Skip to content

Commit f8a4a71

Browse files
dimsdims
committed
[WIP] test codeql and code coverage
Signed-off-by: Davanum Srinivas <[email protected]>
1 parent 0478308 commit f8a4a71

File tree

5 files changed

+588
-99
lines changed

5 files changed

+588
-99
lines changed

‎.github/workflows/code-scanning.yml‎

Lines changed: 50 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,9 @@ jobs:
3232
prepare-environment:
3333
uses: ./.github/workflows/prepare-environment.yml
3434

35-
analyze:
36-
name: Analyze Go code with CodeQL
35+
codeql-pr-analysis:
36+
if: startsWith(github.ref, 'refs/heads/pull-request/')
37+
name: CodeQL PR Analysis
3738
runs-on: linux-amd64-cpu4
3839
timeout-minutes: 360
3940
needs: prepare-environment
@@ -57,16 +58,60 @@ jobs:
5758
shellcheck-version: ${{ needs.prepare-environment.outputs.shellcheck_version }}
5859

5960
- name: Initialize CodeQL
60-
uses: github/codeql-action/init@v3
61+
uses: github/codeql-action/init@v4
6162
with:
6263
languages: go
6364
build-mode: manual
6465
env:
6566
CODEQL_EXTRACTOR_GO_BUILD_TRACING: on
66-
- shell: bash
67+
68+
- name: Build with CodeQL
6769
run: |
6870
make build-all
71+
72+
- name: Perform CodeQL Analysis
73+
uses: github/codeql-action/analyze@v4
74+
with:
75+
category: "/language:go"
76+
77+
codeql-baseline-analysis:
78+
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
79+
name: CodeQL Baseline Analysis
80+
runs-on: linux-amd64-cpu4
81+
timeout-minutes: 360
82+
needs: prepare-environment
83+
permissions:
84+
security-events: write
85+
packages: read
86+
steps:
87+
- name: Checkout repository
88+
uses: actions/checkout@v4
89+
90+
- name: Setup build environment
91+
uses: ./.github/actions/setup-build-env
92+
with:
93+
go-version: ${{ needs.prepare-environment.outputs.go_version }}
94+
python-version: ${{ needs.prepare-environment.outputs.python_version }}
95+
poetry-version: ${{ needs.prepare-environment.outputs.poetry_version }}
96+
golangci-lint-version: ${{ needs.prepare-environment.outputs.golangci_lint_version }}
97+
protobuf-version: ${{ needs.prepare-environment.outputs.protobuf_version }}
98+
protoc-gen-go-version: ${{ needs.prepare-environment.outputs.protoc_gen_go_version }}
99+
protoc-gen-go-grpc-version: ${{ needs.prepare-environment.outputs.protoc_gen_go_grpc_version }}
100+
shellcheck-version: ${{ needs.prepare-environment.outputs.shellcheck_version }}
101+
102+
- name: Initialize CodeQL
103+
uses: github/codeql-action/init@v4
104+
with:
105+
languages: go
106+
build-mode: manual
107+
env:
108+
CODEQL_EXTRACTOR_GO_BUILD_TRACING: on
109+
110+
- name: Build with CodeQL
111+
run: |
112+
make build-all
113+
69114
- name: Perform CodeQL Analysis
70-
uses: github/codeql-action/analyze@v3
115+
uses: github/codeql-action/analyze@v4
71116
with:
72117
category: "/language:go"

