refactor: add Go test coverage workflow

.github/workflows/coverage.yml

@@ -0,0 +1,86 @@
+on:
+  push:
+    branches:
+    - main
+  pull_request:
+
+name: Go test coverage
+
+jobs:
+  coverage:
+    name: Measure test coverage (unit + integration tests)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install golang
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+
+      - name: Check out repository code
+        uses: actions/checkout@v4
+
+      - name: Run tests with coverage
+        run: make test-coverage
+
+      - name: Download base coverage breakdown
+        id: download-main-breakdown
+        uses: dawidd6/action-download-artifact@v6
+        with:
+          branch: main
+          workflow_conclusion: success
+          name: main.breakdown
+          if_no_artifact_found: warn
+
+      # continue-on-error: allow workflow to proceed to post PR comment and upload artifacts
+      - name: Check coverage thresholds
+        id: coverage
+        uses: vladopajic/go-test-coverage@v2
+        continue-on-error: true
+        with:
+          config: .testcoverage.yml
+          breakdown-file-name: ${{ github.ref_name == 'main' && 'main.breakdown' || '' }}
+          diff-base-breakdown-file-name: ${{ steps.download-main-breakdown.outputs.found_artifact == 'true' && 'main.breakdown' || '' }}
+
+      - name: Find pull request ID
+        run: |
+          PR_DATA=$(curl -s -H "Authorization: token ${{ github.token }}" \
+            "https://api.github.com/repos/${{ github.repository }}/pulls?head=${{ github.repository_owner }}:${{ github.head_ref || github.ref_name }}&state=open")
+          PR_ID=$(echo "$PR_DATA" | jq -r '.[0].number')
+          if [ "$PR_ID" != "null" ]; then
+            echo "pull_request_id=$PR_ID" >> "$GITHUB_ENV"
+          else
+            echo "No open pull request found for branch ${{ github.head_ref || github.ref_name }}."
+          fi
+
+      - name: Post coverage report to PR
+        if: env.pull_request_id
+        uses: thollander/actions-comment-pull-request@v3
+        with:
+          github-token: ${{ github.token }}
+          comment-tag: coverage-report
+          pr-number: ${{ env.pull_request_id }}
+          message: |
+            `go-test-coverage` report
+            ```
+            ${{ fromJSON(steps.coverage.outputs.report) }}```
+
+      - name: Upload coverage breakdown
+        uses: actions/upload-artifact@v4
+        if: github.ref_name == 'main'
+        with:
+          name: main.breakdown
+          path: main.breakdown
+          if-no-files-found: error
+
+      - name: Upload coverage report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: test/coverage/coverage.html
+
+      # fail the workflow if coverage thresholds are not met, after PR comment and artifacts are posted
+      - name: Fail if coverage thresholds not met
+        if: steps.coverage.outcome == 'failure'
+        shell: bash
+        run: echo "Coverage thresholds are not met." && exit 1

.gitignore

@@ -7,3 +7,4 @@ go-fdo-server
 go-fdo-server-*.tar.*
 rpmbuild
 test/workdir
+test/coverage

.testcoverage.yml

@@ -0,0 +1,8 @@
+profile: test/coverage/coverage.out
+threshold:
+  file: 0
+  package: 0
+  total: 0
+exclude:
+  paths:
+    - \.gen\.go$

Makefile

@@ -6,7 +6,10 @@ COMMIT_SHORT    := $(shell git rev-parse --short HEAD)
 SOURCE_DIR      := $(CURDIR)/build/package/rpm
 SPEC_FILE_NAME  := $(PROJECT).spec
 SPEC_FILE       := $(SOURCE_DIR)/$(SPEC_FILE_NAME)
-VERSION         := $(shell grep 'Version:' $(SPEC_FILE) | awk '{printf "%s", $$2}').git$(COMMIT_SHORT)
+VERSION         := $(shell grep 'Version:' $(SPEC_FILE) | awk '{printf "%s", $$2}')
+GOFLAGS         ?=
+COVERDIR        ?= $(CURDIR)/test/coverage
+GOCOVERDIR      ?= $(COVERDIR)/integration
 
 
 # Default target
@@ -15,7 +18,7 @@ all: build test
 # Build the Go project
 .PHONY: build
 build: generate tidy fmt vet
-	go build -ldflags="-X github.com/fido-device-onboard/go-fdo-server/internal/version.VERSION=${VERSION}"
+	go build $(GOFLAGS) -ldflags="-X github.com/fido-device-onboard/go-fdo-server/internal/version.VERSION=${VERSION}"
 
 .PHONY: oapi-codegen
 oapi-codegen:
@@ -50,6 +53,24 @@ test:
 shfmt:
 	shfmt -i 2 -ci -w .
