name: coverage

# Nightly plus manual dispatch. The report is uploaded as an artifact rather
# than printed into the run log, so a scheduled run leaves something to fetch.
#
# ⚠️ The hour is deliberate: at the default job capacity of 1
# (`services.hyperhive.deploy.forgejo.ci.concurrency`) this job holds the
# runner for its whole timeout and everything else queues behind it.
#
# Separate from ci.yml because a `workflow_dispatch` trigger there fires every
# job in that file, and this must not run per pull request.
on:
  workflow_dispatch:
  schedule:
    - cron: "0 2 * * *"

jobs:
  coverage:
    name: cargo llvm-cov
    runs-on: [hive-ci]
    # Above the 30 min `nix flake check` allows, because instrumented
    # builds are slower than the ordinary ones and this starts from a
    # cache that the normal jobs never populate.
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v3
      - name: coverage
        # No threshold and no `--fail-under-lines`: a coverage gate
        # mostly teaches people to write assertion-free tests that
        # execute lines. The report is the deliverable; the number is
        # for a human to look at.
        #
        # `--workspace` because the interesting holes are in the crates
        # nobody runs directly, and the per-crate default would hide
        # exactly those behind a green summary for the one crate someone
        # happened to name.
        #
        # `pipefail` or the step reports `tee`'s status, and a failed run
        # uploads an empty report as a success.
        run: |
          set -o pipefail
          nix develop -c cargo llvm-cov --workspace --summary-only | tee coverage-summary.txt
      - name: keep the report
        # `always()`: a failed run should still leave its partial output.
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: coverage-summary
          path: coverage-summary.txt