test-with-coverage.yaml

name: Test with Code Coverage

on:
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read
  issues: read
  checks: write
  pull-requests: write

env:
  CARGO_TERM_COLOR: always

jobs:
  test:
    name: Test
    env:
      PROJECT_NAME_UNDERSCORE: test2
      CARGO_INCREMENTAL: 0
      RUSTFLAGS: -Ccodegen-units=1 -Copt-level=0 -Clink-dead-code -Coverflow-checks=off -Zpanic_abort_tests -Cpanic=abort
      RUSTDOCFLAGS: -Cpanic=abort
    runs-on: ubuntu-latest

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.deps.dev:443
            api.github.com:443
            api.osv.dev:443
            api.scorecard.dev:443
            fulcio.sigstore.dev:443
            github.com:443
            oss-fuzz-build-logs.storage.googleapis.com:443
            rekor.sigstore.dev:443
            tuf-repo-cdn.sigstore.dev:443
            www.bestpractices.dev:443
            objects.githubusercontent.com:443
            static.rust-lang.org:443
            static.crates.io:443
            index.crates.io:443
            just.systems:443
            taskfile.dev:443

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - uses: dtolnay/rust-toolchain@315e265cd78dad1e1dcf3a5074f6d6c47029d5aa # nightly
        with:
          toolchain: nightly
          components: llvm-tools-preview

      - name: Cache dependencies
        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
        env:
          cache-name: cache-dependencies
        with:
          path: |
            ~/.cargo/.crates.toml
            ~/.cargo/.crates2.json
            ~/.cargo/bin
            ~/.cargo/registry/index
            ~/.cargo/registry/cache
            target
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('Cargo.lock') }}

      - name: Install grcov
        uses: taiki-e/install-action@6da51af62171044932d435033daa70a0eb3383ba # v2.45.6
        with:
          tool: grcov,cargo-llvm-cov

      - name: Install dependencies
        run: |
          curl --proto '=https' --tlsv1.3 -sSf https://just.systems/install.sh | bash -s -- --to /usr/local/bin
          sh -c "$(curl --location https://taskfile.dev/install.sh)" -- -d && mv bin/task /usr/local/bin/

      - name: Run tests
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          task test

      - name: Generate test results and coverage report
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          cargo clean
          cargo test $CARGO_OPTIONS -- -Z unstable-options --format json | cargo2junit > results.xml;
          cargo llvm-cov --all-features --workspace --codecov --output-path ./codecov.json

      - name: Upload test results
        uses: EnricoMi/publish-unit-test-result-action@170bf24d20d201b842d7a52403b73ed297e6645b # v2.18.0
        with:
          check_name: Test Results
          github_token: ${{ secrets.GITHUB_TOKEN }}
          files: results.xml

      - name: Run xtask coverage
        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          command: xtask
          args: coverage

      #- name: Upload Coverage Report
      #  uses: codecov/codecov-action@v5
      #  with:
      #    verbose: true
      #    token: ${{ secrets.CODECOV_TOKEN }}
      #    files: ${{ github.workspace }}/codecov.json

      #  - name: Upload to codecov.io
      #    uses: codecov/codecov-action@v5
      #    with:
      #      files: coverage/*.lcov
      #    fail_ci_if_error: true