Update CI coverage actions #183
Conversation
Reviewer's GuideReplaces manual cargo-tarpaulin and CodeScene CLI steps with centralized GitHub actions for coverage collection ( File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Summary by CodeRabbit
Summary by CodeRabbit
WalkthroughThe CI workflow was updated to use reusable GitHub Actions for code coverage generation and upload, replacing manual installation and execution steps. Documentation was revised to reflect the switch from Changes
Sequence Diagram(s)sequenceDiagram
participant GitHub Actions
participant ratchet-coverage Action
participant upload-codescene-coverage Action
participant Codecov
participant CodeScene
GitHub Actions->>ratchet-coverage Action: Run coverage (cargo llvm-cov)
ratchet-coverage Action-->>GitHub Actions: Produce lcov.info
GitHub Actions->>Codecov: Upload lcov.info
GitHub Actions->>upload-codescene-coverage Action: Upload lcov.info
upload-codescene-coverage Action->>CodeScene: Send coverage data
Possibly related PRs
Suggested reviewers
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🧰 Additional context used🪛 GitHub Check: CodeQL.github/workflows/ci.yml[warning] 45-45: Unpinned tag for a non-immutable Action in workflow [warning] 50-50: Unpinned tag for a non-immutable Action in workflow ✨ Finishing Touches🧪 Generate Unit Tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![codescene-delta-analysis[bot]](https://avatars.githubusercontent.com/in/53921?s=60&v=4){kind=small}
There was a problem hiding this comment.
Gates Passed
See analysis details in CodeScene
Quality Gate Profile: Pay Down Tech Debt
Want more control? Customize Code Health rules or catch issues early with our IDE extension and CLI tool.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey @leynos - I've reviewed your changes - here's some feedback:
- Pin the shared actions to immutable SHA digests instead of loose version tags to ensure reproducible CI runs.
- In your docs, explicitly note whether
ratchet-coverageusescargo llvm-covorcargo-tarpaulinto avoid confusion about the underlying coverage tool. - Confirm that passing
installer-checksumtoupload-codescene-coveragestill performs the expected integrity check now that the install script is handled by the action itself.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Pin the shared actions to immutable SHA digests instead of loose version tags to ensure reproducible CI runs.
- In your docs, explicitly note whether `ratchet-coverage` uses `cargo llvm-cov` or `cargo-tarpaulin` to avoid confusion about the underlying coverage tool.
- Confirm that passing `installer-checksum` to `upload-codescene-coverage` still performs the expected integrity check now that the install script is handled by the action itself.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/ci.yml(1 hunks)docs/multi-layered-testing-strategy.md(1 hunks)
🧰 Additional context used
📓 Path-based instructions (7)
`docs/**/*.md`: Documentation must use en-GB-oxendict spelling and grammar (with the exception of "license" which is to be left unchanged for community consistency).
docs/**/*.md: Documentation must use en-GB-oxendict spelling and grammar (with the exception of "license" which is to be left unchanged for community consistency).
📄 Source: CodeRabbit Inference Engine (AGENTS.md)
List of files the instruction was applied to:
docs/multi-layered-testing-strategy.md
`**/*.md`: Validate Markdown files using `markdownlint *.md **/*.md`. Run `mdfor...
**/*.md: Validate Markdown files usingmarkdownlint *.md **/*.md.
Runmdformat-allafter any documentation changes to format all Markdown files and fix table markup.
Validate Markdown Mermaid diagrams using thenixieCLI. The tool is already installed; runnixie *.md **/*.mddirectly instead of usingnpx.
Markdown paragraphs and bullet points must be wrapped at 80 columns.
Code blocks must be wrapped at 120 columns.
Tables and headings must not be wrapped.
📄 Source: CodeRabbit Inference Engine (AGENTS.md)
List of files the instruction was applied to:
docs/multi-layered-testing-strategy.md
`docs/**/*.md`: Provide user guides and examples demonstrating server-initiated messaging.
docs/**/*.md: Provide user guides and examples demonstrating server-initiated messaging.
