Improve coverage

.codacy.yaml

@@ -13,10 +13,25 @@
 # - CLAUDE.md: Codacy's prose rules (undefined-acronym, absolute-rule-without-escape-hatch) fight this
 #   agent-instructions doc, which is imperative and full of deliberate absolutes ("NEVER ...", "ALWAYS ...") by
 #   design; dprint + typos + editorconfig already lint it, so Codacy adds only false positives here.
+# - services/ws-web-runner/mingw-shim/msvc_crt_alloc.c: MISRA-21.3-unavoidable heap-allocation code Codacy cannot
+#   suppress per line; isolated into that one file so this exclude stays minimal. Full rationale lives in the
+#   file's own header comment (its canonical home, since more than one analyzer config may exclude the same file).
+# - services/ws-modules/wasi-{comm1,data1}/src/coverage.rs: each guest's minicov coverage dump, whose unsafe
+#   Codacy flags for audit and cannot suppress per line. Isolated into these one-function files so the exclude
+#   stays minimal; rationale in each file's header. The rest of each guest stays analyzed.
+# - utilities/wasm-cov-wrapper/src/main.rs: a RUSTC_WORKSPACE_WRAPPER that reads its own argv (args_os) and forwards
+#   it to rustc; Codacy's Rust security rule flags args_os-into-a-subprocess as a command-injection shape and cannot
+#   suppress per line. It is a false positive -- the args are cargo's own trusted rustc invocation -- and forwarding
+#   argv to rustc is the whole file's purpose, so no code change removes it. The crate is already this one minimal
+#   file; rationale lives in its header. Still covered by clippy + DeepSource Rust.
 exclude_paths:
   - ".github/actions/**"
   - ".github/workflows/**"
   - "CLAUDE.md"
   - "Dockerfile"
   - "config/semgrep/**"
   - "services/ws-modules/dotnet-data1/Program.cs"
+  - "services/ws-modules/wasi-comm1/src/coverage.rs"
+  - "services/ws-modules/wasi-data1/src/coverage.rs"
+  - "services/ws-web-runner/mingw-shim/msvc_crt_alloc.c"
+  - "utilities/wasm-cov-wrapper/src/main.rs"

.deepsource.toml

@@ -2,10 +2,8 @@ version = 1
 
 # Trees that are generated or vendored rather than hand-written source.
 # Built module artifacts under any `pkg/`, the int-gen outputs under `generated/`, and the scenario `verification/`
-# fixtures. The mingw-shim is MSVC-CRT ABI glue (non-const ABI symbols like `__security_cookie`, lazy-init `static`
-# function-pointer caches, naked asm) where the general C best-practice rules only ever produce false positives;
-# clang-tidy/cpplint already cover that tree.
-exclude_patterns = ["**/pkg/**", "generated/**", "services/ws-web-runner/mingw-shim/**", "verification/**"]
+# fixtures.
+exclude_patterns = ["**/pkg/**", "generated/**", "verification/**"]
 
 # Repo convention: tests live in a `tests/` directory or in source files prefixed `test_`.
 test_patterns = ["**/test_*.py", "**/tests/**"]

.dockerignore

@@ -2,6 +2,8 @@
 # Docker reads only this file; patterns are **/-prefixed to match at any depth
 # like .gitignore. Edit .gitignore and regenerate.
 
+# `.dockerignore` is generated from `.gitignore` by `mise run gen:dockerignore`.
+# After editing `.gitignore`, regenerate it and commit both, or the dockerignore-check task fails on drift.
 **/.claude/
 **/*.wasm
 **/*.onnx
@@ -22,13 +24,20 @@ services/ws-server/static/models/
 **/node_modules/
 **/pnpm-lock.yaml
 **/.venv/
-# .NET build output. `obj/` is safe globally (nothing tracked is named obj/),
-# but `bin/` is scoped to the module so it never matches a Rust crate's
-# `src/bin/` (e.g. utilities/int-gen/src/bin/).
+# .NET build output.
+# `obj/` is safe globally (nothing tracked is named obj/), but `bin/` is scoped to the module so it never
+# matches a Rust crate's `src/bin/` (e.g. utilities/int-gen/src/bin/).
 **/obj/
 services/ws-modules/dotnet-data1/bin/
-# Editor dir (but keep the shared recommended-extensions list), tool caches, and
-# the ws-server's runtime file storage.
+# Coverage-report artifacts produced by the coverage workflow, uploaded to Codecov and never committed.
+# Covers cargo-llvm-cov's lcov, pytest-cov's Cobertura xml, and pytest-cov's .coverage data file.
+lcov.info
+**/coverage-python.xml
+**/.coverage
+# minicov/llvm raw profiles dropped by instrumented binaries run during coverage builds.
+**/*.profraw
+# Editor dir, tool caches, and the ws-server's runtime file storage.
+# The .vscode dir is ignored except its shared recommended-extensions list (negated below).
 .vscode/*
 !.vscode/extensions.json
 **/.ruff_cache/

