Add CMake code coverage support and coverage aggregation script (#7740)

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: achamayou <4016369+achamayou@users.noreply.github.com>
Co-authored-by: Amaury Chamayou <amaury@xargs.fr>
Co-authored-by: Amaury Chamayou <amchamay@microsoft.com>

Author: Copilot

.github/workflows/ci.yml

@@ -181,6 +181,109 @@ jobs:
           if-no-files-found: ignore
         if: success() || failure()
 
+  vmss-virtual-c:
+    name: "VMSS Virtual C" # Code coverage
+    runs-on:
+      [
+        self-hosted,
+        1ES.Pool=gha-vmss-d16av5-ci,
+        "JobId=ci_coverage-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}",
+      ]
+    container:
+      image: mcr.microsoft.com/azurelinux/base/core:3.0
+      options: --user root --publish-all --cap-add NET_ADMIN --cap-add NET_RAW --cap-add SYS_PTRACE
+
+    steps:
+      - name: "Checkout dependencies"
+        shell: bash
+        run: |
+          set -ex
+          gpg --import /etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY
+          tdnf -y update
+          tdnf -y install ca-certificates git
+
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: "Install dependencies"
+        shell: bash
+        run: |
+          set -ex
+          ./scripts/setup-ci.sh
+
+      - name: "Build Debug with coverage"
+        run: |
+          set -ex
+          git config --global --add safe.directory /__w/CCF/CCF
+          mkdir build
+          cd build
+          cmake -GNinja -DCMAKE_BUILD_TYPE=Debug -DCOVERAGE=ON ..
+          ninja
+        shell: bash
+
+      - name: "Run Unit tests"
+        run: |
+          set -ex
+          cd build
+          ./tests.sh --output-on-failure -L unit -j$(nproc --all)
+        shell: bash
+
+      - name: "End to end tests except partition"
+        run: |
+          set -ex
+          cd build
+          rm -rf /github/home/.cache
+          mkdir -p /github/home/.cache
+
+          # End to end tests
+          ./tests.sh --timeout 360 --output-on-failure -LE "benchmark|suite|unit"
+        shell: bash
+
+      - name: "Generate coverage reports"
+        run: |
+          set -ex
+          cd build
+          ../scripts/coverage.sh --html coverage_html | tee coverage_report.txt
+        shell: bash
+
+      - name: "Write coverage summary"
+        if: always()
+        run: |
+          set -ex
+          cd build
+          if [[ -f coverage_report.txt ]]; then
+            {
+              echo '## Code Coverage'
+              echo ''
+              echo '```'
+              cat coverage_report.txt
+              echo '```'
+            } >> "$GITHUB_STEP_SUMMARY"
+          fi
+        shell: bash
+
+      - name: "Upload HTML coverage report"
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-report-html
+          path: build/coverage_html/
+          if-no-files-found: ignore
+        if: success() || failure()
+
+      - name: "Upload logs for virtual C"
+        uses: actions/upload-artifact@v7
+        with:
+          name: logs-azurelinux-virtual-c
+          path: |
+            build/workspace/*/*.config.json
+            build/workspace/*/out
+            build/workspace/*/err
+            build/workspace/*/*.ledger/*
+            build/workspace/*/stack_trace
+          if-no-files-found: ignore
+        if: success() || failure()
+
   aci_snp_milan:
     name: "ACI SNP Milan"
     runs-on:

CHANGELOG.md

@@ -16,6 +16,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Added `ccf::describe_cose_receipt_v1(receipt)` to obtain COSE receipts with Merkle proof in unprotected header for non-signature TXs, and empty unprotected header for signature TXs (#7700).
 - `NetworkIdentitySubsystemInterface` now exposes `get_trusted_keys()`, returning all trusted network identity keys as a `TrustedKeys` map (#7690).
 - Added support for self-transparent code update policies (#7681).
+- Added `scripts/coverage.sh` to aggregate LLVM coverage data produced by tests built with `-DCOVERAGE=ON`. The script merges all `.profraw` files in the build directory, prints an overall coverage summary, and optionally shows uncovered lines (`--show-uncovered`) or generates an HTML report (`--html <dir>`). CMake now also generates `coverage_binaries.txt` in the build directory listing all instrumented test binaries, and automatically sets `LLVM_PROFILE_FILE` for each unit test so that parallel test runs produce uniquely-named profile files.
 
 ### Changed
 

CMakeLists.txt

@@ -1270,6 +1270,21 @@ if(BUILD_TESTS)
       PYTHON_SCRIPT ${CMAKE_SOURCE_DIR}/tests/consistency_trace_validation.py
     )
   endif()
+
+  if(COVERAGE)
+    # Generate a list of coverage-instrumented binaries for scripts/coverage.sh
+    get_property(_cov_targets GLOBAL PROPERTY CCF_COVERAGE_TARGETS)
+    set(_cov_binaries "")
+    foreach(_target ${_cov_targets})
+      list(APPEND _cov_binaries "$<TARGET_FILE:${_target}>")
+    endforeach()
+    string(REPLACE ";" "\n" _cov_binaries_nl "${_cov_binaries}")
+    file(
+      GENERATE
+      OUTPUT "${CMAKE_BINARY_DIR}/coverage_binaries.txt"
+      CONTENT "${_cov_binaries_nl}\n"
+    )
+  endif()
 endif()
 
 # Generate and install CMake export file for consumers using CMake

cmake/ccf_app.cmake

@@ -48,6 +48,7 @@ function(add_ccf_app name)
 
   add_san(${name})
   add_tidy(${name})
+  enable_coverage(${name})
 
   if(USE_SNMALLOC)
     target_link_libraries(${name} INTERFACE snmallocshim-static)

cmake/common.cmake

@@ -44,6 +44,14 @@ function(add_unit_test name)
     PROPERTY LABELS unit
   )
 
+  if(COVERAGE)
+    set_property(
+      TEST ${name}
+      APPEND
+      PROPERTY ENVIRONMENT "LLVM_PROFILE_FILE=${name}-%p.profraw"
+    )
+  endif()
+
   add_san_test_properties(${name})
 endfunction()
 
@@ -132,6 +140,16 @@ function(add_e2e_test)
 
     add_san_test_properties(${PARSED_ARGS_NAME})
 
+    if(COVERAGE)
+      set_property(
+        TEST ${PARSED_ARGS_NAME}
+        APPEND
+        PROPERTY
+          ENVIRONMENT
+          "LLVM_PROFILE_FILE=${CMAKE_BINARY_DIR}/${PARSED_ARGS_NAME}-%p.profraw"
+      )
+    endif()
+
     set_property(
       TEST ${PARSED_ARGS_NAME}
       APPEND

cmake/tools.cmake

@@ -54,5 +54,6 @@ function(enable_coverage name)
   if(COVERAGE)
     target_compile_options(${name} PRIVATE ${COVERAGE_FLAGS})
     target_link_libraries(${name} PRIVATE ${COVERAGE_LINK})
+    set_property(GLOBAL APPEND PROPERTY CCF_COVERAGE_TARGETS ${name})
   endif()
 endfunction()