From 49a2b99ef5292fd48e26a62bd2e87684fdf4e3a1 Mon Sep 17 00:00:00 2001
From: Armel Soro <asoro@redhat.com>
Date: Tue, 6 Oct 2026 13:35:30 +0200
Subject: [PATCH 1/4] ci: upload unit test coverage to Codecov

Add codecov.yml configuration and upload steps to the PR test workflow.
Coverage checks are informational only and will not block merges.

Changes:
- Makefile: add -coverprofile=cover.out to the test target
- codecov.yml: project/patch status as informational, unittests flag
  with carryforward, ignore non-source directories
- codecov-checks.yaml: new workflow to validate codecov.yml against the
  Codecov API
- test.yaml: upload cover.out after make test using
  codecov/codecov-action v6
- .gitignore: add cover.out

Assisted-by: Claude
---
 .github/workflows/codecov-checks.yaml | 63 +++++++++++++++++++++++++++
 .github/workflows/test.yaml           | 10 +++++
 .gitignore                            |  1 +
 Makefile                              |  2 +-
 codecov.yml                           | 29 ++++++++++++
 5 files changed, 104 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/codecov-checks.yaml
 create mode 100644 codecov.yml

diff --git a/.github/workflows/codecov-checks.yaml b/.github/workflows/codecov-checks.yaml
new file mode 100644
index 00000000..20fadece
--- /dev/null
+++ b/.github/workflows/codecov-checks.yaml
@@ -0,0 +1,63 @@
+name: Codecov Config Checks
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - codecov.yml
+      - .github/workflows/codecov-checks.yaml
+  pull_request:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Validate Codecov Config
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Get changed files
+        if: github.event_name == 'pull_request'
+        id: changed-files
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
+        with:
+          files: |
+            codecov.yml
+            .github/workflows/codecov-checks.yaml
+
+      - name: Validate codecov.yml
+        if: github.event_name != 'pull_request' || steps.changed-files.outputs.any_changed == 'true'
+        run: |
+          response=$(curl -s -w "\n%{http_code}" --retry 3 --retry-delay 5 \
+            -X POST \
+            --data-binary @codecov.yml \
+            https://codecov.io/validate)
+
+          http_code=$(echo "$response" | tail -n1)
+          body=$(echo "$response" | sed '$d')
+
+          echo "HTTP Status: ${http_code}"
+          echo "Response: ${body}"
+
+          if [ "$http_code" -eq 400 ]; then
+            echo "::error::Invalid codecov.yml configuration"
+            exit 1
+          elif [ "$http_code" -ne 200 ]; then
+            echo "::warning::Could not validate codecov.yml (HTTP ${http_code}). Transient issue?"
+            exit 1
+          fi
+
+          echo "codecov.yml is valid"
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 9bc758ac..ffd796fa 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -49,6 +49,16 @@ jobs:
         if: steps.changed-files.outputs.any_changed == 'true'
         run: make test
 
+      - name: Upload coverage to Codecov
+        if: steps.changed-files.outputs.any_changed == 'true'
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6
+        with:
+          files: cover.out
+          flags: unittests
+          fail_ci_if_error: false
+          override_commit: ${{ github.event.pull_request.head.sha }}
+          override_pr: ${{ github.event.number }}
+
       - name: Run lint
         if: steps.changed-files.outputs.any_changed == 'true'
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
diff --git a/.gitignore b/.gitignore
index 90a08359..20582611 100644
--- a/.gitignore
+++ b/.gitignore
@@ -44,5 +44,6 @@ rhdh-must-gather-output.tar.gz
 
 # Go
 *.test
+cover.out
 coverage.out
 
diff --git a/Makefile b/Makefile
index 93013e9a..13c7b5b8 100644
--- a/Makefile
+++ b/Makefile
@@ -75,7 +75,7 @@ endif
 
 .PHONY: test
 test: ## Run unit tests
-	$(GO) test -mod=mod ./... -v -count=1
+	$(GO) test -mod=mod ./... -v -count=1 -coverprofile=cover.out
 
 .PHONY: lint
 lint: ## Run linter (golangci-lint)
diff --git a/codecov.yml b/codecov.yml
new file mode 100644
index 00000000..428764a3
--- /dev/null
+++ b/codecov.yml
@@ -0,0 +1,29 @@
+coverage:
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 1%
+        informational: true
+    patch:
+      default:
+        target: auto
+        threshold: 5%
+        informational: true
+
+comment:
+  layout: "reach, diff, flags, files"
+  behavior: default
+
+flags:
+  unittests:
+    paths:
+      - cmd/
+      - internal/
+    carryforward: true
+
+ignore:
+  - tests/
+  - hack/
+  - scripts/
+  - cmd/gather/main.go

From dfe748d70ace219c790da04c3d9e330e3f698233 Mon Sep 17 00:00:00 2001
From: Armel Soro <asoro@redhat.com>
Date: Tue, 6 Oct 2026 14:01:31 +0200
Subject: [PATCH 2/4] ci: add unit tests and lint to nightly workflow

Add lint and unit-tests jobs to the nightly workflow. They run as
separate jobs so a lint failure does not block test execution or
coverage upload. Unit tests upload coverage to Codecov with the nightly
flag across all release branches.

