CVE-Radar/.github/workflows/quality-codecov.yml at main · zza-830/CVE-Radar · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
# Category: Quality | Test coverage (lcov) + Vite bundle analysis via @codecov/vite-plugin.
# See .github/CODECOV.md — upload via GitHub OIDC (public repo) or CODECOV_TOKEN fallback.

name: Quality / Codecov

on:
  pull_request:
    branches: [main]
    paths: &codecov-paths
      - "src/**"
      - "server/**"
      - "shared/**"
      - "tests/**"
      - "package.json"
      - "package-lock.json"
      - ".npmrc"
      - "tsconfig*.json"
      - "vite.config.ts"
      - "codecov.yml"
      - "shared/ci/**"
      - "scripts/verify-junit-report.ts"
      - ".github/workflows/quality-codecov.yml"
      - ".github/workflows/quality/**"
  push:
    branches: [main]
    paths: *codecov-paths
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: write
  id-token: write

concurrency:
  group: codecov-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: false

jobs:
  test:
    name: Run tests and collect coverage
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          fetch-depth: 2

      - name: Set up Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version-file: .nvmrc
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Run tests
        id: tests
        continue-on-error: true
        run: npm run test:ci

      - name: Verify JUnit report
        if: ${{ !cancelled() && steps.tests.outcome != 'skipped' }}
        run: npm run verify:junit

      - name: Upload test results to Codecov (OIDC)
        id: test_results_oidc
        if: ${{ !cancelled() && steps.tests.outcome != 'skipped' }}
        continue-on-error: true
        uses: codecov/codecov-action@cddd853df119a48c5be31a973f8cd97e12e35e16 # v6.0.1
        with:
          use_oidc: true
          report_type: test_results
          files: junit.xml
          flags: unittests
          name: node-test-results
          fail_ci_if_error: false
          skip_validation: true

      - name: Upload test results to Codecov (token fallback)
        id: test_results_token
        if: ${{ !cancelled() && steps.tests.outcome != 'skipped' && steps.test_results_oidc.outcome != 'success' }}
        continue-on-error: true
        uses: codecov/codecov-action@cddd853df119a48c5be31a973f8cd97e12e35e16 # v6.0.1
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          report_type: test_results
          files: junit.xml
          flags: unittests
          name: node-test-results
          fail_ci_if_error: false
          skip_validation: true

      - name: Verify coverage report
        run: test -s coverage/lcov.info

      - name: Production build (bundle analysis)
        run: npm run build
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

      - name: Upload to Codecov (OIDC)
        id: upload_oidc
        continue-on-error: true
        uses: codecov/codecov-action@cddd853df119a48c5be31a973f8cd97e12e35e16 # v6.0.1
        with:
          use_oidc: true
          files: coverage/lcov.info
          flags: unittests
          name: node-test
          fail_ci_if_error: true
          skip_validation: true

      - name: Upload to Codecov (token fallback)
        id: upload_token
        if: steps.upload_oidc.outcome != 'success'
        uses: codecov/codecov-action@cddd853df119a48c5be31a973f8cd97e12e35e16 # v6.0.1
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: coverage/lcov.info
          flags: unittests
          name: node-test
          fail_ci_if_error: true
          skip_validation: true

      - name: Upload failed
        if: steps.upload_oidc.outcome != 'success' && steps.upload_token.outcome != 'success'
        run: |
          echo "::error::Codecov upload failed. Activate the repo at https://codecov.io/gh/RaminNietzsche/CVE-Radar and refresh CODECOV_TOKEN — see .github/CODECOV.md"
          exit 1

      - name: Fail if tests failed
        if: steps.tests.outcome == 'failure'
        run: exit 1