chore: coverage scripts collection simplifications

.github/scripts/coverage/compare-coverage.sh

@@ -20,7 +20,7 @@ fi
 
 CURR_TOTAL=$(jq -r '.total_pct' "$CURRENT")
 PREV_TOTAL=$(jq -r '.total_pct' "$PREVIOUS")
-TOTAL_DELTA=$(echo "$CURR_TOTAL - $PREV_TOTAL" | bc -l)
+TOTAL_DELTA=$(bc -l <<<"$CURR_TOTAL - $PREV_TOTAL")
 
 CURR_REF=$(jq -r '.ref // "head"' "$CURRENT")
 PREV_REF=$(jq -r '.ref // "base"' "$PREVIOUS")
@@ -45,8 +45,8 @@ PACKAGE_COMPARISON=$(jq -n \
 		}
 	)')
 
-TOP_DROPS=$(echo "$PACKAGE_COMPARISON" | jq '[map(select(.delta != null and .delta < 0)) | sort_by(.delta) | .[:10] | .[]]')
-TOP_GAINS=$(echo "$PACKAGE_COMPARISON" | jq '[map(select(.delta != null and .delta > 0)) | sort_by(-.delta) | .[:5] | .[]]')
+TOP_DROPS=$(jq '[map(select(.delta != null and .delta < 0)) | sort_by(.delta) | .[:10] | .[]]' <<<"$PACKAGE_COMPARISON")
+TOP_GAINS=$(jq '[map(select(.delta != null and .delta > 0)) | sort_by(-.delta) | .[:5] | .[]]' <<<"$PACKAGE_COMPARISON")
 
 jq -n \
 	--argjson curr_total "$CURR_TOTAL" \
@@ -94,14 +94,14 @@ jq -n \
 	printf '<tr class="total"><td>TOTAL</td><td>%.1f%%</td><td>%.1f%%</td><td>%+.1f%%</td></tr>\n' "$PREV_TOTAL" "$CURR_TOTAL" "$TOTAL_DELTA"
 
 	# All packages sorted by name
-	echo "$PACKAGE_COMPARISON" | jq -r 'sort_by(.package) | .[] |
+	jq -r 'sort_by(.package) | .[] |
 		if .previous == null then
 			"<tr class=\"new\"><td>\(.package)</td><td>—</td><td>\(.current)%</td><td>new</td></tr>"
 		elif .current == null then
 			"<tr class=\"removed\"><td>\(.package)</td><td>\(.previous)%</td><td>—</td><td>removed</td></tr>"
 		else
 			"<tr><td>\(.package)</td><td>\(.previous)%</td><td>\(.current)%</td><td>\(.delta)%</td></tr>"
-		end'
+		end' <<<"$PACKAGE_COMPARISON"
 
 	cat <<-FOOTER
 	</table>
@@ -114,15 +114,15 @@ echo "=== Coverage Comparison ==="
 printf "Total: %.1f%% (was %.1f%%, delta: %+.1f%%)\n" "$CURR_TOTAL" "$PREV_TOTAL" "$TOTAL_DELTA"
 echo ""
 
-if [[ $(echo "$TOP_DROPS" | jq 'length') -gt 0 ]]; then
+if [[ $(jq 'length' <<<"$TOP_DROPS") -gt 0 ]]; then
 	echo "Top drops:"
-	echo "$TOP_DROPS" | jq -r '.[] | "  \(.package): \(.previous)% → \(.current)% (\(.delta)%)"'
+	jq -r '.[] | "  \(.package): \(.previous)% → \(.current)% (\(.delta)%)"' <<<"$TOP_DROPS"
 	echo ""
 fi
 
-if [[ $(echo "$TOP_GAINS" | jq 'length') -gt 0 ]]; then
+if [[ $(jq 'length' <<<"$TOP_GAINS") -gt 0 ]]; then
 	echo "Top gains:"
-	echo "$TOP_GAINS" | jq -r '.[] | "  \(.package): \(.previous)% → \(.current)% (+\(.delta)%)"'
+	jq -r '.[] | "  \(.package): \(.previous)% → \(.current)% (+\(.delta)%)"' <<<"$TOP_GAINS"
 	echo ""
 fi
 