‎.github/workflows/coverage-report.yml‎

Lines changed: 202 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,202 @@
1+
# Copyright (c) 2025, NVIDIA CORPORATION. All rights reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
name: Coverage Report
16+
17+
on:
18+
workflow_run:
19+
workflows: ["Lint and Test"]
20+
types:
21+
- completed
22+
branches:
23+
- main
24+
- "pull-request/[0-9]+"
25+
26+
permissions:
27+
contents: read # Required for checking out code
28+
actions: write # Required for downloading artifacts
29+
pull-requests: write # Required for coverage report comments
30+
31+
env:
32+
# Go cache settings (specific to this workflow)
33+
GOPATH: /home/runner/go
34+
GOCACHE: /home/runner/.cache/go-build
35+
36+
jobs:
37+
coverage-report:
38+
# Only run on successful completion of lint-test workflow for PR branches
39+
if: github.event.workflow_run.conclusion == 'success' && (github.event.workflow_run.event == 'pull_request' || startsWith(github.event.workflow_run.head_branch, 'pull-request/'))
40+
runs-on: linux-amd64-cpu4
41+
timeout-minutes: 15
42+
steps:
43+
- uses: actions/checkout@v4
44+
with:
45+
ref: ${{ github.event.workflow_run.head_sha }}
46+
47+
- name: Download all coverage artifacts from completed workflow
48+
uses: actions/download-artifact@v4
49+
with:
50+
pattern: "*-results"
51+
path: coverage-artifacts
52+
merge-multiple: true
53+
run-id: ${{ github.event.workflow_run.id }}
54+
55+
- name: Consolidate coverage files
56+
run: |
57+
echo "Consolidating coverage files from all components..."
58+
mkdir -p consolidated-coverage
59+
60+
# Find all coverage.txt files and merge them
61+
find coverage-artifacts -name "coverage.txt" -type f | while read -r file; do
62+
echo "Processing: $file"
63+
# Extract the mode line (first line) if it's the first file
64+
if [ ! -f consolidated-coverage/coverage.txt ]; then
65+
head -n 1 "$file" > consolidated-coverage/coverage.txt
66+
fi
67+
# Append coverage data (skip mode line)
68+
tail -n +2 "$file" >> consolidated-coverage/coverage.txt
69+
done
70+
71+
echo "Consolidated coverage file created:"
72+
ls -la consolidated-coverage/
73+
head -n 10 consolidated-coverage/coverage.txt
74+
75+
- name: Upload consolidated coverage
76+
uses: actions/upload-artifact@v4
77+
with:
78+
name: consolidated-code-coverage
79+
path: consolidated-coverage/coverage.txt
80+
retention-days: 30
81+
82+
- name: Extract PR number from branch name
83+
id: pr-number
84+
run: |
85+
if [[ "${{ github.event.workflow_run.head_branch }}" =~ pull-request/([0-9]+) ]]; then
86+
echo "pr_number=${BASH_REMATCH[1]}" >> $GITHUB_OUTPUT
87+
else
88+
echo "pr_number=" >> $GITHUB_OUTPUT
89+
fi
90+
91+
- name: Setup Go
92+
uses: actions/setup-go@v5
93+
with:
94+
go-version: 'stable'
95+
96+
- name: Install go-coverage-report CLI tool
97+
run: go install github.com/fgrosse/go-coverage-report/cmd/go-coverage-report@latest
98+
99+
- name: Get changed files
100+
uses: tj-actions/changed-files@aa08304bd477b800d468db44fe10f6c61f7f7b11
101+
id: changed-files
102+
with:
103+
write_output_files: true
104+
json: true
105+
files: "**.go"
106+
files_ignore: "vendor/**"
107+
output_dir: .github/outputs
108+
109+
- name: Generate Coverage Report with Fixed PR Number
110+
run: |
111+
# Download current coverage
112+
gh run download "${{ github.event.workflow_run.id }}" --name=consolidated-code-coverage --dir=/tmp/current-coverage
113+
mv /tmp/current-coverage/coverage.txt .github/outputs/new-coverage.txt
114+
115+
# Download baseline coverage from main
116+
LAST_SUCCESSFUL_RUN=$(gh run list --status=success --branch=main --workflow=lint-test.yml --event=push --json=databaseId --limit=1 -q '.[] | .databaseId')
