feat(coverage): add install-dynamic-plugins coverage upload to Codecov (RHIDP-13232)

[gustavolira]

Summary

• Add --cov and --cov-report=lcov to pytest in pr.yaml and coverage-baseline.yml
• Upload LCOV to Codecov with flag install-dynamic-plugins (separate from the rhdh flag)
• Fix codecov.yml flag path from scripts/install-dynamic-plugins/src/** (non-existent TS path) to scripts/install-dynamic-plugins/*.py (actual Python source)
• Fix comment in codecov.yml (pytest-based, not Vitest-based)

This completes the last deliverable from RHIDP-13232: Codecov now shows both rhdh and install-dynamic-plugins flags with data.

Jira

• Story: RHIDP-13232

Test plan

• PR CI passes (pytest with --cov produces LCOV output)
• Codecov upload step succeeds with install-dynamic-plugins flag
• After merge, baseline workflow also uploads install-dynamic-plugins coverage

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gustavolira]

/review

[rhdh-qodo-merge]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis 🔶 RHIDP-13232 - Partially compliant Compliant requirements: Upload LCOV to Codecov using codecov/codecov-action pinned to a commit SHA Codecov shows flags rhdh and install-dynamic-plugins with data (wiring added for install-dynamic-plugins) Non-compliant requirements: Create .github/workflows/unit-tests.yml to run unit tests with coverage, aggregate LCOV, and upload to Codecov Configure repo-root Jest/backstage-cli coverage scope to match codecov.yml scope (coverage reporters/dir/collection) Modify .github/workflows/pr.yaml to run npm run test:coverage for install-dynamic-plugins Activate progressive coverage thresholds in codecov.yml (Phase 1 + future phases) Ensure persist-credentials: false on checkout and minimal permissions (not shown/changed here) P50 runtime under 5 minutes for the new unit-test workflow Threshold rollout documented and Phase 1 live at merge Requires further human verification: Codecov displays the install-dynamic-plugins flag with the expected file mapping and non-zero coverage after CI runs Baseline workflow and PR workflow uploads succeed in GitHub Actions with the configured CODECOV_TOKEN

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 Security concerns Potential supply-chain risk: the newly added pip install -r ... in CI installs unpinned Python dependencies at workflow runtime. While no secrets are directly exposed in the diff, pulling mutable packages can introduce compromised dependency risk and nondeterministic builds. Consider pinned versions (and ideally hashes) for CI-installed Python requirements.

⚡ Recommended focus areas for review Coverage Prereqs The new pytest command generates LCOV via --cov-report=lcov:..., which requires the pytest-cov plugin (and a compatible coverage.py). Verify the workflow environment actually installs these dependencies before running pytest; otherwise the step will fail or produce no .lcov file. - name: Run Python tests if: ${{ steps.check-image.outputs.is_skipped != 'true' }} run: pytest scripts/install-dynamic-plugins/test_install-dynamic-plugins.py -v --cov=scripts/install-dynamic-plugins --cov-report=lcov:coverage-install-dynamic-plugins.lcov - name: Upload install-dynamic-plugins coverage to Codecov if: ${{ steps.check-image.outputs.is_skipped != 'true' && !cancelled() }} uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0 with: files: coverage-install-dynamic-plugins.lcov flags: install-dynamic-plugins token: ${{ secrets.CODECOV_TOKEN }} fail_ci_if_error: false Supply Chain pip install -r python/requirements-dev.txt -r python/requirements.txt pulls mutable dependencies at runtime. Consider pinning/hashing or otherwise constraining installs in CI to reduce flakiness and supply-chain risk, especially since this job runs on a schedule/baseline context. - name: Install Python dependencies run: pip install -r python/requirements-dev.txt -r python/requirements.txt - name: Run Python tests with coverage run: pytest scripts/install-dynamic-plugins/test_install-dynamic-plugins.py -v --cov=scripts/install-dynamic-plugins --cov-report=lcov:coverage-install-dynamic-plugins.lcov Flag Path Scope The flag path was changed to scripts/install-dynamic-plugins/*.py. Confirm this matches Codecov’s expected path normalization and includes all relevant Python sources (e.g., nested modules/subdirs if any) so files are attributed to the install-dynamic-plugins flag as intended. - name: install-dynamic-plugins paths: - scripts/install-dynamic-plugins/*.py carryforward: true

📄 References No matching references available

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-4700
• quay.io/rhdh-community/rhdh:pr-4700-fdb08254

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@66c9207). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4700   +/-   ##
=======================================
  Coverage        ?   69.56%           
=======================================
  Files           ?      109           
  Lines           ?     4705           
  Branches        ?      535           
=======================================
  Hits            ?     3273           
  Misses          ?     1431           
  Partials        ?        1           

Flag	Coverage Δ
install-dynamic-plugins	92.44% <ø> (?)
rhdh	38.75% <ø> (?)

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 66c9207...fdb0825. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.