coverage.yml

name: Code Coverage Assessment
# Run in addition to unit tests without coverage assessment in case of weirdness around
# parallelised code. Also regenerates coverage badge.

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - "**"
    paths:
      - 'benchmark/**/*.py'
      - 'coreax/**/*.py'
      - 'examples/**/*.py'
      - 'tests/**/*.py'
      - 'uv.lock'
      - 'pyproject.toml'

permissions:
  contents: read

jobs:
  coverage:
    runs-on: ubuntu-latest
    env:
      # Disable implicitly syncing before running - we run an explicit sync first.
      UV_NO_SYNC: true
    outputs:
      percentage_int: ${{ steps.cov.outputs.percentage_int }}
      percentage_float: ${{ steps.cov.outputs.percentage_float }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
      - name: Set up uv
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
        with:
          version: "latest"
          python-version: 3.14
          enable-cache: true
      - name: Install test dependencies
        run: uv sync --group test --no-dev --locked
      - name: Debug - uv pip freeze
        run: uv pip freeze
      - name: Assess coverage of unit tests
        run: uv run pytest tests/unit -n auto --dist worksteal --cov
      - name: Extract total coverage percentage
        id: cov
        run: |
          echo "percentage_int=$( uv run coverage report --format=total )" >> $GITHUB_OUTPUT
          echo "percentage_float=$( uv run coverage report --format=total --precision=8 )" >> $GITHUB_OUTPUT
          cat $GITHUB_OUTPUT
      - name: Check out metadata repo
        if: github.event_name == 'pull_request'
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          repository: gchq/coreax-metadata
          # GitHub Actions require check out destination to be within coreax/coreax. To
          # save checking out the main repo into coreax/coreax/coreax, check out the
          # metadata repo to a nested location inside coreax/coreax. Pick a folder name
          # that is very unlikely to clash with any current or future folder name
          # committed to the main coreax repo.
          path: tmp_coreax-metadata
      - name: Check for reduction in coverage
        if: github.event_name == 'pull_request'
        env:
          HISTORIC: tmp_coreax-metadata/coverage
        run: |
          # Create directory if it doesn't exist yet
          mkdir -p $HISTORIC
          uv run tests/coverage/compare.py \
            ${{ steps.cov.outputs.percentage_float }} \
            $HISTORIC

  coverage-badge:
    name: Update coverage badge
    # Keep as a separate job to avoid clashes between meta and main repos
    if: github.event_name == 'push'
    # Push coverage badge config to coreax-metadata repo.
    needs:
      - coverage
    env:
      percentage_int: ${{ needs.coverage.outputs.percentage_int }}
      percentage_float: ${{ needs.coverage.outputs.percentage_float }}
    runs-on: ubuntu-latest
    steps:
      - name: Generate a GitHub token
        id: generate-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
        with:
          app-id: ${{ vars.WRITE_CONTENTS_PR_APP }}
          private-key: ${{ secrets.WRITE_CONTENTS_PR_KEY }}
          repositories: coreax-metadata
      - name: Check out metadata repo
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          repository: gchq/coreax-metadata
      - name: Generate high-precision coverage JSON
        run: |
          echo "{\"total\": ${{ env.percentage_float }}}" > $RUNNER_TEMP/coverage.json
      - name: Save high-precision coverage data
        env:
          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
        run: |
          export message="chore: update precise coverage data for $GITHUB_SHA"
          export content=$( base64 -i $RUNNER_TEMP/coverage.json )
          OUT_NAME="coverage/coverage-$(date --utc +%Y-%m-%d--%H-%M-%S)--$GITHUB_SHA--v1.json"
          gh api --method PUT \
            /repos/:owner/coreax-metadata/contents/$OUT_NAME \
            -f message="$message" \
            -f content="$content"
      - name: Choose badge colour
        id: design
        run: |
          echo "colour=${{
            env.percentage_int >= 90 && 'brightgreen' ||
            env.percentage_int >= 70 && 'yellow' ||
            env.percentage_int >= 50 && 'orange' ||
            'red'
          }}" >> $GITHUB_OUTPUT
      - name: Generate badge config JSON
        # Display an integer percentage
        run: |
          echo "coverage = ${{ env.percentage_int }}%"
          echo "colour = ${{ steps.design.outputs.colour }}"
          {
            echo "{"
            echo "  \"schemaVersion\": 1,"
            echo "  \"label\": \"Coverage\","
            echo "  \"message\": \"${{ env.percentage_int }}%\","
            echo "  \"color\": \"${{ steps.design.outputs.colour }}\""
            echo "}"
          } > $RUNNER_TEMP/badge.json
      - name: Commit badge (with signature)
        # If another workflow is running in parallel, a race condition may occur. Try to
        # push the updated badge three times before failing.
        # Disable fail fast on shell and ensure script always returns an exit code.
        shell: bash {0}
        env:
          BADGE_PATH: coverage/coreax_coverage.json
          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
        run: |
          export message="chore: update coverage badge for $GITHUB_SHA"
          export content=$( base64 -i $RUNNER_TEMP/badge.json )
          # Create new file if does not exist yet (or did not exist at checkout)
          if [ ! -f $BADGE_PATH ]; then
            gh api --method PUT /repos/:owner/coreax-metadata/contents/$BADGE_PATH \
              -f message="$message" \
              -f content="$content"
            if [ $? -eq 0 ]; then
              echo "Coverage badge created."
              exit 0
            fi
            # Failed to create, probably because a file of this name now exists, so
            # continue
          fi
          # Update existing file, trying 3 times in case another job updates the
          # coverage badge almost concurrently, which invalidates old SHA
          for i in {1..3}; do
            # Check whether file has changed
            diff $BADGE_PATH $RUNNER_TEMP/badge.json
            if [ $? -eq 0 ]; then
              echo "Coverage badge unchanged."
              exit 0
            fi
            # Changed: replace existing file
            export sha=$( git rev-parse main:$BADGE_PATH )
            gh api --method PUT /repos/:owner/coreax-metadata/contents/$BADGE_PATH \
              -f message="$message" \
              -f content="$content" \
              -f sha="$sha"
            if [ $? -eq 0 ]; then
              echo "Coverage badge updated."
              exit 0
            fi
            # Failed: remote has probably updated, so pull latest again
            git pull
          done
          echo "Failed to update coverage badge after 3 attempts."
          exit 1