.github/scripts/coverage/download-previous-release.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+TAG_NAME="${TAG_NAME:?Required environment variable TAG_NAME}"
+OUTPUT_DIR="${1:-previous}"
+
+mkdir -p "$OUTPUT_DIR"
+
+PREV_TAG=$(gh release list --exclude-drafts --exclude-pre-releases -L 50 --json tagName \
+	| jq -r --arg tag "${TAG_NAME}" '[.[].tagName] as $tags | ($tags | index($tag)) as $i | if $i == null or ($i + 1) >= ($tags | length) then empty else $tags[$i + 1] end')
+
+if [[ -n "$PREV_TAG" ]]; then
+	echo "Previous release: $PREV_TAG"
+	if gh release download "$PREV_TAG" -p "coverage-summary.json" -D "$OUTPUT_DIR/" 2>/dev/null; then
+		echo "has_previous=true"
+	else
+		echo "No coverage data in previous release $PREV_TAG"
+		echo "has_previous=false"
+	fi
+else
+	echo "No previous release found"
+	echo "has_previous=false"
+fi

.github/scripts/coverage/download-previous.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+REPO="${REPO:?Required environment variable REPO}"
+BRANCH="${BRANCH:?Required environment variable BRANCH}"
+CURRENT_RUN_ID="${CURRENT_RUN_ID:?Required environment variable CURRENT_RUN_ID}"
+OUTPUT_DIR="${1:-previous}"
+
+mkdir -p "$OUTPUT_DIR"
+
+# Find last successful CI run on this branch (excluding current)
+PREV_RUN_ID=$(gh api "repos/${REPO}/actions/workflows/ci.yml/runs?branch=${BRANCH}&status=success&per_page=5" \
+	--jq "[.workflow_runs[] | select(.id != ${CURRENT_RUN_ID})][0].id")
+
+if [[ -z "$PREV_RUN_ID" || "$PREV_RUN_ID" == "null" ]]; then
+	echo "No previous successful run found on $BRANCH"
+	echo "has_previous=false"
+	exit 0
+fi
+
+echo "Previous run: $PREV_RUN_ID"
+
+# Find the coverage-summary.json artifact in that run
+ARTIFACT_ID=$(gh api "repos/${REPO}/actions/runs/${PREV_RUN_ID}/artifacts" \
+	--jq '.artifacts[] | select(.name == "coverage-summary.json") | .id')
+
+if [[ -z "$ARTIFACT_ID" || "$ARTIFACT_ID" == "null" ]]; then
+	echo "No coverage artifact in previous run"
+	echo "has_previous=false"
+	exit 0
+fi
+
+# Download and extract
+gh api "repos/${REPO}/actions/artifacts/${ARTIFACT_ID}/zip" >/tmp/prev-coverage.zip
+unzip -o /tmp/prev-coverage.zip -d "$OUTPUT_DIR/"
+echo "has_previous=true"

.github/scripts/coverage/write-summary-compare.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+REPORT="${1:-comparison-report.json}"
+BASE_REF="${BASE_REF:-base}"
+HEAD_REF="${HEAD_REF:-head}"
+SUMMARY_FILE="${GITHUB_STEP_SUMMARY:-/dev/stdout}"
+
+if [[ ! -f "$REPORT" ]]; then
+	echo "No comparison report found, skipping summary."
+	exit 0
+fi
+
+# Sanitize user inputs for markdown injection
+BASE_REF=$(tr -d '<>|`\n\r' <<<"$BASE_REF")
+HEAD_REF=$(tr -d '<>|`\n\r' <<<"$HEAD_REF")
+
+CURR=$(jq -r '.current_total' "$REPORT")
+PREV=$(jq -r '.previous_total' "$REPORT")
+DELTA=$(jq -r '.total_delta' "$REPORT")
+
+{
+	echo "## Coverage Comparison: ${BASE_REF} vs ${HEAD_REF}"
+	echo ""
+	echo "| Ref | Coverage |"
+	echo "|-----|----------|"
+	echo "| ${BASE_REF} (base) | ${PREV}% |"
+	echo "| ${HEAD_REF} (head) | ${CURR}% |"
+	echo "| Delta | ${DELTA}% |"
+	echo ""
+} >>"$SUMMARY_FILE"
+
+DROPS=$(jq -r '.top_drops[:10][] | "| \(.package) | \(.previous)% | \(.current)% | \(.delta)% |"' "$REPORT" 2>/dev/null || true)
+if [[ -n "$DROPS" ]]; then
+	{
+		echo "### Top Drops"
+		echo "| Package | Base | Head | Delta |"
+		echo "|---------|------|------|-------|"
+		echo "$DROPS"
+	} >>"$SUMMARY_FILE"
+fi
+
+GAINS=$(jq -r '.top_gains[:5][] | "| \(.package) | \(.previous)% | \(.current)% | +\(.delta)% |"' "$REPORT" 2>/dev/null || true)
+if [[ -n "$GAINS" ]]; then
+	{
+		echo ""
+		echo "### Top Gains"
+		echo "| Package | Base | Head | Delta |"
+		echo "|---------|------|------|-------|"
+		echo "$GAINS"
+	} >>"$SUMMARY_FILE"
+fi

