coverage.yml

name: Coverage

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: coverage-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  coverage:
    name: Coverage
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      - name: Set up uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: true

      - name: Install dependencies
        run: uv sync --all-extras --frozen

      - name: Run tests with coverage
        id: tests
        # Use 'coverage run' instead of 'pytest --cov' so that coverage
        # starts BEFORE pytest loads plugins. rampart registers a pytest
        # plugin via the pytest11 entry point — if coverage starts after
        # plugin loading, all module-level code imported during plugin
        # setup is invisible to the tracer.
        run: uv run coverage run -m pytest tests/unit -q

      - name: Coverage summary
        if: ${{ steps.tests.outcome == 'success' }}
        run: |
          echo '## Coverage Report' >> $GITHUB_STEP_SUMMARY
          uv run coverage report --format=markdown --fail-under=0 >> $GITHUB_STEP_SUMMARY

      - name: Check coverage threshold
        if: ${{ steps.tests.outcome == 'success' }}
        # Threshold is defined in pyproject.toml [tool.coverage.report] fail_under
        run: uv run coverage report