Files
Clement Tsang 731564b656 ci: test using no permissions by default for most CI jobs + bump setup-python (#2025)
* ci: test using no permissions by default for most CI jobs

* Also require production approval for a release upload

* remove build_release individual 'job'

* tweak some stuff

* driveby bump on setup-python to 6.2.0 to fix node20 warnings

* remove bsd vm check name
2026-04-11 17:48:58 -04:00

114 lines
3.9 KiB
YAML

# Code coverage generation via cargo-llvm-cov, which is then uploaded to Codecov.
# Codecov will report back via a comment if run on a PR.
#
# Note that Codecov will report back the average all uploaded coverage files.
name: codecov
on:
workflow_dispatch:
pull_request:
push:
branches:
- main
permissions: {}
env:
CARGO_INCREMENTAL: 0
CARGO_HUSKY_DONT_INSTALL_HOOKS: true
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' || github.repository != 'ClementTsang/bottom' }}
jobs:
pre-job:
runs-on: ubuntu-24.04
outputs:
should_skip: ${{ steps.skip_check.outputs.should_skip }}
steps:
- id: skip_check
uses: ClementTsang/skip-duplicate-actions@41b0a75f656d455934ffa6a46b779d8d996ac47c
with:
skip_after_successful_duplicate: "false"
paths: '["tests/**", "src/**", ".github/workflows/coverage.yml", ".github/ci", ".cargo/**", "Cargo.toml", "Cargo.lock", "build.rs"]'
do_not_skip: '["workflow_dispatch", "push"]'
coverage:
needs: pre-job
if: ${{ needs.pre-job.outputs.should_skip != 'true' }}
runs-on: ${{ matrix.info.os }}
timeout-minutes: 12
strategy:
fail-fast: false
matrix:
info:
- { os: "ubuntu-24.04", target: "x86_64-unknown-linux-gnu" }
- { os: "macos-14", target: "aarch64-apple-darwin", cross: false }
- { os: "windows-2022", target: "x86_64-pc-windows-msvc" }
steps:
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Read Rust version
shell: bash
run: |
VER=$(cat .github/ci/rust_version.txt)
echo "RUST_VERSION=$VER" >> $GITHUB_ENV
echo "$VER"
- name: Set up Rust toolchain
uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
with:
toolchain: ${{ env.RUST_VERSION }}
- name: Enable Rust cache
uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # 2.9.1
if: ${{ github.event_name != 'pull_request' || ! github.event.pull_request.head.repo.fork }} # If it is a PR, only if not a fork
with:
key: ${{ matrix.info.target }}
cache-all-crates: true
- name: Install cargo-llvm-cov
run: |
rustup component add llvm-tools-preview
cargo install cargo-llvm-cov --version 0.6.22 --locked
- name: Generate code coverage
run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info --locked --target=${{ matrix.info.target }}
# The token is generally not needed, but sometimes the default shared token hits limits.
# Yes this is ugly as hell. Why retrying is not a built-in feature of GHA, I have no idea.
- name: Upload to codecov.io (Attempt 1)
uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
with:
files: lcov.info
fail_ci_if_error: true
token: ${{ secrets.CODECOV_TOKEN }}
flags: ${{ matrix.info.os }}
id: upload_attempt_1
continue-on-error: true
- name: Upload to codecov.io (Attempt 2)
uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
with:
files: lcov.info
fail_ci_if_error: true
token: ${{ secrets.CODECOV_TOKEN }}
flags: ${{ matrix.info.os }}
if: steps.upload_attempt_1.outcome == 'failure'
id: upload_attempt_2
continue-on-error: true
- name: Upload to codecov.io (Attempt 3)
uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
with:
files: lcov.info
fail_ci_if_error: true
token: ${{ secrets.CODECOV_TOKEN }}
flags: ${{ matrix.info.os }}
if: steps.upload_attempt_2.outcome == 'failure'
id: upload_attempt_3