1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
on:
push:
branches:
- main
pull_request:
types:
- opened
- reopened
- synchronize
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
name: Code Coverage
permissions:
contents: read
jobs:
# Detect if only docs changed - skip CI if so. Named uniquely: other
# workflows also have a "Detect changes" job, and required status checks
# match check names globally.
changes:
name: Detect changes (coverage)
runs-on: ubuntu-latest
outputs:
code: ${{ steps.filter.outputs.code }}
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: filter
with:
filters: |
code:
- '**/*.rs'
- '**/*.toml'
- '**/*.lock'
- 'Cargo.lock'
- '.cargo/**'
- '.github/workflows/coverage.yaml'
coverage:
name: Code coverage
needs: changes
if: ${{ needs.changes.outputs.code == 'true' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
persist-credentials: false
- name: Install pinned Rust toolchain
uses: ./.github/actions/rust-toolchain
with:
components: llvm-tools-preview
# cargo-llvm-cov uses LLVM's native instrumentation for accurate coverage.
# Pinned >= 0.8 for --fail-under-lines support on the report subcommand.
- name: Install cargo-llvm-cov
uses: taiki-e/install-action@4684b8405694ae9dd42c9f39ba901a70ae83f4a3 # v2.82.9
with:
tool: cargo-llvm-cov@0.8.7
# Two passes merged into one profile: the root pass executes the mknod
# device tests, the non-root pass executes their skip branches -
# either alone leaves the other side uncovered.
- name: Generate coverage
run: |
cargo llvm-cov --locked --all-features --workspace --no-report
sudo -E env "PATH=$PATH" cargo llvm-cov --locked --all-features --workspace --no-report
sudo -E env "PATH=$PATH" cargo llvm-cov report --lcov --output-path lcov.info
- name: Upload coverage to Coveralls
uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.6
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
file: lcov.info
format: lcov
# Gate after the upload so Coveralls still receives the report when the
# threshold fails. `report` rescores the profdata recorded by the
# generate steps; sudo because that data is root-owned. The per-file
# bound stops an aggregate score from masking under-tested modules
# (baseline ~98% total, worst file ~95.5%).
- name: Enforce minimum 95% total and per-file line coverage
run: sudo -E env "PATH=$PATH" cargo llvm-cov report --fail-under-lines 95 --fail-under-file-lines 95