matrix-authentication-service/.github/workflows/coverage.yaml

# Copyright 2025 New Vector Ltd.
#
# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
# Please see LICENSE files in the repository root for full details.

name: Coverage

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

env:
  CARGO_TERM_COLOR: always
  CARGO_NET_GIT_FETCH_WITH_CLI: "true"

jobs:
  opa:
    name: Run OPA test suite with coverage
    runs-on: ubuntu-24.04

    permissions:
      contents: read

    steps:
      - name: Checkout the code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - uses: ./.github/actions/build-policies

      - name: Run OPA tests with coverage
        working-directory: ./policies
        run: make coverage

      - name: Upload to codecov.io
        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: policies/coverage.json
          flags: policies

  frontend:
    name: Run frontend test suite with coverage
    runs-on: ubuntu-24.04

    permissions:
      id-token: write
      contents: read

    steps:
      - name: Checkout the code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - uses: ./.github/actions/build-frontend
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

      - name: Test
        working-directory: ./frontend
        run: npm run coverage

      - name: Upload to codecov.io
        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          directory: frontend/coverage/
          flags: frontend

  rust:
    name: Run Rust test suite with coverage
    runs-on: ubuntu-24.04

    permissions:
      contents: read

    env:
      SCCACHE_GHA_ENABLED: "true"
      RUSTC_WRAPPER: "sccache"

    services:
      postgres:
        image: docker.io/library/postgres:15.3
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: postgres
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - "5432:5432"

    steps:
      - name: Checkout the code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Install Rust toolchain
        # Install the minimal toolchain, which includes rustc, rustdoc, and cargo.
        #
        # llvm-tools-preview installs some llvm tools, which are needed for `grcov` below.
        # See https://github.com/rust-lang/rust/issues/85658 for stability tracking issue.
        run: rustup toolchain install stable --profile minimal --component llvm-tools-preview

      - name: Setup sccache
        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Install grcov
        uses: taiki-e/install-action@7ea35f098a7369cd23488403f58be9c491a6c55f # v2
        with:
          tool: grcov

      - uses: ./.github/actions/build-frontend
      - uses: ./.github/actions/build-policies

      - name: Run test suite with profiling enabled
        run: |
          cargo test --no-fail-fast --workspace
        env:
          RUSTFLAGS: "-Cinstrument-coverage --cfg tokio_unstable"
          LLVM_PROFILE_FILE: "cargo-test-%p-%m.profraw"
          DATABASE_URL: postgresql://postgres:postgres@localhost/postgres
          SQLX_OFFLINE: "1"

      - name: Build grcov report
        run: |
          mkdir -p target/coverage
          grcov . --binary-path ./target/debug/deps/ -s . -t lcov --branch --ignore-not-existing --ignore '../*' --ignore "/*" -o target/coverage/tests.lcov

      - name: Upload to codecov.io
        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: target/coverage/*.lcov
          flags: unit