From dcb2b07931a188ee321e8e7ae96781e7b5090163 Mon Sep 17 00:00:00 2001 From: kdacosta0 Date: Thu, 7 May 2026 14:26:20 +0200 Subject: [PATCH 1/6] ci: enable codecov coverage checks with patch and project thresholds [SECURESIGN-4378] Add Codecov integration for automated code coverage reporting: - codecov.yml with patch target 70% (5% threshold) and project target auto (informational) - GitHub Actions workflow to run tests with coverage and upload to Codecov - Explicit coverage.out entry in .gitignore Implements SECURESIGN-4378 Assisted-by: Claude Code --- .github/workflows/code-coverage.yml | 29 +++++++++++++++++++++++++++++ .gitignore | 1 + codecov.yml | 10 ++++++++++ 3 files changed, 40 insertions(+) create mode 100644 .github/workflows/code-coverage.yml create mode 100644 codecov.yml diff --git a/.github/workflows/code-coverage.yml b/.github/workflows/code-coverage.yml new file mode 100644 index 000000000..59612714b --- /dev/null +++ b/.github/workflows/code-coverage.yml @@ -0,0 +1,29 @@ +name: Code Coverage + +on: + push: + branches: [ "main", "release*" ] + pull_request: + branches: [ "main", "release*" ] + +jobs: + coverage: + runs-on: ubuntu-latest + steps: + - name: Checkout source + uses: actions/checkout@v4 + + - name: Install Go + uses: actions/setup-go@v5 + with: + go-version-file: 'go.mod' + + - name: Run tests with coverage + run: go test -v -coverprofile=coverage.out ./... + + - name: Upload coverage to Codecov + uses: codecov/codecov-action@v5 + with: + files: coverage.out + token: ${{ secrets.CODECOV_TOKEN }} + fail_ci_if_error: true diff --git a/.gitignore b/.gitignore index 68ae86055..0eea557db 100644 --- a/.gitignore +++ b/.gitignore @@ -20,6 +20,7 @@ bundle/ # Output of the go coverage tool, specifically when used with LiteIDE *.out +coverage.out # Kubernetes Generated files - skip generated files, except for vendored files diff --git a/codecov.yml b/codecov.yml new file mode 100644 index 000000000..0e888eed9 --- /dev/null +++ b/codecov.yml @@ -0,0 +1,10 @@ +coverage: + status: + project: + default: + target: auto + informational: true + patch: + default: + target: 70% + threshold: 5% From e94ce0dfd0616f4e5ae5e8d86c506b0bb8a9be55 Mon Sep 17 00:00:00 2001 From: kdacosta0 Date: Thu, 7 May 2026 14:28:07 +0200 Subject: [PATCH 2/6] ci: update action versions to v6 Bump actions/checkout, actions/setup-go, and codecov/codecov-action to v6. Implements SECURESIGN-4378 Assisted-by: Claude Code --- .github/workflows/code-coverage.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/code-coverage.yml b/.github/workflows/code-coverage.yml index 59612714b..d2af45e91 100644 --- a/.github/workflows/code-coverage.yml +++ b/.github/workflows/code-coverage.yml @@ -11,10 +11,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout source - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Install Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version-file: 'go.mod' @@ -22,7 +22,7 @@ jobs: run: go test -v -coverprofile=coverage.out ./... - name: Upload coverage to Codecov - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@v6 with: files: coverage.out token: ${{ secrets.CODECOV_TOKEN }} From 9f40e5199c4d61ff380f85953843d189c41d8433 Mon Sep 17 00:00:00 2001 From: kdacosta0 Date: Thu, 7 May 2026 14:37:29 +0200 Subject: [PATCH 3/6] ci: add envtest setup and code generation to coverage workflow The test suite requires generated code (embed/images.env via go generate) and envtest binaries (etcd, kube-apiserver) to run. Also exclude e2e tests which require a full cluster. Implements SECURESIGN-4378 Assisted-by: Claude Code --- .github/workflows/code-coverage.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/code-coverage.yml b/.github/workflows/code-coverage.yml index d2af45e91..c47d88748 100644 --- a/.github/workflows/code-coverage.yml +++ b/.github/workflows/code-coverage.yml @@ -18,8 +18,14 @@ jobs: with: go-version-file: 'go.mod' + - name: Generate code and setup envtest + run: make manifests generate envtest + - name: Run tests with coverage - run: go test -v -coverprofile=coverage.out ./... + run: | + ENVTEST="./bin/setup-envtest-release-0.20" + KUBEBUILDER_ASSETS="$($ENVTEST use 1.32.0 --bin-dir ./bin -p path)" \ + go test -v -coverprofile=coverage.out $(go list ./... | grep -v /e2e) - name: Upload coverage to Codecov uses: codecov/codecov-action@v6 From 53237baa1eeb2da11fb77921c07a6b838a3365c2 Mon Sep 17 00:00:00 2001 From: kdacosta0 Date: Thu, 7 May 2026 14:42:53 +0200 Subject: [PATCH 4/6] =?UTF-8?q?ci:=20fix=20envtest=20setup=20=E2=80=94=20u?= =?UTF-8?q?se=20absolute=20paths=20and=20derive=20versions=20from=20Makefi?= =?UTF-8?q?le?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous workflow hardcoded the envtest binary name and K8s version, and used relative paths which broke when go test changed directories per package. Now all values are derived from the Makefile dynamically. Implements SECURESIGN-4378 Assisted-by: Claude Code --- .github/workflows/code-coverage.