ci(coverage): authenticate Codecov upload with org CODECOV_TOKEN #68
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Calls the canonical plugin-ci reusable workflow (GetBusbar/busbar/.github/workflows/plugin-ci.yml) | |
| # instead of hand-copying build/test/signoff steps here — see that file for what actually runs, and | |
| # see webrequest-hook's / auth-oidc's own ci.yml for the sibling-repo convention this mirrors. | |
| # | |
| # This is the pull_request/push gate. release.yml fires on a `v*` tag and | |
| # docker.yml/docker-bundle.yml are tag-triggered or manual, none of which run tests, so without this | |
| # workflow a broken build could reach a real GitHub Release untested. | |
| # | |
| # busbar_ref is same-branch (`github.ref_name`), not a hard pin. A hard pin to `dev` would make the | |
| # qa gate lie: a push to this repo's `qa` would build core's `dev`, report green, and say nothing | |
| # about whether this plugin works against the core release qa is staging. Matches auth-github / | |
| # auth-ldap / auth-oidc / hashicorp-vault / store-mysql / store-postgres / webrequest-hook. | |
| name: ci | |
| on: | |
| push: | |
| branches: [main, dev, qa] | |
| pull_request: | |
| branches: [main, dev, qa] | |
| # Manual trigger. Needed because `gh run rerun` PINS the reusable-workflow SHA: | |
| # a rerun re-uses the plugin-ci.yml snapshot from the original run, so a fix landing in | |
| # core's reusable workflow can only be picked up by a NEW run, never by rerunning an old one. | |
| workflow_dispatch: {} | |
| jobs: | |
| ci: | |
| uses: GetBusbar/busbar/.github/workflows/plugin-ci.yml@dev | |
| with: | |
| plugin_crate: headroom-hook | |
| plugin_kind: hook | |
| plugin_alias: headroom | |
| service: none | |
| busbar_ref: ${{ github.base_ref || github.ref_name }} | |
| # base_ref FIRST: on a pull_request `github.ref_name` is '<number>/merge', not a branch | |
| # name, so this asked busbar for a branch called '5/merge' and the sibling checkout died | |
| # with an unreadable git error on EVERY pull request to this repo. | |
| # Same-branch intent is unchanged: qa builds core qa, dev builds core dev, never a | |
| # stale main or tag. | |
| # coverage — INFORMATIONAL ONLY, never a gate. Additive to the `ci` job above; the `ci` job stays | |
| # the sole correctness signal and this repo has no umbrella job, so `coverage` is not a required | |
| # context and nothing `needs:` it. It mirrors plugin-ci's build layout (this plugin's Cargo.toml | |
| # depends on a SIBLING `../busbarAI` checkout of the monorepo, so the plugin is checked out to | |
| # `plugin/` and busbar to `busbarAI/`), then instruments the plugin workspace with cargo-llvm-cov | |
| # and uploads lcov to Codecov tokenlessly. `service: none` for this hook, so no service containers. | |
| # | |
| # The `if:` copies core's coverage-tier convention: skip on a plain feature-branch push, run on | |
| # main/dev/qa pushes and on every pull_request / workflow_dispatch. This repo only pushes on | |
| # main/dev/qa today, so it is always-true here, but it is carried verbatim so the rule cannot drift | |
| # from the fleet. | |
| coverage: | |
| name: coverage (llvm-cov · codecov) | |
| runs-on: ubuntu-latest | |
| if: github.event_name != 'push' || contains(fromJSON('["refs/heads/main", "refs/heads/dev", "refs/heads/qa"]'), github.ref) | |
| steps: | |
| - name: Checkout the plugin | |
| uses: actions/checkout@v7 | |
| with: | |
| path: plugin | |
| # Sibling busbar checkout the plugin's `../busbarAI/...` path dependencies resolve against. | |
| # Same-branch intent as the `ci` job: base_ref FIRST so a pull_request's '<number>/merge' | |
| # ref never leaks into the checkout. | |
| - name: Checkout busbar (sibling path dependency) | |
| uses: actions/checkout@v7 | |
| with: | |
| repository: GetBusbar/busbar | |
| ref: ${{ github.base_ref || github.ref_name }} | |
| path: busbarAI | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: llvm-tools-preview | |
| - name: Cache cargo | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| # Both checkouts use `path:`, so neither Cargo workspace lives at the checkout root; the | |
| # action would otherwise find no Cargo.toml and silently cache nothing. See plugin-ci.yml. | |
| workspaces: | | |
| plugin | |
| busbarAI | |
| - name: Install cargo-llvm-cov | |
| uses: taiki-e/install-action@cargo-llvm-cov | |
| - name: Collect coverage (workspace) | |
| working-directory: plugin | |
| run: cargo llvm-cov --workspace --locked --ignore-run-fail --lcov --output-path lcov.info | |
| - name: Upload to Codecov (tokenless; never fails the build) | |
| uses: codecov/codecov-action@v5 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| files: plugin/lcov.info | |
| slug: GetBusbar/headroom-hook | |
| fail_ci_if_error: false |