coverage.yml

# Synced from cplieger/ci/.github/workflow-templates/coverage.yml — DO NOT EDIT.
# Measures test coverage on main and publishes a shields `endpoint` badge to
# the orphan `badges` branch (read by the README coverage badge). Only synced
# to Go/TS repos (shell/Dockerfile-only repos have no statement coverage).
#
# Runs on main + manual dispatch only (never PRs) — the badge reflects main,
# and this keeps it off the per-PR critical path. Not a required check.
name: Coverage

on:
  push:
    branches: [main]
  workflow_dispatch:

# Top-level permissions are read-only (OpenSSF Scorecard Token-Permissions);
# the coverage job declares the contents:write it needs to publish the badge
# JSON to the orphan `badges` branch. GitHub intersects this job-level grant
# with what the called reusable workflow declares, so it is functionally
# equivalent to a top-level grant but scores minimal on Scorecard.
permissions:
  contents: read

jobs:
  coverage:
    permissions:
      contents: write
    # NOTE: pin this @SHA to the ci release tag that first contains
    # coverage.yaml when cutting that tag (see ci.md "Updating and propagating").
    # Renovate then tracks the `# v2` comment and bumps the digest thereafter.
    uses: cplieger/ci/.github/workflows/coverage.yaml@6945966e00b2082b7352a3efcd6dd51fc3a09a8c # v2