The release-1.10 branch is bash-based: it is excluded from the lint
job (no golangci-lint config) and its Codecov upload step is skipped
(its Makefile does not produce cover.out).

Renamed the workflow from "Nightly E2E Tests" to "Nightly Tests" to
reflect the broader scope.

Assisted-by: Claude
---
 .github/workflows/nightly.yaml | 68 +++++++++++++++++++++++++++++++++-
 1 file changed, 67 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index d72382de..2b2a22cd 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -1,4 +1,4 @@
-name: Nightly E2E Tests
+name: Nightly Tests
 
 on:
   schedule:
@@ -9,6 +9,72 @@ permissions:
   contents: read
 
 jobs:
+  lint:
+    name: Lint (${{ matrix.branch }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        branch:
+          - main
+          # release-1.10 is bash-based and has no golangci-lint config
+          - release-2.1
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ matrix.branch }}
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+        with:
+          go-version-file: go.mod
+
+      - name: Run lint
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
+        with:
+          version: v2.14.0
+
+  unit-tests:
+    name: Unit Tests (${{ matrix.branch }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        branch:
+          - main
+          - release-1.10
+          - release-2.1
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ matrix.branch }}
+          fetch-depth: 0
+
+      - name: Capture commit SHA
+        run: echo "COMMIT_SHA=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+        with:
+          go-version-file: go.mod
+
+      - name: Run tests
+        run: make test
+
+      # release-1.10 is bash-based; its Makefile does not produce cover.out
+      - name: Upload coverage to Codecov
+        if: matrix.branch != 'release-1.10'
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6
+        with:
+          files: cover.out
+          flags: unittests,nightly
+          fail_ci_if_error: false
+          override_commit: ${{ env.COMMIT_SHA }}
+          override_branch: ${{ matrix.branch }}
+
   e2e-tests:
     name: Nightly E2E Tests (${{ matrix.branch }})
     runs-on: ubuntu-latest

From fe70feec3ba6b8e371e4939c69369f0e27c20e62 Mon Sep 17 00:00:00 2001
From: Armel Soro <asoro@redhat.com>
Date: Tue, 6 Oct 2026 14:03:27 +0200
Subject: [PATCH 3/4] ci: add nightly flag definition to codecov.yml

The nightly workflow uploads coverage with the 'nightly' flag, but
codecov.yml only defined 'unittests'. Add a 'nightly' flag entry with
the same source paths and carryforward enabled so Codecov tracks
nightly coverage correctly.

Assisted-by: Claude
---
 codecov.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/codecov.yml b/codecov.yml
index 428764a3..8798ee3f 100644
--- a/codecov.yml
+++ b/codecov.yml
@@ -21,6 +21,11 @@ flags:
       - cmd/
       - internal/
     carryforward: true
+  nightly:
+    paths:
+      - cmd/
+      - internal/
+    carryforward: true
 
 ignore:
   - tests/

From 758817ebed7dbc3d1b412a2b55b11e4f1a7486d4 Mon Sep 17 00:00:00 2001
From: Armel Soro <asoro@redhat.com>
Date: Tue, 6 Oct 2026 14:05:08 +0200
Subject: [PATCH 4/4] ci: trigger codecov-checks on release branches

The codecov-checks workflow only triggered on main, so changes to
codecov.yml on release branches or PRs targeting them would not be
validated. Add the release branch pattern to both push and
pull_request triggers, matching test.yaml.

Assisted-by: Claude
---
 .github/workflows/codecov-checks.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/codecov-checks.yaml b/.github/workflows/codecov-checks.yaml
index 20fadece..8c9b77bf 100644
--- a/.github/workflows/codecov-checks.yaml
+++ b/.github/workflows/codecov-checks.yaml
@@ -4,12 +4,14 @@ on:
   push:
     branches:
       - main
+      - 'release-[0-9]+.[0-9]+'
     paths:
       - codecov.yml
       - .github/workflows/codecov-checks.yaml
   pull_request:
     branches:
       - main
+      - 'release-[0-9]+.[0-9]+'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.number || github.ref }}