From 6a15762800e989dfe4bc9bf58f6aa01bae64e9a5 Mon Sep 17 00:00:00 2001
From: Max <maxtropets@microsoft.com>
Date: Sat, 16 May 2026 12:17:01 +0000
Subject: [PATCH 1/2] Separate coverage

---
 .github/workflows/coverage.yml | 115 +++++++++++++++++++++++++++++++++
 1 file changed, 115 insertions(+)
 create mode 100644 .github/workflows/coverage.yml

diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
new file mode 100644
index 00000000000..8232f61c1ef
--- /dev/null
+++ b/.github/workflows/coverage.yml
@@ -0,0 +1,115 @@
+name: "Coverage"
+
+on:
+  schedule:
+    - cron: "0 8,20 * * 1-5"
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  coverage_virtual:
+    name: "Coverage Virtual"
+    runs-on:
+      [
+        self-hosted,
+        1ES.Pool=gha-vmss-d16av5-ci,
+        "JobId=ci_coverage-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}",
+      ]
+    container:
+      image: mcr.microsoft.com/azurelinux/base/core:3.0
+      options: --user root --publish-all --cap-add NET_ADMIN --cap-add NET_RAW --cap-add SYS_PTRACE
+
+    steps:
+      - name: "Checkout dependencies"
+        shell: bash
+        run: |
+          set -ex
+          gpg --import /etc/pki/rpm-gpg/MICROSOFT-RPM-GPG-KEY
+          tdnf -y update
+          tdnf -y install ca-certificates git
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 0
+
+      - name: "Install dependencies"
+        shell: bash
+        run: |
+          set -ex
+          ./scripts/setup-ci.sh
+
+      - name: "Build Debug with coverage"
+        run: |
+          set -ex
+          git config --global --add safe.directory /__w/CCF/CCF
+          mkdir build
+          cd build
+          cmake -GNinja -DCMAKE_BUILD_TYPE=Debug -DCOVERAGE=ON ..
+          ninja
+        shell: bash
+
+      - name: "Run Unit tests"
+        run: |
+          set -ex
+          cd build
+          ./tests.sh --output-on-failure -L unit -j$(nproc --all)
+        shell: bash
+
+      - name: "End to end tests except partition"
+        run: |
+          set -ex
+          cd build
+          rm -rf /github/home/.cache
+          mkdir -p /github/home/.cache
+
+          # End to end tests
+          ./tests.sh --timeout 360 --output-on-failure -LE "benchmark|suite|unit"
+        shell: bash
+
+      - name: "Generate coverage reports"
+        run: |
+          set -ex
+          cd build
+          ../scripts/coverage.sh --html coverage_html | tee coverage_report.txt
+        shell: bash
+
+      - name: "Write coverage summary"
+        if: always()
+        run: |
+          set -ex
+          cd build
+          if [[ -f coverage_report.txt ]]; then
+            {
+              echo '## Code Coverage'
+              echo ''
+              echo '```'
+              cat coverage_report.txt
+              echo '```'
+            } >> "$GITHUB_STEP_SUMMARY"
+          fi
+        shell: bash
+
+      - name: "Upload HTML coverage report"
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: coverage-report-html
+          path: build/coverage_html/
+          if-no-files-found: ignore
+        if: success() || failure()
+
+      - name: "Upload logs"
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: logs-coverage-virtual
+          path: |
+            build/workspace/*/*.config.json
+            build/workspace/*/out
+            build/workspace/*/err
+            build/workspace/*/*.ledger/*
+            build/workspace/*/stack_trace
+          if-no-files-found: ignore
+        if: success() || failure()

From dbe33e3084c604466cde470c670e7ae10ba2d3a1 Mon Sep 17 00:00:00 2001
From: Max <maxtropets@gmail.com>
Date: Sat, 16 May 2026 13:30:07 +0100
Subject: [PATCH 2/2] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/coverage.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 8232f61c1ef..aa41989a99a 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -72,7 +72,7 @@ jobs:
 
       - name: "Generate coverage reports"
         run: |
-          set -ex
+          set -exo pipefail
           cd build
           ../scripts/coverage.sh --html coverage_html | tee coverage_report.txt
         shell: bash