From 8406b5b65bcd293b1a9e12c5d4dee317492e5387 Mon Sep 17 00:00:00 2001 From: Jeremi Joslin Date: Sun, 26 Jul 2026 11:26:53 +0700 Subject: [PATCH 1/2] ci: publish Rust coverage to Codecov Signed-off-by: Jeremi Joslin --- .github/workflows/ci.yml | 26 ++++++++++++ .../workflows/notary-postgres-conformance.yml | 14 +++++++ codecov.yml | 42 +++++++++++++++++++ 3 files changed, 82 insertions(+) create mode 100644 codecov.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9495771c..9a4b00e0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -188,10 +188,14 @@ jobs: needs: changes if: needs.changes.outputs.platform == 'true' runs-on: ubuntu-24.04 + permissions: + contents: read + id-token: write steps: - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 with: + fetch-depth: 0 persist-credentials: false submodules: false @@ -214,6 +218,28 @@ jobs: --all-features --fail-under-lines 80 + - name: Export platform coverage + run: | + set -euo pipefail + coverage_dir="target/platform-coverage" + mkdir -p "${coverage_dir}" + cargo llvm-cov report --locked \ + -p registry-config-report \ + -p 'registry-platform-*' \ + --lcov \ + --output-path "${coverage_dir}/platform.lcov" + + - name: Upload platform coverage to Codecov + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 + with: + disable_search: true + fail_ci_if_error: false + files: target/platform-coverage/platform.lcov + flags: platform + name: platform + use_oidc: true + version: v11.3.1 + platform-hygiene: name: Platform hygiene and config inventory needs: changes diff --git a/.github/workflows/notary-postgres-conformance.yml b/.github/workflows/notary-postgres-conformance.yml index 5db5d1b9..ead7250a 100644 --- a/.github/workflows/notary-postgres-conformance.yml +++ b/.github/workflows/notary-postgres-conformance.yml @@ -58,6 +58,9 @@ jobs: name: Notary state plane (PostgreSQL ${{ matrix.postgresql }}) runs-on: ubuntu-24.04 timeout-minutes: 30 + permissions: + contents: read + id-token: write strategy: fail-fast: false matrix: @@ -138,6 +141,17 @@ jobs: path: target/notary-postgres-conformance/coverage/ if-no-files-found: error + - name: Upload Notary PostgreSQL coverage to Codecov + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 + with: + disable_search: true + fail_ci_if_error: false + files: target/notary-postgres-conformance/coverage/notary-postgresql-${{ matrix.postgresql }}.lcov + flags: notary-postgres + name: notary-postgresql-${{ matrix.postgresql }} + use_oidc: true + version: v11.3.1 + - name: Report PostgreSQL Docker diagnostics if: failure() run: | diff --git a/codecov.yml b/codecov.yml new file mode 100644 index 00000000..938c4860 --- /dev/null +++ b/codecov.yml @@ -0,0 +1,42 @@ +coverage: + status: + default_rules: + flag_coverage_not_uploaded_behavior: exclude + project: + default: off + platform: + flags: + - platform + informational: true + notary-postgres: + flags: + - notary-postgres + informational: true + patch: + default: off + platform: + flags: + - platform + informational: true + notary-postgres: + flags: + - notary-postgres + informational: true + +flags: + platform: + paths: + - "crates/registry-config-report/" + - "crates/registry-platform-*/**" + carryforward: true + notary-postgres: + paths: + - "crates/registry-notary/" + - "crates/registry-notary-server/" + carryforward: true + +comment: + layout: "reach, diff, flags, files" + behavior: default + require_changes: true + show_carryforward_flags: true From 884396fa524cca39641e402e17094f135a9a281c Mon Sep 17 00:00:00 2001 From: Jeremi Joslin Date: Sun, 26 Jul 2026 20:58:41 +0700 Subject: [PATCH 2/2] ci: keep Notary coverage off PRs Signed-off-by: Jeremi Joslin --- .../workflows/notary-postgres-conformance.yml | 67 ++++++++++++++++++- 1 file changed, 66 insertions(+), 1 deletion(-) diff --git a/.github/workflows/notary-postgres-conformance.yml b/.github/workflows/notary-postgres-conformance.yml index ead7250a..6aaf69f8 100644 --- a/.github/workflows/notary-postgres-conformance.yml +++ b/.github/workflows/notary-postgres-conformance.yml @@ -56,6 +56,70 @@ env: jobs: state-plane: name: Notary state plane (PostgreSQL ${{ matrix.postgresql }}) + if: github.event_name == 'pull_request' || github.event_name == 'merge_group' + runs-on: ubuntu-24.04 + timeout-minutes: 30 + strategy: + fail-fast: false + matrix: + include: + - postgresql: "16" + source_image: postgres:16.13-alpine + target_image: postgres:16.14-alpine + - postgresql: "17" + source_image: postgres:17.9-alpine + target_image: postgres:17.10-alpine + - postgresql: "18" + source_image: postgres:18.3-alpine + target_image: postgres:18.4-alpine + steps: + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + with: + fetch-depth: 0 + persist-credentials: false + submodules: false + + - name: Cache Cargo registry and build artifacts + uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 + with: + key: notary-postgresql-pr-${{ matrix.postgresql }} + + - name: Build Registry Notary with CEL support + run: cargo build --locked -p registry-notary --features registry-notary-cel + + - name: Precompile PostgreSQL conformance tests before service startup + run: cargo test --locked -p registry-notary-server --lib --no-run + + - name: Run Notary PostgreSQL conformance + env: + NOTARY_BIN: target/notary-postgres-conformance/debug/registry-notary + NOTARY_POSTGRES_SOURCE_IMAGE: ${{ matrix.source_image }} + NOTARY_POSTGRES_TARGET_IMAGE: ${{ matrix.target_image }} + run: | + set -euo pipefail + diagnostics="${RUNNER_TEMP}/notary-postgresql-${{ matrix.postgresql }}-docker-events.log" + docker events --format '{{json .}}' >"${diagnostics}" & + events_pid=$! + trap 'kill "${events_pid}" 2>/dev/null || true; wait "${events_pid}" 2>/dev/null || true' EXIT + products/notary/scripts/postgresql-conformance.sh "${{ matrix.postgresql }}" + + - name: Report PostgreSQL Docker diagnostics + if: failure() + run: | + set -euo pipefail + diagnostics="${RUNNER_TEMP}/notary-postgresql-${{ matrix.postgresql }}-docker-events.log" + if [[ -s "${diagnostics}" ]]; then + sed -n '1,400p' "${diagnostics}" + else + echo "No Docker events were captured." + fi + docker ps --all --no-trunc + docker version + + state-plane-coverage: + name: Notary state plane (PostgreSQL ${{ matrix.postgresql }}) + if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' runs-on: ubuntu-24.04 timeout-minutes: 30 permissions: @@ -79,12 +143,13 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 with: fetch-depth: 0 + persist-credentials: false submodules: false - name: Cache Cargo registry and build artifacts uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 with: - key: notary-postgresql-${{ matrix.postgresql }} + key: notary-postgresql-coverage-${{ matrix.postgresql }} save-if: ${{ github.ref == 'refs/heads/main' }} - name: Install pinned coverage tool