ci: measure test coverage and add Codecov badge - #267
Conversation
|
Warning Review limit reached
Next review available in: 54 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. 📝 WalkthroughWalkthroughThe PR adds a GitHub Actions coverage workflow, ignores generated coverage files, and adds a Codecov badge to the README. ChangesCoverage reporting
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Commit Check✅ All 6 checks passed Show all 6 checkscommit-check 2.14.0 · Rules reference |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/coverage.yml:
- Line 16: Update the actions/checkout step in the coverage workflow to set
persist-credentials to false, preventing the checkout token from remaining in
local Git configuration while preserving the existing pinned action reference.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 9e5559e2-b93c-449f-83c1-f1feb4ecff55
📒 Files selected for processing (3)
.github/workflows/coverage.yml.gitignoreREADME.md
| coverage: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -e
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/coverage.yml
printf '%s\n' '--- checkout references ---'
rg -n -C 3 'actions/checkout|persist-credentials|pull_request|permissions|run:' .github/workflows
printf '%s\n' '--- pinned action metadata ---'
curl -fsSL 'https://raw.githubusercontent.com/actions/checkout/3d3c42e5aac5ba805825da76410c181273ba90b1/action.yml' | sed -n '1,180p'Repository: commit-check/commit-check-action
Length of output: 15131
🏁 Script executed:
#!/bin/bash
set -e
python3 - <<'PY'
import re
from pathlib import Path
from urllib.request import urlopen
workflow = Path(".github/workflows/coverage.yml").read_text()
metadata_url = (
"https://raw.githubusercontent.com/actions/checkout/"
"3d3c42e5aac5ba805825da76410c181273ba90b1/action.yml"
)
metadata = urlopen(metadata_url, timeout=10).read().decode()
assert re.search(r"^\s*pull_request:\s*$", workflow, re.M)
assert re.search(r"^\s*permissions:\s*$", workflow, re.M)
assert re.search(r"^\s+contents:\s+read\s*$", workflow, re.M)
checkout = workflow.index("actions/checkout@")
first_run = workflow.index("run:", checkout)
assert first_run > checkout
assert re.search(
r"persist-credentials:\s*[\r\n ]",
metadata,
)
assert re.search(
r"persist-credentials:\s*\n(?:\s+.*\n)*?\s+default:\s*true\b",
metadata,
)
print("pull_request trigger: present")
print("job token permission: contents: read")
print("repository-controlled run step after checkout: present")
print("pinned actions/checkout persist-credentials default: true")
print("pinned actions/checkout token input default: github.token")
PYRepository: commit-check/commit-check-action
Length of output: 2457
🏁 Script executed:
#!/bin/bash
set -e
python3 - <<'PY'
import re
from pathlib import Path
from urllib.request import urlopen
workflow = Path(".github/workflows/coverage.yml").read_text()
metadata = urlopen(
"https://raw.githubusercontent.com/actions/checkout/"
"3d3c42e5aac5ba805825da76410c181273ba90b1/action.yml",
timeout=10,
).read().decode()
assert re.search(r"^\s*pull_request:\s*$", workflow, re.M)
assert re.search(r"^\s*contents:\s+read\s*$", workflow, re.M)
checkout = workflow.index("actions/checkout@")
assert workflow.index("run:", checkout) > checkout
assert re.search(
r"persist-credentials:\s*\n(?:\s+.*\n)*?\s+default:\s*true\b",
metadata,
)
assert re.search(r"default:\s*\$\{\{\s*github\.token\s*\}\}", metadata)
print("pull_request trigger: present")
print("job token permission: contents: read")
print("post-checkout run step: present")
print("persist-credentials default: true")
print("token default: github.token")
PYRepository: commit-check/commit-check-action
Length of output: 2456
🏁 Script executed:
#!/bin/bash
set -e
curl -fsSL \
'https://raw.githubusercontent.com/actions/checkout/3d3c42e5aac5ba805825da76410c181273ba90b1/action.yml' |
python3 -c '
import re
import sys
from pathlib import Path
workflow = Path(".github/workflows/coverage.yml").read_text()
metadata = sys.stdin.read()
assert re.search(r"^\s*pull_request:\s*$", workflow, re.M)
assert re.search(r"^\s*contents:\s+read\s*$", workflow, re.M)
checkout = workflow.index("actions/checkout@")
assert workflow.index("run:", checkout) > checkout
assert re.search(
r"persist-credentials:\s*\n(?:\s+.*\n)*?\s+default:\s*true\b",
metadata,
)
assert re.search(r"default:\s*\$\{\{\s*github\.token\s*\}\}", metadata)
print("pull_request trigger: present")
print("job token permission: contents: read")
print("post-checkout run step: present")
print("persist-credentials default: true")
print("token default: github.token")
'Repository: commit-check/commit-check-action
Length of output: 331
Disable checkout credential persistence.
Because this pull_request job runs repository-controlled code after checkout, the default persist-credentials: true exposes the contents: read token through local Git configuration. Set persist-credentials: false.
Proposed fix
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 16-16: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/coverage.yml at line 16, Update the actions/checkout step
in the coverage workflow to set persist-credentials to false, preventing the
checkout token from remaining in local Git configuration while preserving the
existing pinned action reference.
Source: Linters/SAST tools
Updated Codecov badge token in README.md
1 participant
What
Mirror the coverage setup that commit-check already has:
.github/workflows/coverage.ymlruns the suite withpytest-covon every push tomainand every PR, then uploadscoverage.xmlto Codecov.Design notes
chore/test-add-pr-comments-coverage(which was never merged), including its reviewed tweaks:fail_ci_if_erroronly on push tomain, so a flaky upload never blocks a PRpermissions: contents: readubuntu-latest/ Python 3.10 (the repo's floor, seetest.yml) rather than from the whole 3×2 test matrix — a single deterministic upload, same as the sibling repo's approach.secrets.CODECOV_TOKENinput:codecov-action@v7uploads tokenlessly for public repos. If you'd rather pin it explicitly, addingtoken: ${{ secrets.CODECOV_TOKEN }}is a one-liner (that's what commit-check does)..gitignoregains.coverage*,coverage.xml,htmlcov/; existing entries untouched.Verified locally
pytest --cov=main main_test.py→ 116 passed, 92% coverage (419 stmts, 32 miss)https://codecov.io/gh/commit-check/commit-check-action/branch/main/graph/badge.svg?token=G3R0LFO0YF(token was already public in the repo history)Note: the badge shows the percentage only after the first upload lands on
main.Summary by CodeRabbit