gha: upload coverage to codecov

Signed-off-by: Aleksa Sarai <[email protected]>

Author: cyphar

.github/workflows/ci.yml

@@ -97,17 +97,26 @@ jobs:
       - name: unit tests
         run: |
           if (Test-Path 'env:GOCOVERDIR') {
-            go test -v -cover '-test.gocoverdir' "$env:GOCOVERDIR" ./...
+            go test -v -cover ./... -args '-test.gocoverdir' "$env:GOCOVERDIR"
           } else {
-            go test -v ./...
+            go test -v -cover -coverprofile codecov-coverage.txt ./...
           }
-      - name: upload coverage
+      - name: upload coverage artefact
         # We can only use -test.gocoverdir for Go >= 1.20.
         if: ${{ matrix.go-version != '1.18' && matrix.go-version != '1.19' }}
         uses: actions/upload-artifact@v4
         with:
           name: coverage-${{ runner.os }}-${{ github.job }}-${{ strategy.job-index }}
           path: ${{ env.GOCOVERDIR }}
+      - name: collate coverage data for codecov
+        if: ${{ env.GOCOVERDIR != '' }}
+        run: go tool covdata textfmt -i "$env:GOCOVERDIR" -o "codecov-coverage.txt"
+      - name: upload coverage to codecov
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          slug: cyphar/filepath-securejoin
+          files: codecov-coverage.txt
 
   test-unix:
     strategy:
@@ -143,16 +152,35 @@ jobs:
           GOCOVERDIR="$(mktemp --tmpdir -d gocoverdir.XXXXXXXX)"
           echo "GOCOVERDIR=$GOCOVERDIR" >>"$GITHUB_ENV"
       - name: go test
-        run: go test -v -timeout=30m ${GOCOVERDIR:+-cover -test.gocoverdir="$GOCOVERDIR"} ./...
+        run: |-
+          if [ -n "${GOCOVERDIR:-}" ]; then
+            go test -v -timeout=30m -cover ./... -args -test.gocoverdir="$GOCOVERDIR"
+          else
+            go test -v -timeout=30m -cover -coverprofile codecov-coverage.txt ./...
+          fi
       - name: sudo go test
-        run: sudo go test -v -timeout=30m ${GOCOVERDIR:+-cover -test.gocoverdir="$GOCOVERDIR"} ./...
-      - name: upload coverage
+        run: |-
+          if [ -n "${GOCOVERDIR:-}" ]; then
+            sudo go test -v -timeout=30m -cover ./... -args -test.gocoverdir="$GOCOVERDIR"
+          else
+            sudo go test -v -timeout=30m -cover -coverprofile codecov-coverage-sudo.txt ./...
+          fi
+      - name: upload coverage artefact
         # We can only use -test.gocoverdir for Go >= 1.20.
         if: ${{ matrix.go-version != '1.18' && matrix.go-version != '1.19' }}
         uses: actions/upload-artifact@v4
         with:
           name: coverage-${{ runner.os }}-${{ github.job }}-${{ strategy.job-index }}
           path: ${{ env.GOCOVERDIR }}
+      - name: collate coverage data
+        if: ${{ env.GOCOVERDIR != '' }}
+        run: go tool covdata textfmt -i "$GOCOVERDIR" -o "codecov-coverage.txt"
+      - name: upload coverage to codecov
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          slug: cyphar/filepath-securejoin
+          files: codecov-coverage.txt,codecov-coverage-sudo.txt
 
   coverage:
     runs-on: ubuntu-latest

codecov.yaml

@@ -0,0 +1,20 @@
+comment:
+  layout: "condensed_header, reach, diff, components, condensed_files, condensed_footer"
+  require_changes: true
+  branches:
+    - main
+
+coverage:
+  range: 60..100
+  status:
+    project:
+      default:
+        target: 85%
+        threshold: 0%
+      delta:
+        target: auto
+        informational: true
+
+github_checks:
+  annotations: false
+