⬆️ Update python:3.14-slim Docker digest to a7fb1e6 #2065
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Coverage | |
| # yamllint disable-line rule:truthy | |
| on: | |
| push: | |
| pull_request: | |
| workflow_dispatch: | |
| # Cancel superseded runs for the same ref to save CI minutes. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| # Default to read-only; the job below opts into the one write scope it needs. | |
| permissions: | |
| contents: read | |
| jobs: | |
| coverage: | |
| name: Rust coverage via pytest | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # Read the repository (checkout, cargo). | |
| contents: read | |
| # Publish the coverage report to GitHub code quality (required by | |
| # actions/upload-code-coverage; the action cannot declare this itself). | |
| # `code-quality` is a current GitHub permission that actionlint and zizmor | |
| # do not recognize yet, hence the targeted suppressions for this scope. | |
| code-quality: write # zizmor: ignore[excessive-permissions] | |
| steps: | |
| - name: ⤵️ Check out code (with config submodules) | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| submodules: true | |
| - name: 🏗 Set up uv and Python | |
| uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| with: | |
| enable-cache: true | |
| python-version: "3.13" | |
| - name: 🏗 Set up Rust | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # zizmor: ignore[superfluous-actions,stale-action-refs,impostor-commit] stable; canonical pinned Rust toolchain installer | |
| with: | |
| components: llvm-tools-preview | |
| - name: 🏗 Install dependencies | |
| # numpy keeps the OPT_SERIALIZE_NUMPY path inside the coverage numbers; | |
| # proptest adds Hypothesis so the property tests run (and count) here. | |
| run: uv sync --locked --no-install-project --no-default-groups --group build --group test --group numpy --group proptest | |
| - name: 🏗 Install cargo-llvm-cov | |
| # Pin the tool version (not just its locked deps) so coverage runs are | |
| # reproducible across CI. Bump this deliberately. | |
| run: cargo install cargo-llvm-cov --version =0.8.7 --locked | |
| - name: 🏗 Set up coverage environment | |
| # show-env emits shell `export KEY='VALUE'` lines. Drop the `export ` | |
| # prefix and the surrounding single quotes so the raw values persist | |
| # into later steps via $GITHUB_ENV (quotes would be taken literally | |
| # there, corrupting RUSTFLAGS and the profile path). | |
| run: > | |
| cargo llvm-cov show-env --sh | |
| | sed -E "s/^export //; s/^([^=]+)='(.*)'$/\1=\2/" >> "$GITHUB_ENV" | |
| - name: 🧹 Clean coverage data | |
| run: cargo llvm-cov clean --workspace | |
| - name: 🚀 Run the Rust unit tests (instrumented) | |
| run: cargo test --locked --lib | |
| - name: 🏗 Build and install yamlrocks (instrumented) | |
| run: uv run --no-sync maturin develop --locked | |
| - name: 🚀 Run pytest to exercise the Rust core | |
| # The llvm-cov-instrumented build carries far more baseline memory than | |
| # the normal extension (per-region counters, larger code, profile | |
| # buffers), so the default address-space guard in `tests/conftest.py` | |
| # (1536 MiB, tuned for the uninstrumented suite) is too tight here: the | |
| # process high-water creeps up across the full run and a large | |
| # real-world round-trip then fails to allocate, which under | |
| # `panic = "abort"` shows up as `Fatal Python error: Aborted`. Give the | |
| # instrumented run generous headroom; the guard still catches a true | |
| # runaway well below the 16 GiB runner. | |
| env: | |
| YAMLROCKS_AS_LIMIT_MIB: "8192" | |
| run: uv run --no-sync python -m pytest | |
| - name: 📊 Generate Cobertura coverage report | |
| run: cargo llvm-cov report --cobertura --output-path coverage.xml | |
| - name: 📤 Upload coverage to Codecov | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| with: | |
| files: ./coverage.xml | |
| - name: 📤 Upload coverage to GitHub | |
| uses: actions/upload-code-coverage@1c15be36fc3733ba839b1dd643bd9556e4426dc1 # v1.4.1 | |
| with: | |
| file: ./coverage.xml | |
| label: code-coverage/pytest | |
| # The GitHub-native code-coverage feature is opt-in per repository; | |
| # until it is enabled the endpoint 404s, so do not fail CI on it. | |
| fail-on-error: false | |
| - name: ✅ Enforce coverage floor | |
| run: cargo llvm-cov report --summary-only --fail-under-lines 90 |