chore(ci): add code coverage collection for integration and e2e test suites

.github/workflows/ci-review-trigger.yml

@@ -9,6 +9,7 @@
 #
 # The available triggers are:
 #
+# /ci-run-coverage            : runs full coverage suite (unit + int + e2e) — NOT included in /ci-run-all (covered by others)
 # /ci-run-all                 : runs all of the below
 # /ci-run-cli                 : runs CLI - Linux
 # /ci-run-test-vector-api     : runs make test-vector-api
@@ -63,6 +64,7 @@ jobs:
       || startsWith(github.event.review.body, '/ci-run-test-docs')
       || startsWith(github.event.review.body, '/ci-run-deny')
       || startsWith(github.event.review.body, '/ci-run-component-features')
+      || startsWith(github.event.review.body, '/ci-run-coverage')
       || startsWith(github.event.review.body, '/ci-run-cross')
       || startsWith(github.event.review.body, '/ci-run-unit-mac')
       || startsWith(github.event.review.body, '/ci-run-unit-windows')
@@ -194,3 +196,14 @@ jobs:
     with:
       ref: ${{ github.event.review.commit_id }}
     secrets: inherit
+
+  coverage:
+    needs: validate
+    if: contains(github.event.review.body, '/ci-run-coverage')
+    permissions:
+      contents: read
+      packages: write
+    uses: ./.github/workflows/coverage.yml
+    with:
+      ref: ${{ github.event.review.commit_id }}
+    secrets: inherit

.github/workflows/coverage.yml

@@ -1,43 +1,105 @@
-name: Code Coverage
+# Coverage
+#
+# Runs all test suites (unit, component validation, CLI, API, behavior,
+# integration) with code coverage instrumentation on a single commit. Results
+# are merged into one lcov report and uploaded to Datadog. Also runs on a
+# weekly schedule to ensure full baseline coverage is always fresh.
+#
+# Limitation: integration and E2E coverage only instruments the test runner
+# (cargo-nextest), not the separately-launched Vector binary inside compose
+# services. Instrumenting the service binary would require building it with
+# cargo-llvm-cov and merging its runtime profdata, which is out of scope here.
+
+name: Coverage
 
 on:
-  push:
-    branches:
-      - master
-  workflow_dispatch: # Allow manual trigger from GitHub UI
+  workflow_call:
+    inputs:
+      ref:
+        description: "Git ref to checkout"
+        required: false
+        type: string
+
+  schedule:
+    - cron: "0 2 * * 0" # 2 AM UTC every Sunday
+  workflow_dispatch:
 
 permissions:
   contents: read
 
 env:
-  CI: true
   CARGO_INCREMENTAL: "0" # Disable incremental compilation for coverage
+  CI: true
 
 jobs:
-  coverage:
+  tests:
+    permissions:
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/unit-tests.yml
+    with:
+      ref: ${{ inputs.ref }}
+      default: true
+      coverage: true
+      cli: true
+      vector-api: true
+
+  integration-tests:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/integration.yml
+    with:
+      run_all: true
+      coverage: true
+      ref: ${{ inputs.ref }}
+    secrets: inherit
+
+  coverage-upload:
+    name: Merge and Upload Coverage
     runs-on: ubuntu-24.04
+    needs:
+      - tests
+      - integration-tests
+    if: ${{ !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') }}
     permissions:
       contents: read
       id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.ref }}
+
+      - name: Download all coverage artifacts
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        with:
+          pattern: coverage-*
+          path: coverage-artifacts
+          merge-multiple: false
+
+      - name: Merge coverage reports
+        run: |
+          sudo apt-get install -y --no-install-recommends lcov
+
+          mapfile -t FILES < <(find coverage-artifacts -name '*.info')
+          echo "Merging ${#FILES[@]} coverage file(s)"
+
+          ARGS=()
+          for f in "${FILES[@]}"; do
+            ARGS+=("--add-tracefile" "$f")
+          done
+          lcov "${ARGS[@]}" --output-file merged-lcov.info
 
       - uses: ./.github/actions/setup
         with:
-          rust: true
-          libsasl2: true
-          protoc: true
-          cargo-llvm-cov: true
-          cargo-nextest: true
+          vdev: false
           datadog-ci: true
 
-      - name: "Generate code coverage"
-        run: cargo llvm-cov nextest --workspace --lcov --output-path lcov.info
-
       - uses: ./.github/actions/dd-token
 
-      - name: "Upload coverage to Datadog"
+      - name: Upload to Datadog
         env:
           DD_SITE: datadoghq.com
           DD_ENV: ci
-        run: datadog-ci coverage upload lcov.info
+        run: datadog-ci coverage upload merged-lcov.info

