coverage-refresh.yml

# .github/workflows/coverage-refresh.yml
name: 'Coverage Map Refresh'
on:
  schedule:
    - cron: '0 6 * * 1'      # weekly floor
  push:
    branches: [master]
    paths:
      - 'toolchain/mfc/test/cases.py'
      - 'src/**/*.fpp'
  workflow_dispatch:
permissions:
  contents: write
concurrency:
  group: coverage-refresh
  cancel-in-progress: true
jobs:
  refresh:
    if: github.repository == 'MFlowCode/MFC'
    timeout-minutes: 240
    runs-on:
      group:  phoenix
      labels: gt
    steps:
      # persist-credentials: false stops actions/checkout from configuring the
      # default GITHUB_TOKEN as an http.extraheader, which otherwise OVERRIDES the
      # token embedded in the push URL below — making the push authenticate as
      # github-actions[bot] (which cannot bypass the require-PR rule) instead of
      # the CACHE_PUSH_TOKEN identity.
      - uses: actions/checkout@v4
        with: { clean: false, persist-credentials: false }
      - name: Build + collect coverage map (SLURM)
        run: bash .github/scripts/submit-slurm-job.sh .github/workflows/common/coverage-refresh.sh cpu none phoenix
      - name: Commit refreshed map
        env:
          CACHE_PUSH_TOKEN: ${{ secrets.CACHE_PUSH_TOKEN }}
        run: |
          if ! git diff --quiet tests/coverage_map.json.gz; then
            git config user.name  "mfc-bot"
            git config user.email "mfc-bot@users.noreply.github.com"
            git add tests/coverage_map.json.gz
            # --no-verify: this bot commit stages only the binary coverage map; it
            # must not run the repo pre-commit hook (./mfc.sh precheck/spelling),
            # which is for source changes and aborts the commit on the runner.
            git commit --no-verify -m "test: refresh coverage map [skip ci]"
            # Push to master with CACHE_PUSH_TOKEN, a classic PAT from an org-owner
            # account. GitHub Apps cannot bypass the require-PR ruleset rule for
            # direct pushes, but a PAT authenticates as the user (OrganizationAdmin),
            # which IS an honored bypass actor. persist-credentials:false above
            # ensures this token is actually used for the push.
            git push "https://x-access-token:${CACHE_PUSH_TOKEN}@github.com/MFlowCode/MFC.git" HEAD:master
          else
            echo "Coverage map unchanged."
          fi