117+
118+
if [[ -n "$LAST_SUCCESSFUL_RUN" ]]; then
119+
gh run download "$LAST_SUCCESSFUL_RUN" --name=consolidated-code-coverage --dir=/tmp/baseline-coverage 2>/dev/null || true
120+
if [[ -f /tmp/baseline-coverage/coverage.txt ]]; then
121+
mv /tmp/baseline-coverage/coverage.txt .github/outputs/old-coverage.txt
122+
fi
123+
fi
124+
125+
# Generate the report using fgrosse's CLI tool (same format!)
126+
go-coverage-report -root=github.com/NVIDIA/nvsentinel \
127+
.github/outputs/old-coverage.txt \
128+
.github/outputs/new-coverage.txt \
129+
.github/outputs/all_modified_files.json > coverage-report.md 2>&1 || true
130+
131+
# Post comment using our correct PR number (this is the only fix needed!)
132+
if [[ -n "${{ steps.pr-number.outputs.pr_number }}" && -f coverage-report.md ]]; then
133+
# Check for existing coverage comment
134+
EXISTING_COMMENT=$(gh api "repos/${{ github.repository }}/issues/${{ steps.pr-number.outputs.pr_number }}/comments" \
135+
--jq '.[] | select(.user.login=="github-actions[bot]" and (.body | test("Coverage Report|Coverage Δ"))) | .id' \
136+
| head -1)
137+
138+
COVERAGE_BODY=$(cat coverage-report.md)
139+
140+
if [[ -n "$EXISTING_COMMENT" ]]; then
141+
echo "Updating existing comment..."
142+
gh api "repos/${{ github.repository }}/issues/${{ steps.pr-number.outputs.pr_number }}/comments/$EXISTING_COMMENT" \
143+
--method PATCH --field body="$COVERAGE_BODY"
144+
else
145+
echo "Creating new comment..."
146+
gh api "repos/${{ github.repository }}/issues/${{ steps.pr-number.outputs.pr_number }}/comments" \
147+
--method POST --field body="$COVERAGE_BODY"
148+
fi
149+
fi
150+
env:
151+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
152+
continue-on-error: true # Don't fail if baseline coverage doesn't exist yet
153+
154+
coverage-baseline:
155+
# Only run on successful completion of lint-test workflow for main branch
156+
if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main' && github.event.workflow_run.event == 'push'
157+
runs-on: linux-amd64-cpu4
158+
timeout-minutes: 15
159+
steps:
160+
- uses: actions/checkout@v4
161+
with:
162+
ref: ${{ github.event.workflow_run.head_sha }}
163+
164+
- name: Setup Go
165+
uses: actions/setup-go@v5
166+
with:
167+
go-version: 'stable'
168+
169+
- name: Download all coverage artifacts from completed workflow
170+
uses: actions/download-artifact@v4
171+
with:
172+
pattern: "*-results"
173+
path: coverage-artifacts
174+
merge-multiple: true
175+
run-id: ${{ github.event.workflow_run.id }}
176+
177+
- name: Consolidate coverage files
178+
run: |
179+
echo "Consolidating coverage files from all components for baseline..."
180+
mkdir -p consolidated-coverage
181+
182+
# Find all coverage.txt files and merge them
183+
find coverage-artifacts -name "coverage.txt" -type f | while read -r file; do
184+
echo "Processing: $file"
185+
# Extract the mode line (first line) if it's the first file
186+
if [ ! -f consolidated-coverage/coverage.txt ]; then
187+
head -n 1 "$file" > consolidated-coverage/coverage.txt
188+
fi
189+
# Append coverage data (skip mode line)
190+
tail -n +2 "$file" >> consolidated-coverage/coverage.txt
191+
done
192+
193+
echo "Baseline coverage file created:"
194+
ls -la consolidated-coverage/
195+
echo "Total coverage lines: $(wc -l < consolidated-coverage/coverage.txt)"
196+
197+
- name: Upload consolidated coverage baseline
198+
uses: actions/upload-artifact@v4
199+
with:
200+
name: consolidated-code-coverage
201+
path: consolidated-coverage/coverage.txt
202+
retention-days: 90 # Keep baseline longer