.github/scripts/coverage/write-summary.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+REPORT="${1:-comparison-report.json}"
+SUMMARY_FILE="${GITHUB_STEP_SUMMARY:-/dev/stdout}"
+
+if [[ ! -f "$REPORT" ]]; then
+	echo "No comparison report found, skipping summary."
+	exit 0
+fi
+
+BASELINE=$(jq -r '.baseline' "$REPORT")
+
+if [[ "$BASELINE" == "true" ]]; then
+	{
+		echo "## Coverage Baseline Established"
+		echo ""
+		echo "Total: $(jq -r '.current_total' "$REPORT")%"
+	} >>"$SUMMARY_FILE"
+	exit 0
+fi
+
+CURR=$(jq -r '.current_total' "$REPORT")
+PREV=$(jq -r '.previous_total' "$REPORT")
+DELTA=$(jq -r '.total_delta' "$REPORT")
+
+{
+	echo "## :bar_chart: Coverage Diff"
+	echo ""
+	echo "| Metric | Value |"
+	echo "|--------|-------|"
+	echo "| Current | ${CURR}% |"
+	echo "| Previous | ${PREV}% |"
+	echo "| Delta | ${DELTA}% |"
+	echo ""
+} >>"$SUMMARY_FILE"
+
+DROPS=$(jq -r '.top_drops[:5][] | "| \(.package) | \(.previous)% | \(.current)% | \(.delta)% |"' "$REPORT" 2>/dev/null || true)
+if [[ -n "$DROPS" ]]; then
+	{
+		echo "### Top Drops"
+		echo "| Package | Previous | Current | Delta |"
+		echo "|---------|----------|---------|-------|"
+		echo "$DROPS"
+	} >>"$SUMMARY_FILE"
+fi
+
+GAINS=$(jq -r '.top_gains[:5][] | "| \(.package) | \(.previous)% | \(.current)% | +\(.delta)% |"' "$REPORT" 2>/dev/null || true)
+if [[ -n "$GAINS" ]]; then
+	{
+		echo ""
+		echo "### Top Gains"
+		echo "| Package | Previous | Current | Delta |"
+		echo "|---------|----------|---------|-------|"
+		echo "$GAINS"
+	} >>"$SUMMARY_FILE"
+fi

.github/scripts/setup/mount-tmpfs.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+#
+# Mount tmpfs (Linux) or RAM disk (macOS) for faster CI builds.
+#
+# Usage: mount-tmpfs.sh [OPTIONS] [EXTRA_PATH:SIZE ...]
+#   --go-build-only   Only mount go-build cache (minimal mode)
+#   EXTRA_PATH:SIZE   Additional cache dirs under ~/.cache to mount
+#                     e.g. terragrunt:4G golangci-lint:2G
+
+set -euo pipefail
+
+GO_BUILD_ONLY=false
+EXTRAS=()
+
+for arg in "$@"; do
+	case "$arg" in
+	--go-build-only) GO_BUILD_ONLY=true ;;
+	*) EXTRAS+=("$arg") ;;
+	esac
+done
+
+case "$(uname -s)" in
+Linux)
+	if [[ "$GO_BUILD_ONLY" == "true" ]]; then
+		mkdir -p /home/runner/.cache/go-build
+		sudo mount -t tmpfs -o size=4G tmpfs /home/runner/.cache/go-build
+	else
+		sudo mount -t tmpfs -o size=12G tmpfs /tmp
+		mkdir -p /home/runner/go
+		sudo mount -t tmpfs -o size=12G tmpfs /home/runner/go
+		mkdir -p /home/runner/.cache/go-build
+		sudo mount -t tmpfs -o size=4G tmpfs /home/runner/.cache/go-build
+	fi
+
+	for extra in "${EXTRAS[@]}"; do
+		path="/home/runner/.cache/${extra%%:*}"
+		size="${extra##*:}"
+		mkdir -p "$path"
+		sudo mount -t tmpfs -o size="$size" tmpfs "$path"
+	done
+	;;
+Darwin)
+	RAMDISK=$(hdiutil attach -nomount ram://8388608 | tr -d '[:space:]') || {
+		echo "Failed to create RAM disk"
+		exit 1
+	}
+	# Wait for disk device to be registered in kernel
+	for _ in $(seq 1 10); do
+		diskutil info "$RAMDISK" >/dev/null 2>&1 && break
+		sleep 1
+	done
+	diskutil erasevolume HFS+ RAMDisk "$RAMDISK"
+	mkdir -p /Volumes/RAMDisk/go-build
+	rm -rf ~/Library/Caches/go-build
+	ln -sf /Volumes/RAMDisk/go-build ~/Library/Caches/go-build
+	;;
+*)
+	echo "Unsupported OS: $(uname -s)" >&2
+	exit 1
+	;;
+esac

