Test Coverage Improvements: Phase 1-3 Complete

.claude/settings.local.json

@@ -122,7 +122,17 @@
       "Bash(else echo \"No coverage file\")",
       "Bash(while read dir)",
       "Bash(do test -d \"internal/$dir\")",
-      "Read(//c/c/Users/cathe/OneDrive/Desktop/github/driftmgr/**)"
+      "Read(//c/c/Users/cathe/OneDrive/Desktop/github/driftmgr/**)",
+      "Bash(codecov:*)",
+      "Bash(sort:*)",
+      "Bash(./codecov.exe:*)",
+      "Bash(git rev-parse:*)",
+      "Bash(xargs:*)",
+      "Bash(if [ -f test_coverage.out ])",
+      "Bash(else echo \"Coverage file not found\")",
+      "WebSearch",
+      "Bash(./scripts/codecov-test.bat)",
+      "Bash(start test_badges.html)"
     ],
     "deny": [],
     "ask": [],

.github/workflows/ci-cd.yml

@@ -11,6 +11,8 @@ on:
 
 env:
   GO_VERSION: '1.23'
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
 
 jobs:
   # Basic validation
@@ -27,6 +29,7 @@ jobs:
       with:
         go-version: ${{ env.GO_VERSION }}
         cache: true
+        cache-dependency-path: go.sum
 
     - name: Download dependencies
       run: go mod download
@@ -68,6 +71,7 @@ jobs:
       with:
         go-version: ${{ env.GO_VERSION }}
         cache: true
+        cache-dependency-path: go.sum
 
     - name: Download dependencies
       run: go mod download
@@ -85,25 +89,67 @@ jobs:
       with:
         sarif_file: gosec.sarif
 
-  # Docker build
+  # Docker build and push
   docker:
     name: Docker Build
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request'
-
+    permissions:
+      contents: read
+      packages: write
+
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
-
+
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v3
+
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
-
-    - name: Build Docker image
+
+    - name: Log in to GitHub Container Registry
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Extract metadata
+      id: meta
+      uses: docker/metadata-action@v5
+      with:
+        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+        tags: |
+          type=ref,event=branch
+          type=ref,event=pr
+          type=semver,pattern={{version}}
+          type=semver,pattern={{major}}.{{minor}}
+          type=raw,value=latest,enable={{is_default_branch}}
+
+    - name: Build and push Docker image
       uses: docker/build-push-action@v5
       with:
         context: .
-        platforms: linux/amd64
-        push: false
-        tags: driftmgr:test
+        platforms: linux/amd64,linux/arm64
+        push: true
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
         cache-from: type=gha
-        cache-to: type=gha,mode=max
+        cache-to: type=gha,mode=max
+        build-args: |
+          VERSION=${{ github.sha }}
+          BUILD_DATE=${{ github.event.repository.updated_at }}
+
+    - name: Run Trivy vulnerability scanner
+      uses: aquasecurity/trivy-action@master
+      with:
+        image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
+        format: 'sarif'
+        output: 'trivy-results.sarif'
+
+    - name: Upload Trivy results to GitHub Security
+      uses: github/codeql-action/upload-sarif@v3
+      continue-on-error: true
+      with:
+        sarif_file: 'trivy-results.sarif'

.github/workflows/code-quality.yml

@@ -0,0 +1,42 @@
+name: Code Quality
+
+on:
+  push:
+    branches: [ main, develop ]
+  pull_request:
+    branches: [ main, develop ]
+
+jobs:
+  format:
+    name: Go Format Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.23'
+
+      - name: Check Go formatting
+        run: |
+          if [ "$(gofmt -s -l . | wc -l)" -gt 0 ]; then
+            echo "The following files are not formatted correctly:"
+            gofmt -s -l .
+            exit 1
+          fi
+
+  lint:
+    name: Go Linting
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.23'
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v6
+        with:
+          version: latest
+          args: --timeout=10m