From 716adce677b90924b7c0f028cfbaf5bc88e73ffc Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Tue, 4 Aug 2026 15:57:32 +0500 Subject: [PATCH] feat: extend coverage-gate with install command and artifact upload Signed-off-by: rldyourmnd --- .github/workflows/coverage-gate.yml | 33 ++++++++++++++++++++++++++++- CHANGELOG.md | 9 ++++++++ catalog/capabilities.yml | 4 +++- catalog/tools.yml | 3 ++- 4 files changed, 46 insertions(+), 3 deletions(-) diff --git a/.github/workflows/coverage-gate.yml b/.github/workflows/coverage-gate.yml index 0ac4393..81dbad0 100644 --- a/.github/workflows/coverage-gate.yml +++ b/.github/workflows/coverage-gate.yml @@ -18,6 +18,10 @@ on: description: 'Command (bash) that produces a coverage report. Empty to skip.' type: string default: '' + install_command: + description: 'Command (bash) that installs the coverage tool, e.g. `cargo install cargo-llvm-cov`. Empty to skip; runs before the coverage command.' + type: string + default: '' files: description: 'Coverage file(s) to upload (comma-separated). Empty lets Codecov search.' type: string @@ -41,6 +45,18 @@ on: timeout_minutes: type: number default: 20 + upload_artifact: + description: 'When true, uploads the coverage report file as a workflow artifact.' + type: boolean + default: false + artifact_name: + description: 'Name of the workflow artifact to upload.' + type: string + default: 'coverage-report' + artifact_path: + description: 'Path (file or directory) of the report to upload. Required when upload_artifact is true.' + type: string + default: '' secrets: codecov_token: required: false @@ -67,11 +83,17 @@ jobs: with: persist-credentials: false + - name: Run install command + if: ${{ inputs.install_command != '' }} + env: + INSTALL_COMMAND: ${{ inputs.install_command }} + run: bash -euo pipefail -c "$INSTALL_COMMAND" + - name: Produce coverage if: ${{ inputs.coverage_command != '' }} env: COVERAGE_COMMAND: ${{ inputs.coverage_command }} - run: bash -c "$COVERAGE_COMMAND" + run: bash -euo pipefail -c "$COVERAGE_COMMAND" - name: Upload to Codecov if: ${{ inputs.use_codecov }} @@ -88,3 +110,12 @@ jobs: with: github-token: ${{ secrets.GITHUB_TOKEN }} file: ${{ inputs.coveralls_file }} + + - name: Upload coverage report artifact + if: ${{ inputs.upload_artifact }} + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: ${{ inputs.artifact_name }} + path: ${{ inputs.artifact_path }} + if-no-files-found: error + retention-days: 14 diff --git a/CHANGELOG.md b/CHANGELOG.md index 3864d3f..a50e5a0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -22,6 +22,15 @@ ### Added +- **`coverage-gate.yml` gained an install command and artifact upload.** Four + new inputs: `install_command` (string, default `''` — runs before the coverage + command to install the coverage tool, e.g. `cargo install cargo-llvm-cov`; + skipped when empty), `upload_artifact` (boolean, default false), + `artifact_name` (string, default `coverage-report`), and `artifact_path` + (string, default `''` — required when `upload_artifact` is true). When + `upload_artifact` is true, the report is uploaded as a workflow artifact via + `actions/upload-artifact`. Off by default, so existing callers are unaffected. + - **`actionlint.yml` grew optional shellcheck support.** Three new inputs — `enable_shellcheck` (boolean, default false), `shellcheck_version` (default `0.11.0`), and `shellcheck_sha256` (SHA256 of diff --git a/catalog/capabilities.yml b/catalog/capabilities.yml index ca378c8..a2c66ad 100644 --- a/catalog/capabilities.yml +++ b/catalog/capabilities.yml @@ -1247,8 +1247,10 @@ capabilities: risks: - "Coverage thresholds are enforced by the caller's codecov.yml, not this workflow" - "Private-repo runner minutes are metered beyond the included free allotment" + - "install_command runs arbitrary caller-supplied bash before the coverage command; keep it trusted and least-privilege" + - "upload_artifact (default off) uploads artifact_path via actions/upload-artifact using the job token; it needs artifact_path set and fails closed if no files match" deprecations: null - last_verified: "2026-07-08" + last_verified: "2026-08-04" sources: - "https://docs.codecov.com/docs" - "https://github.com/codecov/codecov-action" diff --git a/catalog/tools.yml b/catalog/tools.yml index a1b1f37..2f2add8 100644 --- a/catalog/tools.yml +++ b/catalog/tools.yml @@ -163,7 +163,8 @@ tools: pin: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" used_by: - .github/workflows/release-supply-chain.yml - last_verified: "2026-07-04" + - .github/workflows/coverage-gate.yml + last_verified: "2026-08-04" - id: flutter-action name: subosito/flutter-action