 
+.PHONY: test-coverage
+test-coverage: SHELL := /usr/bin/env bash
+test-coverage:
+	rm -rf "$(COVERDIR)"
+	mkdir -p "$(GOCOVERDIR)"
+	go test -coverpkg=./... -coverprofile="$(COVERDIR)/unit.out" -covermode=atomic ./...
+	export GOCOVERDIR="$(GOCOVERDIR)"; \
+	export GOFLAGS="-cover -covermode=atomic"; \
+	set -e; \
+	for t in test/ci/test-*.sh; do \
+		echo "=== RUNNING: $$t ==="; \
+		($$t); \
+	done; \
+	go tool covdata textfmt -i="$(GOCOVERDIR)" -o="$(COVERDIR)/integration.out"
+	go install github.com/wadey/gocovmerge@latest
+	gocovmerge "$(COVERDIR)/unit.out" "$(COVERDIR)/integration.out" > "$(COVERDIR)/coverage.out"
+	go tool cover -html="$(COVERDIR)/coverage.out" -o "$(COVERDIR)/coverage.html"
+
 #
 # Generating sources and vendor tar files
 #
@@ -65,15 +86,23 @@ GO_VENDOR_TOOLS_FILE_NAME  := go-vendor-tools.toml
 GO_VENDOR_TOOLS_FILE       := $(SOURCE_DIR)/$(GO_VENDOR_TOOLS_FILE_NAME)
 VENDOR_TARBALL_FILENAME    := go-fdo-server-$(VERSION)-vendor.tar.bz2
 VENDOR_TARBALL             := $(SOURCE_DIR)/$(VENDOR_TARBALL_FILENAME)
-$(VENDOR_TARBALL):
+
+.PHONY: install-go-vendor-tools
+install-go-vendor-tools:
+	command -v go_vendor_archive || sudo dnf install -y go-vendor-tools python3-tomlkit askalono-cli go-rpm-macros
+
+$(VENDOR_TARBALL): install-go-vendor-tools
 	rm -rf vendor; \
-	command -v go_vendor_archive || sudo dnf install -y go-vendor-tools python3-tomlkit askalono-cli; \
 	go_vendor_archive create --config $(GO_VENDOR_TOOLS_FILE) --write-config --output $(VENDOR_TARBALL) .; \
 	rm -rf vendor;
 
 .PHONY: vendor-tarball
 vendor-tarball: $(VENDOR_TARBALL)
 
+.PHONY: update-rpm-licensing
+update-rpm-licensing: install-go-vendor-tools $(SPEC_FILE) $(SOURCE_TARBALL) $(VENDOR_TARBALL)
+	go_vendor_license --config $(GO_VENDOR_TOOLS_FILE) --path $(SPEC_FILE) report --update-spec --autofill=auto
+
 #
 # Building packages
 #
@@ -98,6 +127,7 @@ RENDEZVOUS_USER_FILE                  := $(SOURCE_DIR)/$(RENDEZVOUS_USER_FILE_NA
 OWNER_USER_FILE_NAME                  := go-fdo-server-owner-user.conf
 OWNER_USER_FILE                       := $(SOURCE_DIR)/$(OWNER_USER_FILE_NAME)
 
+RPMBUILD_VERSION                      := $(VERSION).git$(COMMIT_SHORT)
 RPMBUILD_TOP_DIR                      := $(CURDIR)/rpmbuild
 RPMBUILD_BUILD_DIR                    := $(RPMBUILD_TOP_DIR)/build
 RPMBUILD_RPMS_DIR                     := $(RPMBUILD_TOP_DIR)/rpms
@@ -107,9 +137,9 @@ RPMBUILD_SRPMS_DIR                    := $(RPMBUILD_TOP_DIR)/srpms
 RPMBUILD_BUILD_DIR                    := $(RPMBUILD_TOP_DIR)/build
 RPMBUILD_BUILDROOT_DIR                := $(RPMBUILD_TOP_DIR)/buildroot
 RPMBUILD_GOLANG_VENDOR_TOOLS_FILE     := $(RPMBUILD_SOURCES_DIR)/$(GO_VENDOR_TOOLS_FILE_NAME)
