coverage: adopt the LLVM coverage pipeline from score_tooling 2.2.1

.bazelrc

@@ -46,11 +46,8 @@ build --per_file_copt=external/.*@-Wno-unused-variable
 # Same for exec/tool configuration builds triggered by unit() rules.
 build --host_per_file_copt=external/.*@-Wno-unused-variable
 
-coverage --features=coverage
-coverage --combined_report=lcov
-coverage --cache_test_results=no
-coverage --copt=-fprofile-update=atomic
-coverage --linkopt=-fprofile-update=atomic
+# LLVM source-based coverage (@score_tooling//coverage): --config=llvm_cov
+import %workspace%/tools/coverage/coverage.bazelrc
 
 # QNX credential helper — downloads QCC from qnx.com using SCORE_QNX_USER / SCORE_QNX_PASSWORD
 # env vars (set in CI secrets) or ~/.netrc (for local builds with a QNX account)

.github/tools/check_coverage_scope.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+# Coverage scope completeness check.
+#
+# Compares three sets:
+#   1. every production (non-testonly, non-QNX-only) cc_library / rust_library
+#      under //score/... (the universe),
+#   2. everything transitively reachable from //tools/coverage:coverage_scope,
+#   3. the justified exclusions in tools/coverage/scope_exclusions.txt.
+#
+# Fails when a universe target is neither reachable from the scope nor
+# excluded (coverage would silently miss its files), and when an exclusion
+# has become reachable (stale entry).
+set -euo pipefail
+cd "$(dirname "$0")/../.."
+
+SCOPE=//tools/coverage:coverage_scope
+ACCEPTLIST_JSON=score/config_management/deps_acceptlist.json
+EXCLUSIONS=tools/coverage/scope_exclusions.txt
+
+all=$(mktemp) scoped=$(mktemp) excluded=$(mktemp)
+trap 'rm -f "$all" "$scoped" "$excluded"' EXIT
+
+# Universe = production libraries of the PUBLIC buildable surface (the
+# deps_acceptlist) - the full //score tree references internal-overlay-only
+# targets and cannot be queried as a whole on the public repository.
+ACCEPT_TARGETS=$(python3 -c "import json; print(' '.join(json.load(open('$ACCEPTLIST_JSON'))['buildable_targets']))")
+bazel query \
+  "kind(\"cc_library|rust_library|rust_proc_macro\", set($ACCEPT_TARGETS)) \
+   except attr(testonly, 1, set($ACCEPT_TARGETS))" \
+  --output=label 2>/dev/null | sort -u > "$all"
+
+bazel cquery --noimplicit_deps --check_visibility=false \
+  "kind(\"cc_library|rust_library|rust_proc_macro\", deps(labels(deps, $SCOPE)))" \
+  --output=label 2>/dev/null | awk '{print $1}' | { grep '^//score' || true; } | sort -u > "$scoped"
+
+(grep -oE '^//[^ #]+' "$EXCLUSIONS" || true) | sort -u > "$excluded"
+
+missing=$(comm -23 "$all" "$scoped" | comm -23 - "$excluded")
+stale=$(comm -12 "$scoped" "$excluded")
+
+status=0
+if [ -n "$missing" ]; then
+  echo "ERROR: production targets neither in the coverage scope nor excluded:"
+  echo "$missing" | sed 's/^/  /'
+  echo "Add them to $SCOPE deps, or to $EXCLUSIONS with a justification."
+  status=1
+fi
+if [ -n "$stale" ]; then
+  echo "ERROR: exclusions that are (now) reachable from the coverage scope - remove them:"
+  echo "$stale" | sed 's/^/  /'
+  status=1
+fi
+[ "$status" -eq 0 ] && echo "Coverage scope is complete: every production target is in scope or explicitly excluded."
+exit "$status"

.github/workflows/coverage_report.yml

@@ -34,33 +34,31 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           persist-credentials: false
-      - name: Install lcov
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y lcov
       - name: Setup Bazel Cache
         uses: eclipse-score/cicd-actions/setup-bazel-cache@659dcbed63f6b7fbde88c7850125ea0a0a92f939
         with:
           unique-cache-name: ${{ github.workflow }}-${{ github.job }}
-      - name: Run Bazel Coverage
+      - name: Check coverage scope completeness
+        run: ./.github/tools/check_coverage_scope.sh
+      - name: Run Bazel Coverage (LLVM, line + branch)
         run: |
           readarray -t TARGETS < <(python3 -c \
             "import json; [print(t) for t in json.load(open('score/config_management/deps_acceptlist.json'))['test_targets']]")
-          bazel coverage --config=host_gcc "${TARGETS[@]}"
+          bazel coverage --config=llvm_cov --build_tests_only "${TARGETS[@]}"
       - name: Generate HTML Coverage Report
+        env:
+          # Report-only at introduction; ratchet once a baseline is agreed.
+          COVERAGE_THRESHOLD: "0"
         run: |
-          genhtml "$(bazel info output_path)/_coverage/_coverage_report.dat" \
-            -o=cpp_coverage \
-            --show-details \
-            --source-directory="$(bazel info execution_root)" \
-            --legend \
-            --function-coverage \
-            --branch-coverage
-        shell: bash
+          bazel run @score_tooling//coverage:generate_coverage_html -- \
+            --yaml tools/coverage/coverage_justifications.yaml \
+            --testlogs-subdir score \
+            --archive-dir coverage_artifact
       - name: Upload Coverage Artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
+          # Name kept from the gcov flow so downstream consumers keep working.
           name: ${{ github.event.repository.name }}_cpp_coverage_report
-          path: cpp_coverage/
+          path: coverage_artifact/
           include-hidden-files: true
           retention-days: 10

