fix(ci): isolate coverage artifacts from source audits

Author: victorsteele

.github/workflows/ci.yml

@@ -72,6 +72,7 @@ jobs:
         working-directory: mailbox-app
         env:
           DJANGO_SETTINGS_MODULE: config.settings.test
+          COVERAGE_FILE: ${{ runner.temp }}/mailstack-standalone.coverage
         run: pytest --cov=apps --cov-report=term-missing --cov-fail-under=85
 
       - name: Contact service tests

docs/FORENSIC_FILE_INVENTORY.json

@@ -72,10 +72,10 @@
     },
     {
       "kind": "text",
-      "lines": 100,
+      "lines": 101,
       "path": ".github/workflows/ci.yml",
-      "sha256": "618cb17f101353d97d8e8d05879e7ff3a366f02c8ee7068355db219f734b5769",
-      "size_bytes": 2946
+      "sha256": "888c162494f787a0c0bc2b5b55c2aa66da13be41460a8e5bf9f2eee17c0b9ebe",
+      "size_bytes": 3020
     },
     {
       "kind": "text",
@@ -4299,7 +4299,7 @@
     },
     {
       "kind": "text",
-      "lines": 314,
+      "lines": 318,
       "path": "scripts/forensic_audit.py",
       "python": {
         "classes": [],
@@ -4324,8 +4324,8 @@
         ],
         "methods": []
       },
-      "sha256": "9526c75f22a9ec7121bd14a28805beb884f9672dc66e638c27cb1e3f475752fa",
-      "size_bytes": 10819
+      "sha256": "53233de834b74e2d6ad7c0422361c7ada8b9087074c66104c40b4a4c617dcfd7",
+      "size_bytes": 11137
     },
     {
       "kind": "text",
@@ -4519,7 +4519,7 @@
     "shell_files": 13,
     "shell_functions": 30,
     "text_files": 347,
-    "total_bytes": 874720,
-    "total_text_lines": 20793
+    "total_bytes": 875112,
+    "total_text_lines": 20798
   }
 }

scripts/forensic_audit.py

@@ -11,6 +11,7 @@
 import re
 import subprocess
 import sys
+import tempfile
 from pathlib import Path
 
 REQUIRED = {
@@ -221,7 +222,6 @@ def main() -> int:
     # Ensure the public-site template renders without leaving placeholder tokens.
     template_dir = root / "public-site/site-template"
     if template_dir.is_dir():
-        import tempfile
         with tempfile.TemporaryDirectory(prefix="vibmail-public-render-") as temporary:
             destination = Path(temporary) / "site"
             code, output = run(
@@ -275,24 +275,28 @@ def main() -> int:
 
     if args.full:
         app = root / "mailbox-app"
-        commands = [
-            ([sys.executable, "-m", "pytest", "--cov=apps", "--cov-report=term-missing", "--cov-fail-under=85"], app, "PYTEST_COVERAGE", True),
-            ([sys.executable, "-m", "ruff", "check", "."], app, "RUFF", True),
-            ([sys.executable, "-m", "bandit", "-c", ".bandit", "-q", "-r", "apps", "config"], app, "BANDIT", True),
-            ([sys.executable, "manage.py", "makemigrations", "--check", "--dry-run", "--settings=config.settings.test"], app, "MIGRATION_DRIFT", True),
-            ([sys.executable, "manage.py", "check", "--settings=config.settings.test"], app, "DJANGO_CHECK", True),
-            ([sys.executable, "test_contact_app.py"], root / "public-site/contact_service", "CONTACT_TESTS", False),
-            ([sys.executable, "-m", "pip", "check"], root, "PIP_CHECK", False),
-        ]
-        for command, cwd, label, django_environment in commands:
-            env = os.environ.copy()
-            if django_environment:
-                env["DJANGO_SETTINGS_MODULE"] = "config.settings.test"
-            else:
-                env.pop("DJANGO_SETTINGS_MODULE", None)
-            completed = subprocess.run(command, cwd=cwd, env=env, text=True, capture_output=True)
-            if completed.returncode:
-                findings.append(f"{label}:{(completed.stdout + completed.stderr).strip()}")
+        with tempfile.TemporaryDirectory(prefix="mailstack-full-audit-") as temporary:
+            coverage_file = Path(temporary) / ".coverage"
+            commands = [
+                ([sys.executable, "-m", "pytest", "--cov=apps", "--cov-report=term-missing", "--cov-fail-under=85"], app, "PYTEST_COVERAGE", True),
+                ([sys.executable, "-m", "ruff", "check", "."], app, "RUFF", True),
+                ([sys.executable, "-m", "bandit", "-c", ".bandit", "-q", "-r", "apps", "config"], app, "BANDIT", True),
+                ([sys.executable, "manage.py", "makemigrations", "--check", "--dry-run", "--settings=config.settings.test"], app, "MIGRATION_DRIFT", True),
+                ([sys.executable, "manage.py", "check", "--settings=config.settings.test"], app, "DJANGO_CHECK", True),
+                ([sys.executable, "test_contact_app.py"], root / "public-site/contact_service", "CONTACT_TESTS", False),
+                ([sys.executable, "-m", "pip", "check"], root, "PIP_CHECK", False),
+            ]
+            for command, cwd, label, django_environment in commands:
+                env = os.environ.copy()
+                if django_environment:
+                    env["DJANGO_SETTINGS_MODULE"] = "config.settings.test"
+                else:
+                    env.pop("DJANGO_SETTINGS_MODULE", None)
+                if label == "PYTEST_COVERAGE":
+                    env["COVERAGE_FILE"] = str(coverage_file)
+                completed = subprocess.run(command, cwd=cwd, env=env, text=True, capture_output=True)
+                if completed.returncode:
+                    findings.append(f"{label}:{(completed.stdout + completed.stderr).strip()}")
 
     print("=== MAILSTACK FORENSIC SOURCE AUDIT ===")
     print(f"ROOT={root}")