.github/workflows/integration.yml

@@ -7,14 +7,31 @@
 name: Integration Test Suite
 
 on:
+  workflow_call:
+    inputs:
+      run_all:
+        description: "Run all integration and e2e tests regardless of changed files"
+        required: false
+        type: boolean
+        default: false
+      coverage:
+        description: "Collect code coverage (outputs target/coverage/lcov.info per service)"
+        required: false
+        type: boolean
+        default: false
+      ref:
+        description: "Git ref to checkout (defaults to github.sha)"
+        required: false
+        type: string
   workflow_dispatch:
   pull_request:
   merge_group:
     types: [checks_requested]
 
 concurrency:
-  # `github.event.number` exists for pull requests, otherwise fall back to SHA for merge queue
-  group: ${{ github.workflow }}-${{ github.event.number || github.event.merge_group.head_sha }}
+  # `github.event.number` exists for pull requests, otherwise fall back to SHA for merge queue.
+  # For workflow_call (e.g. weekly coverage), use run_id so each caller gets its own group.
+  group: ${{ github.workflow }}-${{ github.event.number || github.event.merge_group.head_sha || github.run_id }}
   cancel-in-progress: true
 
 permissions:
@@ -51,6 +68,8 @@ jobs:
     if: ${{
       always() &&
       (github.event_name == 'workflow_dispatch' ||
+      github.event_name == 'workflow_call' ||
+      inputs.run_all == true ||
       (github.event_name == 'merge_group' &&
       needs.changes.result == 'success' &&
       (needs.changes.outputs.dependencies == 'true' ||
@@ -60,7 +79,8 @@ jobs:
       }}
     uses: ./.github/workflows/build-test-runner.yml
     with:
-      commit_sha: ${{ github.sha }}
+      commit_sha: ${{ inputs.ref || github.sha }}
+      checkout_ref: ${{ inputs.ref }}
 
   integration-tests:
     runs-on: ubuntu-24.04-8core
@@ -72,8 +92,9 @@ jobs:
       - build-test-runner
 
     if: ${{ always() && !failure() && !cancelled() && needs.build-test-runner.result == 'success' &&
-      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch') }}
+      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call' || inputs.run_all == true) }}
     strategy:
+      fail-fast: false
       matrix:
         # TODO: Add "splunk" back once https://github.com/vectordotdev/vector/issues/23474 is fixed.
         # If you modify this list, please also update the `int_tests` job in changes.yml.
@@ -126,6 +147,8 @@ jobs:
         id: check
         run: |
           if [[ "${{ github.event_name }}" == "workflow_dispatch" || \
+                "${{ github.event_name }}" == "workflow_call" || \
+                "${{ inputs.run_all }}" == "true" || \
                 "${{ needs.changes.outputs.dependencies }}" == "true" || \
                 "${{ needs.changes.outputs.integration-yml }}" == "true" ]]; then
             echo "should_run=true" >> "$GITHUB_OUTPUT"
@@ -142,6 +165,7 @@ jobs:
         if: steps.check.outputs.should_run == 'true'
         with:
           submodules: "recursive"
+          ref: ${{ inputs.ref || github.sha }}
 
       - uses: ./.github/actions/dd-token
         if: steps.check.outputs.should_run == 'true'
@@ -159,7 +183,7 @@ jobs:
         uses: ./.github/actions/pull-test-runner
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
-          commit_sha: ${{ github.sha }}
+          commit_sha: ${{ inputs.ref || github.sha }}
 
       - name: Run Integration Tests for ${{ matrix.service }}
         if: steps.check.outputs.should_run == 'true'
@@ -168,7 +192,15 @@ jobs:
           timeout_minutes: 30
           max_attempts: 3
           command: |
-            bash scripts/run-integration-test.sh int ${{ matrix.service }}
+            bash scripts/run-integration-test.sh ${{ inputs.coverage && '-c' || '' }} int ${{ matrix.service }}
+
+      - name: Upload coverage artifact
+        if: inputs.coverage && always()
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: coverage-int-${{ matrix.service }}
+          path: target/coverage/lcov.info
+          if-no-files-found: ignore
 