-RPMBUILD_SPECFILE                     := $(RPMBUILD_SPECS_DIR)/go-fdo-server-$(VERSION).spec
-RPMBUILD_TARBALL                      := $(RPMBUILD_SOURCES_DIR)/$(SOURCE_TARBALL_FILENAME)
-RPMBUILD_VENDOR_TARBALL               := ${RPMBUILD_SOURCES_DIR}/$(VENDOR_TARBALL_FILENAME)
+RPMBUILD_SPECFILE                     := $(RPMBUILD_SPECS_DIR)/go-fdo-server-$(RPMBUILD_VERSION).spec
+RPMBUILD_TARBALL                      := $(RPMBUILD_SOURCES_DIR)/go-fdo-server-$(RPMBUILD_VERSION).tar.gz
+RPMBUILD_VENDOR_TARBALL               := ${RPMBUILD_SOURCES_DIR}/go-fdo-server-$(RPMBUILD_VERSION)-vendor.tar.bz2
 RPMBUILD_GROUP_FILE                   := $(RPMBUILD_SOURCES_DIR)/$(GROUP_FILE_NAME)
 RPMBUILD_MANUFACTURER_USER_FILE       := $(RPMBUILD_SOURCES_DIR)/$(MANUFACTURER_USER_FILE_NAME)
 RPMBUILD_RENDEZVOUS_USER_FILE         := $(RPMBUILD_SOURCES_DIR)/$(RENDEZVOUS_USER_FILE_NAME)
@@ -120,12 +150,12 @@ RPMBUILD_RPM_FILE                     := $(RPMBUILD_RPMS_DIR)/$(ARCH)/$(PROJECT)
 
 $(RPMBUILD_SPECFILE):
 	mkdir -p $(RPMBUILD_SPECS_DIR)
-	sed -e "s/^Version:\(\s*\).*/Version:\1$(VERSION)/;" \
+	sed -e "s/^Version:\(\s*\).*/Version:\1$(RPMBUILD_VERSION)/;" \
 	    $(SPEC_FILE) > $(RPMBUILD_SPECFILE)
 
-$(RPMBUILD_TARBALL): $(SOURCE_TARBALL) $(VENDOR_TARBALL)
+$(RPMBUILD_TARBALL): $(VENDOR_TARBALL)
 	mkdir -p $(RPMBUILD_SOURCES_DIR)
-	cp $(SOURCE_TARBALL) $(RPMBUILD_TARBALL)
+	git archive --prefix=go-fdo-server-$(RPMBUILD_VERSION)/ --format=tar.gz HEAD > $(RPMBUILD_TARBALL)
 	cp $(VENDOR_TARBALL) $(RPMBUILD_VENDOR_TARBALL);
 
 $(RPMBUILD_GOLANG_VENDOR_TOOLS_FILE):

build/package/rpm/go-fdo-server.spec

@@ -22,7 +22,7 @@ Release:        %autorelease
 Summary:        A Go implementation of the FIDO Device Onboard Specification
 
 # Generated by go-vendor-tools
-License:        Apache-2.0 AND BSD-3-Clause AND MIT
+License:        0BSD AND Apache-2.0 AND BSD-3-Clause AND MIT AND Unlicense
 URL:            %{gourl}
 Source0:        %{gosource}
 # Generated by go-vendor-tools

build/package/rpm/go-vendor-tools.toml

@@ -10,3 +10,12 @@ path = "vendor/gopkg.in/yaml.v3/LICENSE"
 sha256sum = "d18f6323b71b0b768bb5e9616e36da390fbd39369a81807cca352de4e4e6aa0b"
 expression = "Apache-2.0 AND MIT"
 
+[[licensing.licenses]]
+path = "vendor/github.com/oasdiff/yaml/LICENSE"
+sha256sum = "24653fd8a39354396da1a265d68316399edc39b1df48c5866d55f9f06484fa9a"
+expression = "MIT AND BSD-3-Clause"
+
+[[licensing.licenses]]
+path = "vendor/github.com/oasdiff/yaml3/LICENSE"
+sha256sum = "d18f6323b71b0b768bb5e9616e36da390fbd39369a81807cca352de4e4e6aa0b"
+expression = "Apache-2.0 AND MIT"

go.mod

@@ -9,7 +9,7 @@ require (