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/code-coverage.yml b/.github/workflows/code-coverage.yml index c47d88748..836635191 100644 --- a/.github/workflows/code-coverage.yml +++ b/.github/workflows/code-coverage.yml @@ -23,8 +23,10 @@ jobs: - name: Run tests with coverage run: | - ENVTEST="./bin/setup-envtest-release-0.20" - KUBEBUILDER_ASSETS="$($ENVTEST use 1.32.0 --bin-dir ./bin -p path)" \ + LOCALBIN="$(pwd)/bin" + ENVTEST=$(find "$LOCALBIN" -maxdepth 1 -name 'setup-envtest-*' -type f | head -1) + ENVTEST_K8S_VERSION=$(grep '^ENVTEST_K8S_VERSION' Makefile | awk -F '?= ' '{print $2}' | tr -d ' ') + KUBEBUILDER_ASSETS="$($ENVTEST use "$ENVTEST_K8S_VERSION" --bin-dir "$LOCALBIN" -p path)" \ go test -v -coverprofile=coverage.out $(go list ./... | grep -v /e2e) - name: Upload coverage to Codecov From 9719a574b452e50bfd9cb19b66903d81a3095779 Mon Sep 17 00:00:00 2001 From: kdacosta0 Date: Mon, 11 May 2026 09:56:21 +0200 Subject: [PATCH 5/6] ci: retrigger pipeline Co-Authored-By: Claude Opus 4.6 From 346afd4ccfbcba83c7add399714ff10e812d3c03 Mon Sep 17 00:00:00 2001 From: kdacosta0 Date: Mon, 18 May 2026 11:45:34 +0200 Subject: [PATCH 6/6] ci: integrate coverage into existing build-operator job Remove the separate code-coverage.yml workflow and collect coverage as a side effect of the tests that already run in build-operator. Update codecov.yml to match org standard configuration. - Add -coverprofile to Makefile test target - Add Codecov upload step with 'unit' flag to build-operator job - Add flag_management with carryforward to codecov.yml - Make patch target informational until e2e coverage is integrated - Remove redundant coverage.out .gitignore entry (*.out covers it) Co-Authored-By: Claude Opus 4.6 --- .github/workflows/code-coverage.yml | 37 ----------------------------- .github/workflows/main.yml | 10 ++++++++ .gitignore | 1 - Makefile | 2 +- codecov.yml | 5 ++++ 5 files changed, 16 insertions(+), 39 deletions(-) delete mode 100644 .github/workflows/code-coverage.yml diff --git a/.github/workflows/code-coverage.yml b/.github/workflows/code-coverage.yml deleted file mode 100644 index 836635191..000000000 --- a/.github/workflows/code-coverage.yml +++ /dev/null @@ -1,37 +0,0 @@ -name: Code Coverage - -on: - push: - branches: [ "main", "release*" ] - pull_request: - branches: [ "main", "release*" ] - -jobs: - coverage: - runs-on: ubuntu-latest - steps: - - name: Checkout source - uses: actions/checkout@v6 - - - name: Install Go - uses: actions/setup-go@v6 - with: - go-version-file: 'go.mod' - - - name: Generate code and setup envtest - run: make manifests generate envtest - - - name: Run tests with coverage - run: | - LOCALBIN="$(pwd)/bin" - ENVTEST=$(find "$LOCALBIN" -maxdepth 1 -name 'setup-envtest-*' -type f | head -1) - ENVTEST_K8S_VERSION=$(grep '^ENVTEST_K8S_VERSION' Makefile | awk -F '?= ' '{print $2}' | tr -d ' ') - KUBEBUILDER_ASSETS="$($ENVTEST use "$ENVTEST_K8S_VERSION" --bin-dir "$LOCALBIN" -p path)" \ - go test -v -coverprofile=coverage.out $(go list ./... | grep -v /e2e) - - - name: Upload coverage to Codecov - uses: codecov/codecov-action@v6 - with: - files: coverage.out - token: ${{ secrets.CODECOV_TOKEN }} - fail_ci_if_error: true diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 52114dffe..b19fe6a5e 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -23,6 +23,7 @@ jobs: permissions: contents: read packages: write + id-token: write steps: - name: Checkout source uses: actions/checkout@v4 @@ -46,6 +47,15 @@ jobs: - name: Build operator container run: make docker-build docker-push + - name: Upload coverage to Codecov + if: always() + uses: codecov/codecov-action@v6 + with: + files: coverage.out + flags: unit + use_oidc: true + fail_ci_if_error: false + build-bundle: name: Build-bundle-image runs-on: ubuntu-24.04 diff --git a/.gitignore b/.gitignore index 0eea557db..68ae86055 100644 --- a/.gitignore +++ b/.gitignore @@ -20,7 +20,6 @@ bundle/ # Output of the go coverage tool, specifically when used with LiteIDE *.out -coverage.out # Kubernetes Generated files - skip generated files, except for vendored files diff --git a/Makefile b/Makefile index f5bd54998..a3cd17103 100644 --- a/Makefile +++ b/Makefile @@ -126,7 +126,7 @@ vet: ## Run go vet against code. .PHONY: test test: manifests generate fmt vet envtest ## Run tests. - KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test $$(go list ./... | grep -v /e2e) + KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test -coverprofile=coverage.out $$(go list ./... | grep -v /e2e) # Utilize Kind or modify the e2e tests to load the image locally, enabling compatibility with other vendors. .PHONY: test-e2e # Run the e2e tests against a Kind k8s instance that is spun up. diff --git a/codecov.yml b/codecov.yml index 0e888eed9..d85a2ecdc 100644 --- a/codecov.yml +++ b/codecov.yml @@ -8,3 +8,8 @@ coverage: default: target: 70% threshold: 5% + informational: true + +flag_management: + default_rules: + carryforward: true