++++++++++++++++++++++---------- dev/test | 5 ++--- 3 files changed, 40 insertions(+), 18 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 468d38fb..478178b3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -146,11 +146,15 @@ jobs: # A separate `go build ./...` would only be a third full compile of the tree. - run: go vet ./... - name: Test (race on every platform; coverage only where it is uploaded) - # Only ubuntu uploads coverage, so only ubuntu pays the atomic-coverage - # instrumentation cost. The other platforms run the identical suite under - # -race with COVER unset, which is a correctness gate, not a coverage one. + # Ubuntu and Windows upload coverage, so only they pay the atomic-coverage + # instrumentation cost. Windows is uploaded because about 2,300 lines of + # *_windows.go code, and every runtime.GOOS == "windows" branch in shared + # code, run only there; Codecov counts a line covered when any upload covers + # it, so without this upload that code reads as untested on every pull + # request. macOS runs the identical suite under -race with COVER unset: its + # platform-only code is about 140 lines, too little to pay for a slower leg. env: - COVER: ${{ matrix.os == 'ubuntu-latest' && '-covermode=atomic -coverpkg=./... -coverprofile=coverage.out' || '' }} + COVER: ${{ matrix.os != 'macos-latest' && '-covermode=atomic -coverpkg=./... -coverprofile=coverage.out' || '' }} run: ./dev/test # Coverage is only a number until something fails when it drops. The floor @@ -161,11 +165,13 @@ jobs: if: matrix.os == 'ubuntu-latest' && matrix.go == '1.27' run: ./dev/coverfloor + # The flag names the platform, so Codecov can show either report on its own. - name: Upload coverage - if: matrix.os == 'ubuntu-latest' && matrix.go == '1.27' + if: matrix.os != 'macos-latest' && matrix.go == '1.27' uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7 with: files: coverage.out + flags: ${{ runner.os }} continue-on-error: true # The same profile, kept inside the repository's own trust boundary so the diff --git a/codecov.yml b/codecov.yml index 0e7d9a09..c395e42e 100644 --- a/codecov.yml +++ b/codecov.yml @@ -25,14 +25,33 @@ # The packages they test are not ignored. Coverage of the real implementations, # which is what the harnesses exist to produce, is unaffected. # -# The two `*_linux.go` files at the end are ignored for a related reason: their -# number reports the runner's configuration rather than the state of the tests. -# Both attach network plumbing to a child process inside a user namespace, and -# both are covered by tests that call t.Skip when the host has unprivileged user -# namespaces disabled. The GitHub ubuntu runner has them disabled, so the tests -# that exist for this code never execute in CI and it reports 10% and 50% while -# being tested. A pull request that touches either file is then scored against -# coverage it has no way to earn. +# Linux and Windows both upload (ci.yml, the test job), and a line counts as +# covered when either report covers it, so Windows-only code is scored on the +# Windows run. Codecov holds its status until the rest of CI has finished, so the +# status is posted once, after both uploads. +# +# The patch target is fixed rather than following the project figure. Codecov's +# default holds a pull request's changed lines to the project's own coverage (94% +# when this was written), so three or four untested error paths in a small diff +# fail it. 90% sits just under the floor dev/coverfloor enforces on the whole +# tree. A changed line still uncovered needs a test or a reason in the pull +# request body (AGENTS.md, Coverage), whatever this check says. +# +# The project status is off because dev/coverfloor is the project gate: it fails +# CI when Linux coverage drops below dev/coverage-floor, and lowering the floor is +# a reviewed diff. A second, advisory project number would only differ from it by +# whatever the Windows upload adds. +codecov: + notify: + wait_for_ci: true + +coverage: + status: + patch: + default: + target: 90% + project: off + ignore: - "bus/bustest" - "jobs/jobstest" @@ -44,5 +63,3 @@ ignore: - "spine/spinetest" - "state/statetest" - "internal/conformtest" - - "sandbox/egress_linux.go" - - "sandbox/forward_linux.go" diff --git a/dev/test b/dev/test index ade25c29..28070772 100755 --- a/dev/test +++ b/dev/test @@ -6,9 +6,8 @@ # The race detector always runs: it is the point of this gate. Coverage # instrumentation is separable via COVER, which defaults to atomic coverage # written to coverage.out (the local and primary-CI invocation). Set COVER= to -# run without it: CI uploads coverage from one platform only, so the other -# platforms skip the instrumentation cost while still running every test under -# -race. Unsetting it is also the fast path for a scoped local run, since the +# run without it: CI uploads coverage from Linux and Windows only, so macOS +# skips the instrumentation cost while still running every test under -race. Unsetting it is also the fast path for a scoped local run, since the # coverage default instruments the whole tree no matter how few packages you name. # # -coverpkg=./... is what makes the number honest. By default `go test` credits a