   e2e-tests:
     runs-on: ubuntu-24.04-8core
@@ -179,8 +211,9 @@ jobs:
       - changes
       - build-test-runner
     if: ${{ always() && !failure() && !cancelled() && needs.build-test-runner.result == 'success' &&
-      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch') }}
+      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call' || inputs.run_all == true) }}
     strategy:
+      fail-fast: false
       matrix:
         service: ["datadog-logs", "datadog-metrics", "opentelemetry-logs", "opentelemetry-metrics"]
     timeout-minutes: 90
@@ -196,6 +229,8 @@ jobs:
         id: check
         run: |
           if [[ "${{ github.event_name }}" == "workflow_dispatch" || \
+                "${{ github.event_name }}" == "workflow_call" || \
+                "${{ inputs.run_all }}" == "true" || \
                 "${{ needs.changes.outputs.dependencies }}" == "true" || \
                 "${{ needs.changes.outputs.integration-yml }}" == "true" ]]; then
             echo "should_run=true" >> "$GITHUB_OUTPUT"
@@ -212,6 +247,7 @@ jobs:
         if: steps.check.outputs.should_run == 'true'
         with:
           submodules: "recursive"
+          ref: ${{ inputs.ref || github.sha }}
 
       - uses: ./.github/actions/dd-token
         if: steps.check.outputs.should_run == 'true'
@@ -229,7 +265,7 @@ jobs:
         uses: ./.github/actions/pull-test-runner
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
-          commit_sha: ${{ github.sha }}
+          commit_sha: ${{ inputs.ref || github.sha }}
 
       - name: Run E2E Tests for ${{ matrix.service }}
         if: steps.check.outputs.should_run == 'true'
@@ -238,7 +274,15 @@ jobs:
           timeout_minutes: 30
           max_attempts: 3
           command: |
-            bash scripts/run-integration-test.sh e2e ${{ matrix.service }}
+            bash scripts/run-integration-test.sh ${{ inputs.coverage && '-c' || '' }} e2e ${{ matrix.service }}
+
+      - name: Upload coverage artifact
+        if: inputs.coverage && always()
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: coverage-e2e-${{ matrix.service }}
+          path: target/coverage/lcov.info
+          if-no-files-found: ignore
 
   integration-test-suite:
     name: Integration Test Suite

.github/workflows/unit-tests.yml

@@ -4,10 +4,13 @@
 # validation. Callers can enable additional suites (CLI, Vector API, behavior)
 # via boolean inputs.
 #
-# When `default` is true, all nextest-based suites run in a single `make test`
-# invocation with the relevant features enabled. When `default` is false, only
-# the explicitly enabled suites run, using a nextest filter expression to
-# select the matching tests.
+# With coverage: false (default), plain cargo-nextest; uploads test results to Datadog.
+# With coverage: true, cargo-llvm-cov (COVERAGE=true); uploads an lcov artifact named "coverage-unit".
+#
+# When `default` is true (the default), all nextest-based suites run in a
+# single `make test` invocation with the relevant features enabled. When
+# `default` is false, only the explicitly enabled suites run, using a nextest
+# filter expression to select the matching tests.
 
 name: Tests
 
@@ -18,6 +21,11 @@ on:
         description: "Git ref to checkout"
         required: false
         type: string
+      coverage:
+        description: "Collect code coverage (sets COVERAGE=true for make targets)"
+        required: false
+        type: boolean
+        default: false
       default:
         description: "Run the full default unit test suite (--workspace with default features)"
         required: true
@@ -38,7 +46,7 @@ on:
         type: boolean
         default: false
       behavior:
-        description: "Include behavior tests"
+        description: "Include behavior tests (cargo run based, no coverage)"
         required: false
         type: boolean
         default: false
@@ -69,7 +77,8 @@ jobs:
         with:
           rust: true
           cargo-nextest: true
-          datadog-ci: true
+          cargo-llvm-cov: ${{ inputs.coverage }}
+          datadog-ci: ${{ !inputs.coverage }}
           protoc: true
           libsasl2: true
 
@@ -112,11 +121,27 @@ jobs:
           else
             echo "No nextest suites selected; skipping 'make test'"
           fi
+        env:
+          COVERAGE: ${{ inputs.coverage }}
 
       - name: Behavior tests
         if: ${{ inputs.behavior }}
         run: make test-behavior
 
       - name: Upload test results to Datadog
-        if: ${{ always() }}
+        if: ${{ !inputs.coverage && always() }}
         run: scripts/upload-test-results.sh
+
+      - name: Generate lcov report
+        if: ${{ inputs.coverage }}
+        run: |
+          make coverage-report
+          # Normalize absolute source paths to relative so they merge cleanly with
+          # coverage from the containerized integration tests (which use SF:src/...).
+          sed -i "s|SF:$(pwd)/|SF:|g" lcov.info
+
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        if: ${{ inputs.coverage }}
+        with:
+          name: coverage-unit
+          path: lcov.info