 	github.com/jackc/pgx/v5 v5.7.6
 	github.com/mattn/go-sqlite3 v1.14.32
 	github.com/mitchellh/mapstructure v1.5.0
-	github.com/oapi-codegen/runtime v1.1.2
+	github.com/oapi-codegen/runtime v1.2.0
 	github.com/spf13/cobra v1.9.1
 	github.com/spf13/viper v1.20.1
 	golang.org/x/time v0.11.0
@@ -38,7 +38,7 @@ require (
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
 	github.com/neilotoole/jsoncolor v0.7.1 // indirect
-	github.com/oapi-codegen/oapi-codegen/v2 v2.5.1 // indirect
+	github.com/oapi-codegen/oapi-codegen/v2 v2.6.0 // indirect
 	github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 // indirect
 	github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.3 // indirect

go.sum

@@ -105,10 +105,10 @@ github.com/nwidger/jsoncolor v0.3.2/go.mod h1:Cs34umxLbJvgBMnVNVqhji9BhoT/N/KinH
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
-github.com/oapi-codegen/oapi-codegen/v2 v2.5.1 h1:5vHNY1uuPBRBWqB2Dp0G7YB03phxLQZupZTIZaeorjc=
-github.com/oapi-codegen/oapi-codegen/v2 v2.5.1/go.mod h1:ro0npU1BWkcGpCgGD9QwPp44l5OIZ94tB3eabnT7DjQ=
-github.com/oapi-codegen/runtime v1.1.2 h1:P2+CubHq8fO4Q6fV1tqDBZHCwpVpvPg7oKiYzQgXIyI=
-github.com/oapi-codegen/runtime v1.1.2/go.mod h1:SK9X900oXmPWilYR5/WKPzt3Kqxn/uS/+lbpREv+eCg=
+github.com/oapi-codegen/oapi-codegen/v2 v2.6.0 h1:4i+F2cvwBFZeplxCssNdLy3MhNzUD87mI3HnayHZkAU=
+github.com/oapi-codegen/oapi-codegen/v2 v2.6.0/go.mod h1:eWHeJSohQJIINJZzzQriVynfGsnlQVh0UkN2UYYcw4Q=
+github.com/oapi-codegen/runtime v1.2.0 h1:RvKc1CVS1QeKSNzO97FBQbSMZyQ8s6rZd+LpmzwHMP4=
+github.com/oapi-codegen/runtime v1.2.0/go.mod h1:Y7ZhmmlE8ikZOmuHRRndiIm7nf3xcVv+YMweKgG1DT0=
 github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 h1:G7ERwszslrBzRxj//JalHPu/3yz+De2J+4aLtSRlHiY=
 github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037/go.mod h1:2bpvgLBZEtENV5scfDFEtB/5+1M4hkQhDQrccEJ/qGw=
 github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 h1:bQx3WeLcUWy+RletIKwUIt4x3t8n2SxavmoclizMb8c=
@@ -173,8 +173,8 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/ugorji/go/codec v1.2.11 h1:BMaWp1Bb6fHwEtbplGBGJ498wD+LKlNSl25MjdZY4dU=
-github.com/ugorji/go/codec v1.2.11/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
+github.com/ugorji/go/codec v1.2.12 h1:9LC83zGrHhuUA9l16C9AHXAqEV/2wBQ4nkvumAE65EE=
+github.com/ugorji/go/codec v1.2.12/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
 github.com/vmware-labs/yaml-jsonpath v0.3.2 h1:/5QKeCBGdsInyDCyVNLbXyilb61MXGi9NP674f9Hobk=
 github.com/vmware-labs/yaml-jsonpath v0.3.2/go.mod h1:U6whw1z03QyqgWdgXxvVnQ90zN1BWz5V+51Ewf8k+rQ=
 github.com/woodsbury/decimal128 v1.3.0 h1:8pffMNWIlC0O5vbyHWFZAt5yWvWcrHA+3ovIIjVWss0=