Wire the CodeScene coverage gate into CI - #197
Conversation
CodeScene (project 70277) already posts a Code Health Review check but never receives coverage data: the guarded upload step in coverage.yml defaults to `mode: upload`, which CodeScene only accepts for branches it analyses, so it would fail outright on pull-request heads the moment CS_ACCESS_TOKEN is set. Bump the shared-actions pin to 927edd4 (the shared-actions#333/#334 fixes), enable the coverage ratchet, and add coverage-main.yml so main-branch pushes upload coverage with `mode: upload` while pull requests only generate coverage. The changed-line `mode: check` gate is deferred: project 70277 has no coverage-gates configuration yet, which is a CodeScene-side setting outside CI's control.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 43 minutes Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3fdbcae0a4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| access-token: ${{ env.CS_ACCESS_TOKEN }} | ||
| installer-checksum: ${{ vars.CODESCENE_CLI_SHA256 }} | ||
| use-cargo-nextest: 'false' | ||
| with-ratchet: 'true' |
There was a problem hiding this comment.
When a PR runs after coverage-main has uploaded a new baseline, this ratchet still starts from 0: the pinned generate-coverage action restores ratchet-baseline-${{ runner.os }}-${{ github.run_id }} with restore prefix ratchet-baseline-${{ runner.os }}-, but saves the updated baseline as ratchet-baseline-${{ runner.os }}. Since that saved key is not prefixed by either lookup key, the main baseline is never restored here, so coverage drops below the intended baseline will pass silently even with with-ratchet enabled.
Useful? React with 👍 / 👎.
1 participant
Summary
Code Health Reviewcheck on vk's pull requests; this PR gets coverage data flowing so theCode Coveragecheck can eventually be enabled without repeating the netsuke/mxd timed-out-check jam.leynos/shared-actionspin repo-wide from69f9c29dto927edd45ae77be4251a8a18ca9eb5613a2e32cbd(shared-actions #333/#334: fixes the coverage-upload CLI-version bug and adds per-line coverage records plusmode: checksupport).with-ratchet: 'true') in the PR generation step so the changed baseline gates future PRs once uploads exist..github/workflows/coverage-main.yml: on push tomain(andworkflow_dispatch, so automerged pushes that skip the push event can be re-triggered manually), it regenerates coverage and uploads it to CodeScene withmode: upload, and writes the authoritative ratchet baseline that PR runs compare against.mode: checkchanged-line gate. A read-only probe ofGET /v2/code-coverage/projects/70277/configwith the estate PAT returns an empty body, matching the pattern found on ddlint/chutoro — CodeScene has not enabled the coverage-gates configuration for this project yet, andcs-coverage checkfails unconditionally without it ("received project-config isn't valid. Lacks the gates configuration."). The deferral is documented inline incoverage.yml.mode: uploadis likewise not run from the PR job (CodeScene only accepts uploads for branches it analyses; from a PR head it fails outright) — this is why the existing guarded step had to be removed rather than left in place once secrets go live.Why the existing step had to change, not just gain new inputs
vk's coverage.yml already had a guarded
upload-codescene-coveragestep, but it used the action's defaultmode: uploadandCS_ACCESS_TOKENwas unset in both secret stores, so it always skipped silently. Setting the secret without first fixing this would have broken every open pull request the instant the token was set (cs-coverage uploadrejects non-analysed branches). This PR removes that step from the PR job entirely; uploads now only happen fromcoverage-main.yml, which runs onmain.Review walkthrough
.github/workflows/coverage.yml— pin bump,fetch-depth: 0(so a futuremode: checkstep can diff against the merge base without another checkout change),use-cargo-nextest: 'false'(vk's Makefile runs plaincargo test, not nextest, so this preserves existing test behaviour),with-ratchet: 'true', and the guarded upload step replaced with an explanatory comment..github/workflows/coverage-main.yml— new workflow, modelled on ddlint's, generating and uploading coverage on push tomainplus manual dispatch..github/workflows/release.yml— same pin bump for consistency (single repo-wide shared-actions pin).Validation
python3 -c "import yaml; yaml.safe_load(open('.github/workflows/coverage.yml'))"and the same forcoverage-main.ymlandrelease.yml— all parse..github/workflowsfilenames in Rust sources and the Makefile).use-cargo-nextest: 'false'and the ratchet-enabled step must not fail on first run (no baseline cached yet).About the CodeScene checks
The
CodeScene Code Health Reviewcheck you may see on this PR is unrelated to this change — it runs independently of coverage. There is no branch-protection ruleset on this repository (gh api repos/leynos/vk/rules/branches/mainreturns[]), so no check here is a required check; CodeScene checks (health review or, in future, coverage) affect the status rollup but not mergeability directly.Secrets:
CS_ACCESS_TOKENwill be set in both the Actions and Dependabot secret stores immediately before this PR merges (not before), to avoid breaking the several other open pull requests (#194, #195, #196, #186) whose heads still carry the old, unguarded-by-branch upload step until they rebase onto the new main.