.dprint.jsonc

@@ -1,6 +1,6 @@
-// dprint anchors its base directory (the tree it formats) to the directory of
-// the config file it discovers. This stub keeps that base at the repo root while
-// the real config lives in config/ alongside the other linter configs.
+// Stub config at the repo root so dprint anchors its base directory (the tree it formats) here, not in config/.
+// dprint fixes its base to the directory of the config file it discovers, so the real config lives in config/
+// alongside the other linter configs, and this root stub just re-exports it via "extends".
 {
   "extends": "config/dprint.jsonc",
 }

.github/workflows/check.yaml

@@ -52,6 +52,10 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
+      - name: Free disk space on Linux
+        if: runner.os == 'Linux'
+        uses: jlumbroso/free-disk-space@v1.3.1
+
       - name: Free disk space on Windows
         if: runner.os == 'Windows'
         uses: ./.github/actions/free-disk-space-windows

.github/workflows/coverage.yaml

@@ -21,9 +21,6 @@ defaults:
     shell: bash --noprofile --norc -euo pipefail {0}
 
 env:
-  # Exact full guest-language set -- gha.rego pins this literal value at the workflow level.
-  # (It's what lets `build-modules` build every ws-module so the Rust tests run.) The coverage job appends the
-  # `coverage` env at job level below, mirroring test.yaml's override job's `,${{ matrix.compiler }}`.
   MISE_ENV: dart,dotnet,java,js,python,rust,zig
 
 jobs:
@@ -32,6 +29,7 @@ jobs:
     timeout-minutes: 150
     env:
       MISE_ENV: dart,dotnet,java,js,python,rust,zig,coverage
+      ET_TEST_COVERAGE: "true"
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -52,7 +50,7 @@ jobs:
         timeout-minutes: 20
         with:
           github-token: ${{ github.token }}
-          install-action-tools: cargo-llvm-cov,cargo-nextest
+          install-action-tools: cargo-llvm-cov,deepsource
 
       - name: Prefetch dependencies
         timeout-minutes: 15
@@ -70,13 +68,50 @@ jobs:
         timeout-minutes: 75
         run: mise run cargo-llvm-cov
 
-      - name: Upload coverage to Codecov (OIDC)
+      # Fold the instrumented wasm guest modules' coverage into lcov.info so it rides the same `rust` flag.
+      # The WASI + browser modules dumped their .profraw to target/wasi-cov during the runner tests above.
+      - name: Merge wasm guest coverage into lcov.info
+        timeout-minutes: 10
+        run: mise run wasm-cov
+
+      - name: Collect Python coverage
+        timeout-minutes: 15
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: mise run pytest-cov
+
+      - name: Upload coverage reports as artifacts
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-reports
+          path: |
+            lcov.info
+            coverage-python.xml
+          if-no-files-found: error
+
+      - name: Upload Rust coverage to Codecov (OIDC)
         uses: codecov/codecov-action@v5
         with:
           use_oidc: true
           files: lcov.info
+          flags: rust
           fail_ci_if_error: true
 
+      - name: Upload Python coverage to Codecov (OIDC)
+        uses: codecov/codecov-action@v5
+        with:
+          use_oidc: true
+          files: coverage-python.xml
+          flags: python
+          fail_ci_if_error: true
+
+      - name: Upload Rust coverage to DeepSource (OIDC)
+        run: deepsource report --analyzer test-coverage --key rust --value-file lcov.info --use-oidc
+
+      - name: Upload Python coverage to DeepSource (OIDC)
+        run: deepsource report --analyzer test-coverage --key python --value-file coverage-python.xml --use-oidc
+
       # Upload test results even when tests failed.
       # nextest still wrote the JUnit report, and a failing run is exactly when the per-test results on Codecov
       # matter most; `report_type: test_results` selects the JUnit upload path.