.gitignore

@@ -53,3 +53,6 @@ styles/
 .venv
 __pycache__/
 /.coverage
+
+# LLVM coverage report outputs
+/coverage*/

BUILD

@@ -11,9 +11,14 @@
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
 
-load("@score_tooling//:defs.bzl", "copyright_checker", "dash_license_checker", "setup_starpls", "use_format_targets")
+load("@score_tooling//:defs.bzl", "copyright_checker", "dash_license_checker", "setup_starpls")
+load("@score_tooling//third_party/format:macros.bzl", "use_format_targets")
 load("//:project_config.bzl", "PROJECT_CONFIG")
 
+# The LLVM coverage pipeline (//tools/coverage) resolves the workspace root
+# through MODULE.bazel at report time.
+exports_files(["MODULE.bazel"])
+
 setup_starpls(
     name = "starpls_server",
     visibility = ["//visibility:public"],
@@ -22,10 +27,10 @@ setup_starpls(
 copyright_checker(
     name = "copyright",
     srcs = [
+        "BUILD",
+        "MODULE.bazel",
         "src",
         "tests",
-        "//:BUILD",
-        "//:MODULE.bazel",
     ],
     config = "@score_tooling//cr_checker/resources:config",
     template = "@score_tooling//cr_checker/resources:templates",

MODULE.bazel

@@ -36,15 +36,31 @@ bazel_dep(name = "rules_rust", version = "0.68.1-score")
 bazel_dep(name = "rules_cc", version = "0.2.17")
 
 # LLVM Toolchains Rules - host configuration
-bazel_dep(name = "toolchains_llvm", version = "1.6.0", dev_dependency = True)
+bazel_dep(name = "toolchains_llvm", version = "1.8.0", dev_dependency = True)
 
 llvm = use_extension("@toolchains_llvm//toolchain/extensions:llvm.bzl", "llvm", dev_dependency = True)
 llvm.toolchain(
     cxx_standard = {"": "c++17"},
     llvm_version = "19.1.0",
+    # toolchains_llvm 1.8.0 defaults to its bundled libc++ and emits
+    # -stdlib=libc++ (an unused-argument error under warnings-as-errors);
+    # pin libstdc++ to keep the exact 1.6.0 behavior for regular builds.
+    stdlib = {"": "stdc++"},
 )
-use_repo(llvm, "llvm_toolchain")
-use_repo(llvm, "llvm_toolchain_llvm")
+
+# Coverage-only Clang instance (covmap for the LLVM coverage pipeline from
+# @score_tooling//coverage; selected only under --config=llvm_cov). Separate
+# from the 19.1.0 default instance so regular builds stay untouched.
+llvm.toolchain(
+    name = "llvm_toolchain_coverage",
+    cxx_standard = {"": "c++17"},
+    extra_known_features = [
+        "@score_tooling//coverage:enable_llvm_coverage_for_death_tests",
+    ],
+    llvm_version = "22.1.7",
+    stdlib = {"": "stdc++"},
+)
+use_repo(llvm, "llvm_toolchain", "llvm_toolchain_coverage", "llvm_toolchain_coverage_llvm", "llvm_toolchain_llvm")
 
 register_toolchains(
     "@llvm_toolchain//:all",
@@ -117,18 +133,10 @@ use_repo(imagefs, "score_qnx_aarch64_ifs_toolchain", "score_qnx_x86_64_ifs_toolc
 bazel_dep(name = "score_toolchains_rust", version = "0.9.1", dev_dependency = True)
 
 # tooling
-bazel_dep(name = "score_tooling", version = "1.2.0")
-
-# NOTE: git_override to get sphinx_module + docs_library_deps + dependable_element _rst target.
-# NOTE: To be removed once score_tooling releases a stable version with these features.
-git_override(
-    module_name = "score_tooling",
-    commit = "835f219a1121b316c4c7809d983db1b4d31ebbcf",
-    patch_strip = 1,
-    patches = ["//bazel/patches:score_tooling_remove_svglib.patch"],
-    remote = "https://github.com/eclipse-score/tooling.git",
-)
-
+# 2.2.1 contains the sphinx_module/docs_library_deps/dependable_element
+# features the old git_override existed for, and no longer depends on svglib
+# (the override patch is obsolete).
+bazel_dep(name = "score_tooling", version = "2.2.1")
 bazel_dep(name = "aspect_rules_lint", version = "2.3.0")
 bazel_dep(name = "buildifier_prebuilt", version = "8.5.1")
 
@@ -168,7 +176,12 @@ bazel_dep(name = "score_persistency", version = "0.3.2")
 single_version_override(
     module_name = "score_persistency",
     patch_strip = 1,
-    patches = ["//bazel/patches:score_persistency_fix_string_view_to_string.patch"],
+    patches = [
+        "//bazel/patches:score_persistency_fix_string_view_to_string.patch",
+        # score_persistency 0.3.2 root BUILD loads rust_coverage_report, which
+        # score_tooling 2.x removed - strip it so the package evaluates.
+        "//bazel/patches:score_persistency_remove_rust_coverage.patch",
+    ],
 )
 
 # TRLC dependency — commit matches score_tooling ade2a09e