.github/workflows/base-test.yml

@@ -17,40 +17,22 @@ jobs:
       GOGC: "400"
 
     steps:
-      - name: "Mount tmpfs"
+      - name: Fetch setup scripts
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          sparse-checkout: .github/scripts/setup
+          path: _setup-scripts
+          fetch-depth: 1
+
+      - name: Mount tmpfs / RAM disk
         shell: bash
-        if: runner.os == 'Linux'
-        run: |
-          sudo mount -t tmpfs -o size=12G tmpfs /tmp
-          mkdir -p /home/runner/go
-          sudo mount -t tmpfs -o size=12G tmpfs /home/runner/go
-          mkdir -p /home/runner/.cache/go-build
-          sudo mount -t tmpfs -o size=4G tmpfs /home/runner/.cache/go-build
-          mkdir -p /home/runner/.cache/terragrunt
-          sudo mount -t tmpfs -o size=4G tmpfs /home/runner/.cache/terragrunt
+        run: ./_setup-scripts/.github/scripts/setup/mount-tmpfs.sh terragrunt:4G
 
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 1
 
-      # RAM disk for go-build cache — persists through post-steps so cache save works.
-      # If ramdisk is unmounted before job cleanup, cache save will fail silently.
-      - name: "Mount RAM disk"
-        shell: bash
-        if: runner.os == 'macOS'
-        run: |
-          RAMDISK=$(hdiutil attach -nomount ram://8388608 | tr -d '[:space:]') || { echo "Failed to create RAM disk"; exit 1; }
-          # Wait for disk device to be registered in kernel (hdiutil may return before kernel is ready)
-          for i in $(seq 1 10); do
-            diskutil info "$RAMDISK" > /dev/null 2>&1 && break
-            sleep 1
-          done
-          diskutil erasevolume HFS+ RAMDisk "$RAMDISK"
-          mkdir -p /Volumes/RAMDisk/go-build
-          rm -rf ~/Library/Caches/go-build
-          ln -sf /Volumes/RAMDisk/go-build ~/Library/Caches/go-build
-
       - name: Use mise to install dependencies
         uses: jdx/mise-action@c1ecc8f748cd28cdeabf76dab3cccde4ce692fe4 # v4.0.0
         with:

.github/workflows/build-no-proxy.yml

@@ -27,15 +27,16 @@ jobs:
             arch: amd64
 
     steps:
-      - name: "Mount tmpfs"
+      - name: Fetch setup scripts
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          sparse-checkout: .github/scripts/setup
+          path: _setup-scripts
+          fetch-depth: 1
+
+      - name: Mount tmpfs / RAM disk
         shell: bash
-        if: runner.os == 'Linux'
-        run: |
-          sudo mount -t tmpfs -o size=12G tmpfs /tmp
-          mkdir -p /home/runner/go
-          sudo mount -t tmpfs -o size=12G tmpfs /home/runner/go
-          mkdir -p /home/runner/.cache/go-build
-          sudo mount -t tmpfs -o size=4G tmpfs /home/runner/.cache/go-build
+        run: ./_setup-scripts/.github/scripts/setup/mount-tmpfs.sh
 
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6