test-with-coverage.yaml

name: Test with Code Coverage

on:
  push:
    branches:
      - main
      - 'releases/**'
  pull_request:
    branches:
      - main
      - 'releases/**'

permissions:
  contents: read
  issues: read
  checks: write
  pull-requests: write

env:
  CARGO_TERM_COLOR: always
  FEATURE_PATH: ./

jobs:
  test:
    name: Test
    env:
      PROJECT_NAME_UNDERSCORE: test2
      CARGO_INCREMENTAL: 0
      RUSTFLAGS: -Ccodegen-units=1 -Copt-level=0 -Clink-dead-code -Coverflow-checks=off -Zpanic_abort_tests -Cpanic=abort
      RUSTDOCFLAGS: -Cpanic=abort
    runs-on: ubuntu-latest

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.deps.dev:443
            api.github.com:443
            api.osv.dev:443
            api.scorecard.dev:443
            fulcio.sigstore.dev:443
            github.com:443
            oss-fuzz-build-logs.storage.googleapis.com:443
            rekor.sigstore.dev:443
            tuf-repo-cdn.sigstore.dev:443
            www.bestpractices.dev:443
            objects.githubusercontent.com:443
            release-assets.githubusercontent.com:443
            static.rust-lang.org:443
            static.crates.io:443
            index.crates.io:443
            just.systems:443
            taskfile.dev:443

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: nightly
          components: llvm-tools-preview

      - name: Cache dependencies
        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
        env:
          cache-name: cache-dependencies
        with:
          path: |
            ~/.cargo/.crates.toml
            ~/.cargo/.crates2.json
            ~/.cargo/bin
            ~/.cargo/git
            ~/.cargo/registry/index
            ~/.cargo/registry/cache
          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('Cargo.lock') }}

      # Cache target directory seperately to prevent cache invalidation of
      # ~/.cargo when target changes
      #- name: Cache target directory
      #  uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
      #  env:
      #    cache-name: cache-dependencies
      #  with:
      #    path: target
      #    key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('Cargo.lock') }}

      - name: Install grcov
        uses: taiki-e/install-action@305bebabd4457bed9b82541755f034994382465b # v2.68.10
        with:
          tool: grcov,cargo-llvm-cov

      - name: Run tests
        uses: yonasBSD/toolkit@7757e45441401d468ec049000c61571426a47de4 # v1.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          run: |
            task test

      - name: Generate test results and coverage report
        uses: yonasBSD/toolkit@7757e45441401d468ec049000c61571426a47de4 # v1.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          run: |
            cd ${{ env.FEATURE_PATH }}
            cargo test ${CARGO_OPTIONS:+$CARGO_OPTIONS} -- -Z unstable-options --format json | cargo2junit > results.xml;
            cargo llvm-cov --all-features --workspace --codecov --output-path ./codecov.json

      - name: Upload test results
        uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2.23.0
        with:
          check_name: Test Results
          github_token: ${{ secrets.GITHUB_TOKEN }}
          files: results.xml