code-coverage.yml

name: code-coverage
# Unified coverage for relay (Go) + inbound (Vitest/Istanbul). Uploads the inbound
# cobertura report to GitHub Enterprise Code Coverage (org required check:
# `coverage`) and keeps full multi-component artifacts for inspection.

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read
  id-token: write
  code-quality: write
  pull-requests: write

jobs:
  coverage:
    name: coverage
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Setup Go
        uses: actions/setup-go@v7
        with:
          go-version-file: relay/go.mod
          cache-dependency-path: relay/go.sum

      - name: Relay coverage
        working-directory: relay
        env:
          # Floor (#419): coverage.yml previously only printed the total with
          # nothing able to fail on a regression, so a PR deleting half the
          # tests would merge green while the ruleset presents `coverage` as a
          # real required check. Set comfortably below the current ~79 percent so
          # normal drift does not trip it, but a real regression does.
          RELAY_COVERAGE_FLOOR: "65"
        run: |
          set -euo pipefail
          go test -race -coverprofile=coverage.out -covermode=atomic ./...
          summary="$(go tool cover -func=coverage.out | tail -1)"
          echo "$summary"
          pct="$(echo "$summary" | grep -oE '[0-9]+\.[0-9]+' | tail -1)"
          if [ -z "$pct" ]; then
            echo "::error::could not parse relay total coverage from: $summary"
            exit 1
          fi
          awk -v pct="$pct" -v floor="$RELAY_COVERAGE_FLOOR" 'BEGIN {
            if (pct + 0 < floor + 0) {
              printf "relay coverage %.1f%% is below the %s%% floor\n", pct, floor
              exit 1
            }
          }'

      - name: Setup Node
        uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: inbound/package-lock.json

      - name: Inbound coverage
        working-directory: inbound
        run: |
          npm ci
          npm run test:coverage

      - name: Upload coverage to GitHub Code Coverage
        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
        uses: actions/upload-code-coverage@v1
        with:
          file: ./inbound/coverage/cobertura-coverage.xml
          language: javascript

      - name: Upload coverage reports (artifacts)
        uses: actions/upload-artifact@v7
        with:
          name: coverage-reports
          path: |
            relay/coverage.out
            inbound/coverage/
          if-no-files-found: warn
          retention-days: 14