From 3f479351772c2b44bd362be4961c58878a7e02cb Mon Sep 17 00:00:00 2001
From: spencrr <23708360+spencrr@users.noreply.github.com>
Date: Tue, 21 Apr 2026 20:19:52 -0700
Subject: [PATCH] [CI]: Improve CI and split out coverage as spearate workflow

---
 .github/workflows/ci.yml       |  6 ++--
 .github/workflows/coverage.yml | 56 ++++++++++++++++++++++++++++++++++
 2 files changed, 60 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/coverage.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b4035e36..67e5ae66 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,6 +16,7 @@ jobs:
   lint:
     name: Lint & Type Check
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
     steps:
@@ -48,7 +49,9 @@ jobs:
 
   test:
     name: Test (Python ${{ matrix.python-version }})
+    needs: lint
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
     strategy:
@@ -76,5 +79,4 @@ jobs:
         run: uv sync --frozen
 
       - name: Run tests
-        # Coverage threshold (fail_under) is enforced via pyproject.toml [tool.coverage.report]
-        run: uv run pytest tests/unit --cov=rampart --cov-report=xml --cov-report=term-missing
+        run: uv run pytest tests/unit
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
new file mode 100644
index 00000000..846649e0
--- /dev/null
+++ b/.github/workflows/coverage.yml
@@ -0,0 +1,56 @@
+name: Coverage
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: coverage-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  coverage:
+    name: Coverage
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --frozen
+
+      - name: Run tests with coverage
+        id: tests
+        # --cov-fail-under=0 overrides pyproject.toml [tool.coverage.report] fail_under
+        # so pytest doesn't exit non-zero on low coverage; threshold is checked separately below.
+        run: uv run pytest tests/unit --cov=rampart --cov-report=term-missing --cov-fail-under=0
+
+      - name: Coverage summary
+        if: ${{ steps.tests.outcome == 'success' }}
+        run: |
+          echo '## Coverage Report' >> $GITHUB_STEP_SUMMARY
+          uv run coverage report --format=markdown >> $GITHUB_STEP_SUMMARY
+
+      - name: Check coverage threshold
+        if: ${{ steps.tests.outcome == 'success' }}
+        # Threshold is defined in pyproject.toml [tool.coverage.report] fail_under
+        run: uv run coverage report