📄 Source: CodeRabbit Inference Engine (docs/asynchronous-outbound-messaging-roadmap.md)
List of files the instruction was applied to:
docs/multi-layered-testing-strategy.md
`docs/**/*.md`: Conventions for writing project documentation should follow the rules outlined in the documentation style guide.
docs/**/*.md: Conventions for writing project documentation should follow the rules outlined in the documentation style guide.
📄 Source: CodeRabbit Inference Engine (docs/contents.md)
List of files the instruction was applied to:
docs/multi-layered-testing-strategy.md
`docs/**/*.md`: Use British English based on the Oxford English Dictionary (en-o...
docs/**/*.md: Use British English based on the Oxford English Dictionary (en-oxendict) for documentation.
The word "outwith" is acceptable in documentation.
Keep US spelling when used in an API, for examplecolor.
Use the Oxford comma in documentation.
Company names are treated as collective nouns (e.g., "Lille Industries are expanding").
Write headings in sentence case in documentation.
Use Markdown headings (#,##,###, etc.) in order without skipping levels.
Follow markdownlint recommendations for Markdown files.
Provide code blocks and lists using standard Markdown syntax.
Always use fenced code blocks with a language identifier; useplaintextfor non-code text.
Use-as the first level bullet and renumber lists when items change.
Prefer inline links using[text](url)or angle brackets around the URL in Markdown.
Expand any uncommon acronym on first use, for example, Continuous Integration (CI).
Wrap paragraphs at 80 columns in documentation.
Wrap code at 120 columns in documentation.
Do not wrap tables in documentation.
Use footnotes referenced with[^label]in documentation.
Include Mermaid diagrams in documentation where it adds clarity.
When embedding figures in documentation, useand provide concise alt text describing the content.
Add a short description before each Mermaid diagram in documentation so screen readers can understand it.
📄 Source: CodeRabbit Inference Engine (docs/documentation-style-guide.md)
List of files the instruction was applied to:
docs/multi-layered-testing-strategy.md
`docs/**/*.md`: Write the official documentation for the new features. Create se...
docs/**/*.md: Write the official documentation for the new features. Create separate guides for "Duplex Messaging & Pushes", "Streaming Responses", and "Message Fragmentation". Each guide must include runnable examples and explain the relevant concepts and APIs.
📄 Source: CodeRabbit Inference Engine (docs/wireframe-1-0-detailed-development-roadmap.md)
List of files the instruction was applied to:
docs/multi-layered-testing-strategy.md
`**/*.md`: * Avoid 2nd person or 1st person pronouns ("I", "you", "we") * Use en...
**/*.md: * Avoid 2nd person or 1st person pronouns ("I", "you", "we")
- Use en-oxendic spelling and grammar.
- Paragraphs and bullets must be wrapped to 80 columns, except where a long URL would prevent this (in which case, silence MD013 for that line)
- Code blocks should be wrapped to 120 columns.
- Headings must not be wrapped.
⚙️ Source: CodeRabbit Configuration File
List of files the instruction was applied to:
docs/multi-layered-testing-strategy.md
🪛 GitHub Check: CodeQL
.github/workflows/ci.yml
[warning] 45-45: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'CI' step Uses Step: coverage uses 'leynos/shared-actions/.github/actions/ratchet-coverage' with ref 'v1.2.0', not a pinned commit hash
[warning] 50-50: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'CI' step Uses Step uses 'leynos/shared-actions/.github/actions/upload-codescene-coverage' with ref 'v1.2.0', not a pinned commit hash
⏰ Context from checks skipped due to timeout of 240000ms (1)
- GitHub Check: build-test
| id: coverage | ||
| uses: leynos/shared-actions/.github/actions/ratchet-coverage@v1.2.0 | ||
| with: | ||
| args: --workspace --lcov --output-path lcov.info | ||
| - name: Upload coverage data to CodeScene | ||
| if: env.CS_ACCESS_TOKEN | ||
| run: cs-coverage upload --format "lcov" --metric "line-coverage" "lcov.info" | ||
| uses: leynos/shared-actions/.github/actions/upload-codescene-coverage@v1.2.0 | ||
| with: | ||
| format: lcov | ||
| access-token: ${{ env.CS_ACCESS_TOKEN }} | ||
| installer-checksum: ${{ env.CODESCENE_CLI_SHA256 }} | ||
| - name: Upload coverage data to Codecov |
There was a problem hiding this comment.