.github/workflows/docker-linux.yaml

@@ -146,17 +146,8 @@ jobs:
           docker run --rm et-test sh -c "find / -xdev -type f -size +50M -exec du -h {} + | sort -h | tail -50"
           echo "::endgroup::"
 
-      # Run the test phases as two separate `docker run` invocations.
-      # Each starts a fresh container with an empty writable layer, so the per-phase compile target/ doesn't share
-      # disk with the other phase. Splits cargo-test's two halves (workspace minus et-ws-web-runner, then
-      # et-ws-web-runner serialized) for clearer attribution when a tight-disk runner fails. test-ws-web-runner
-      # already skips itself on hosts that can't satisfy its Deno-runtime requirements, so this step is a no-op on
-      # those platforms.
-      - name: Run cargo-test-other
-        run: docker run --rm et-test mise run cargo-test-other
-
-      - name: Run test-ws-web-runner
-        run: docker run --rm et-test mise run test-ws-web-runner
+      - name: Run cargo-test
+        run: docker run --rm et-test mise run cargo-test
 
       - name: Run mise check
         run: docker run --rm et-check

.github/workflows/docker-windows.yaml

@@ -156,14 +156,7 @@ jobs:
           # shellcheck disable=SC2086
           docker build $args .
 
-      # Run the test suite split the same way docker-linux does.
-      # cargo-test-other (workspace minus et-ws-web-runner) and test-ws-web-runner (Deno-runtime gated, self-skips
-      # on hosts that can't satisfy it). Each runs in a fresh container so the per-phase compile target/ doesn't
-      # share the writable layer with the other phase. servercore-only -- Nano has no test stage.
-      - name: Run cargo-test-other
+      # Run the Rust tests, excluding et-ws-web-runner on the gnullvm target.
+      - name: Run cargo-test
         if: matrix.base == 'servercore'
-        run: docker run --rm et-windows-test mise run cargo-test-other
-
-      - name: Run test-ws-web-runner
-        if: matrix.base == 'servercore'
-        run: docker run --rm et-windows-test mise run test-ws-web-runner
+        run: docker run --rm et-windows-test mise run cargo-test

.gitignore

@@ -1,3 +1,5 @@
+# `.dockerignore` is generated from `.gitignore` by `mise run gen:dockerignore`.
+# After editing `.gitignore`, regenerate it and commit both, or the dockerignore-check task fails on drift.
 .claude/
 *.wasm
 *.onnx
@@ -18,13 +20,20 @@ uv.lock
 node_modules/
 pnpm-lock.yaml
 .venv/
-# .NET build output. `obj/` is safe globally (nothing tracked is named obj/),
-# but `bin/` is scoped to the module so it never matches a Rust crate's
-# `src/bin/` (e.g. utilities/int-gen/src/bin/).
+# .NET build output.
+# `obj/` is safe globally (nothing tracked is named obj/), but `bin/` is scoped to the module so it never
+# matches a Rust crate's `src/bin/` (e.g. utilities/int-gen/src/bin/).
 obj/
 services/ws-modules/dotnet-data1/bin/
-# Editor dir (but keep the shared recommended-extensions list), tool caches, and
-# the ws-server's runtime file storage.
+# Coverage-report artifacts produced by the coverage workflow, uploaded to Codecov and never committed.
+# Covers cargo-llvm-cov's lcov, pytest-cov's Cobertura xml, and pytest-cov's .coverage data file.
+/lcov.info
+coverage-python.xml
+.coverage
+# minicov/llvm raw profiles dropped by instrumented binaries run during coverage builds.
+*.profraw
+# Editor dir, tool caches, and the ws-server's runtime file storage.
+# The .vscode dir is ignored except its shared recommended-extensions list (negated below).
 .vscode/*
 !.vscode/extensions.json
 .ruff_cache/