‎.github/workflows/lint-test.yml‎

Lines changed: 0 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@ concurrency:
3030
permissions:
3131
contents: read # Required for checking out code
3232
actions: write # Required for uploading test artifacts
33-
pull-requests: write # Required for coverage report comments
3433

3534
env:
3635
# Go cache settings (specific to this workflow)
@@ -170,96 +169,3 @@ jobs:
170169
${{ matrix.component }}/coverage.txt
171170
${{ matrix.component }}/report.xml
172171
173-
consolidated-coverage-report:
174-
if: github.event_name == 'pull_request' || startsWith(github.ref, 'refs/heads/pull-request/')
175-
runs-on: linux-amd64-cpu4
176-
timeout-minutes: 15
177-
needs: [health-monitors-lint-test, modules-lint-test]
178-
steps:
179-
- uses: actions/checkout@v4
180-
181-
- name: Download all coverage artifacts
182-
uses: actions/download-artifact@v4
183-
with:
184-
pattern: "*-results"
185-
path: coverage-artifacts
186-
merge-multiple: true
187-
188-
- name: Consolidate coverage files
189-
run: |
190-
echo "Consolidating coverage files from all components..."
191-
mkdir -p consolidated-coverage
192-
193-
# Find all coverage.txt files and merge them
194-
find coverage-artifacts -name "coverage.txt" -type f | while read -r file; do
195-
echo "Processing: $file"
196-
# Extract the mode line (first line) if it's the first file
197-
if [ ! -f consolidated-coverage/coverage.txt ]; then
198-
head -n 1 "$file" > consolidated-coverage/coverage.txt
199-
fi
200-
# Append coverage data (skip mode line)
201-
tail -n +2 "$file" >> consolidated-coverage/coverage.txt
202-
done
203-
204-
echo "Consolidated coverage file created:"
205-
ls -la consolidated-coverage/
206-
head -n 10 consolidated-coverage/coverage.txt
207-
208-
- name: Upload consolidated coverage
209-
uses: actions/upload-artifact@v4
210-
with:
211-
name: consolidated-code-coverage
212-
path: consolidated-coverage/coverage.txt
213-
retention-days: 30
214-
215-
- name: Generate Go Coverage Report
216-
uses: fgrosse/go-coverage-report@8c1d1a09864211d258937b1b1a5b849f7e4f2682 # v1.2.0
217-
with:
218-
coverage-artifact-name: "consolidated-code-coverage"
219-
coverage-file-name: "coverage.txt"
220-
root-package: "github.com/NVIDIA/nvsentinel"
221-
skip-comment: false
222-
continue-on-error: true # Don't fail if baseline coverage doesn't exist yet
223-
224-
consolidated-coverage-baseline:
225-
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
226-
runs-on: linux-amd64-cpu4
227-
timeout-minutes: 15
228-
needs: [health-monitors-lint-test, modules-lint-test]
229-
steps:
230-
- uses: actions/checkout@v4
231-
232-
- name: Download all coverage artifacts
233-
uses: actions/download-artifact@v4
234-
with:
235-
pattern: "*-results"
236-
path: coverage-artifacts
237-
merge-multiple: true
238-
239-
- name: Consolidate coverage files
240-
run: |
241-
echo "Consolidating coverage files from all components for baseline..."
242-
mkdir -p consolidated-coverage
243-
244-
# Find all coverage.txt files and merge them
245-
find coverage-artifacts -name "coverage.txt" -type f | while read -r file; do
246-
echo "Processing: $file"
247-
# Extract the mode line (first line) if it's the first file
248-
if [ ! -f consolidated-coverage/coverage.txt ]; then
249-
head -n 1 "$file" > consolidated-coverage/coverage.txt
250-
fi
251-
# Append coverage data (skip mode line)
252-
tail -n +2 "$file" >> consolidated-coverage/coverage.txt
253-
done
254-
255-
echo "Baseline coverage file created:"
256-
ls -la consolidated-coverage/
257-
echo "Total coverage lines: $(wc -l < consolidated-coverage/coverage.txt)"
258-
259-
- name: Upload consolidated coverage baseline
260-
uses: actions/upload-artifact@v4
261-
with:
262-
name: consolidated-code-coverage
263-
path: consolidated-coverage/coverage.txt
264-
retention-days: 90 # Keep baseline longer
265-

0 commit comments

Comments
 (0)