Pin third-party Actions to immutable commit SHAs.
ratchet-coverage@v1.2.0 and upload-codescene-coverage@v1.2.0 reference moving tags.
CodeQL has already flagged this. Unpinned Actions are a supply-chain risk and can
silently change behaviour.
Proposed fix:
- uses: leynos/shared-actions/.github/actions/ratchet-coverage@v1.2.0
+ # TODO: replace with the exact commit SHA corresponding to v1.2.0
+ uses: leynos/shared-actions/.github/actions/ratchet-coverage@<commit-sha>
...
- uses: leynos/shared-actions/.github/actions/upload-codescene-coverage@v1.2.0
+ # TODO: replace with the exact commit SHA corresponding to v1.2.0
+ uses: leynos/shared-actions/.github/actions/upload-codescene-coverage@<commit-sha>Committable suggestion skipped: line range outside the PR's diff.
🧰 Tools
🪛 GitHub Check: CodeQL
[warning] 45-45: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'CI' step Uses Step: coverage uses 'leynos/shared-actions/.github/actions/ratchet-coverage' with ref 'v1.2.0', not a pinned commit hash
[warning] 50-50: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'CI' step Uses Step uses 'leynos/shared-actions/.github/actions/upload-codescene-coverage' with ref 'v1.2.0', not a pinned commit hash
🤖 Prompt for AI Agents
In .github/workflows/ci.yml around lines 44 to 55, the GitHub Actions use
version tags like v1.2.0 for third-party actions, which are mutable and pose a
supply-chain risk. To fix this, replace the version tags with immutable commit
SHAs for both ratchet-coverage and upload-codescene-coverage actions to ensure
the workflow uses a fixed, verified version of these actions.
There was a problem hiding this comment.
Gates Passed
See analysis details in CodeScene
Quality Gate Profile: Pay Down Tech Debt
Want more control? Customize Code Health rules or catch issues early with our IDE extension and CLI tool.
There was a problem hiding this comment.
Gates Passed
See analysis details in CodeScene
Quality Gate Profile: Pay Down Tech Debt
Want more control? Customize Code Health rules or catch issues early with our IDE extension and CLI tool.
| bash install-cs-coverage-tool.sh -y | ||
| rm install-cs-coverage-tool.sh | ||
| id: coverage | ||
| uses: leynos/shared-actions/.github/actions/ratchet-coverage@v1.2.1 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
| - name: Upload coverage data to CodeScene | ||
| if: env.CS_ACCESS_TOKEN | ||
| run: cs-coverage upload --format "lcov" --metric "line-coverage" "lcov.info" | ||
| uses: leynos/shared-actions/.github/actions/upload-codescene-coverage@v1.2.1 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
1 participant
Summary
ratchet-coverageaction for coverageupload-codescene-coverageactionTesting
make fmtmake lintmake testmarkdownlint *.md **/*.mdmdformat-allnixie *.md **/*.md(fails: RuntimeError: Event loop is closed)https://chatgpt.com/codex/tasks/task_e_6869243cbb0483229d3ae9c1dae7deb7
Summary by Sourcery
Consolidate CI coverage steps by adopting shared GitHub Actions for coverage measurement and CodeScene uploads, and update project docs to reflect the new coverage pipeline.
CI:
ratchet-coverageaction with lcov outputupload-codescene-coverageactionDocumentation:
cargo llvm-cov,ratchet-coverage, andupload-codescene-coverageworkflows