Stop using codecov, handle coverage ourselves (#1333)

Author: alex

.github/actions/upload-coverage/action.yml

@@ -0,0 +1,21 @@
+name: Upload Coverage
+description: Upload coverage files
+
+runs:
+  using: "composite"
+
+  steps:
+    - run: |
+        COVERAGE_UUID=$(python3 -c "import uuid; print(uuid.uuid4())")
+        echo "COVERAGE_UUID=${COVERAGE_UUID}" >> $GITHUB_OUTPUT
+        if [ -f .coverage ]; then
+          mv .coverage .coverage.${COVERAGE_UUID}
+        fi
+      id: coverage-uuid
+      shell: bash
+    - uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+      with:
+        name: coverage-data-${{ steps.coverage-uuid.outputs.COVERAGE_UUID }}
+        path: |
+          .coverage.*
+        if-no-files-found: ignore

.github/dependabot.yml

@@ -1,6 +1,8 @@
 version: 2
 updates:
   - package-ecosystem: "github-actions"
-    directory: "/"
+    directories:
+      - "/"
+      - "/.github/actions/*/"
     schedule:
       interval: "daily"

.github/workflows/ci.yml

@@ -59,10 +59,7 @@ jobs:
       - run: tox -v
         env:
           TOXENV: ${{ matrix.PYTHON.TOXENV }}
-      - name: Upload coverage
-        run: |
-          curl -o codecov.sh -f https://codecov.io/bash || curl -o codecov.sh -f https://codecov.io/bash || curl -o codecov.sh -f https://codecov.io/bash
-          bash codecov.sh -n "tox -e ${{ matrix.PYTHON.TOXENV }}"
+      - uses: ./.github/actions/upload-coverage
 
   linux-docker:
     runs-on: ubuntu-latest
@@ -80,10 +77,7 @@ jobs:
         env:
           TOXENV: ${{ matrix.TEST.TOXENV }}
           RUSTUP_HOME: /root/.rustup
-      - name: Upload coverage
-        run: |
-          curl -o codecov.sh -f https://codecov.io/bash || curl -o codecov.sh -f https://codecov.io/bash || curl -o codecov.sh -f https://codecov.io/bash
-          bash codecov.sh -n "tox -e ${{ matrix.TEST.TOXENV }} on ${{ matrix.TEST.CONTAINER }}"
+      - uses: ./.github/actions/upload-coverage
 
   all-green:
     runs-on: ubuntu-latest
@@ -95,3 +89,44 @@ jobs:
         uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
         with:
           jobs: ${{ toJSON(needs) }}
+
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        timeout-minutes: 3
+        with:
+          persist-credentials: false
+      - name: Setup python
+        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
+        with:
+          python-version: '3.12'
+        timeout-minutes: 3
+      - run: pip install coverage[toml]
+      - name: Download coverage data
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          pattern: coverage-data-*
+          merge-multiple: true
+      - name: Combine coverage and fail if it's too low
+        id: combinecoverage
+        run: |
+          set +e
+          python -m coverage combine
+          echo "## Python Coverage" >> $GITHUB_STEP_SUMMARY
+          python -m coverage report -m --fail-under=98 > COV_REPORT
+          COV_EXIT_CODE=$?
+          cat COV_REPORT
+          if [ $COV_EXIT_CODE -ne 0 ]; then
+            echo "🚨 Python Coverage failed. Coverage too low." | tee -a $GITHUB_STEP_SUMMARY
+          fi
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          cat COV_REPORT >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          exit $COV_EXIT_CODE
+      - name: Create coverage HTML
+        run: python -m coverage html
+        if: ${{ failure() && steps.combinecoverage.outcome == 'failure' }}
+      - name: Upload HTML report.
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+        with:
+          name: _html-report
+          path: htmlcov
+          if-no-files-found: ignore

MANIFEST.in

@@ -1,5 +1,5 @@
 include             LICENSE MANIFEST.in *.rst tox.ini .coveragerc src/OpenSSL/py.typed
-exclude             codecov.yml .readthedocs.yml mypy.ini
+exclude             .readthedocs.yml mypy.ini
 recursive-include   tests           *.py
 recursive-include   doc             *
 prune               doc/_build

README.rst

@@ -9,10 +9,6 @@ pyOpenSSL -- A Python wrapper around the OpenSSL library
 .. image:: https://github.com/pyca/pyopenssl/workflows/CI/badge.svg?branch=main
    :target: https://github.com/pyca/pyopenssl/actions?query=workflow%3ACI+branch%3Amain
 
-.. image:: https://codecov.io/github/pyca/pyopenssl/branch/main/graph/badge.svg
-   :target: https://codecov.io/github/pyca/pyopenssl
-   :alt: Test coverage
-
 **Note:** The Python Cryptographic Authority **strongly suggests** the use of `pyca/cryptography`_
 where possible. If you are using pyOpenSSL for anything other than making a TLS connection
 **you should move to cryptography and drop your pyOpenSSL dependency**.

codecov.yml

@@ -1,12 +1,15 @@
 [tool.coverage.run]
 branch = true
+relative_files = true
 source = ["OpenSSL", "tests/"]
 
 [tool.coverage.paths]
 source = [
     "src/OpenSSL",
-    ".tox/*/lib/python*/site-packages/OpenSSL",
-    ".tox/pypy/site-packages/OpenSSL",
+    "*.tox/*/lib/python*/site-packages/OpenSSL",
+    "*.tox/*/lib/pypy*/site-packages/OpenSSL",
+    "*.tox/pypy/site-packages/OpenSSL",
+    "*.tox\\*\\Lib\\site-packages\\OpenSSL",
 ]
 
 [tool.coverage.report]