Skip to content

Add codecov config #4568

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Zeta201 wants to merge 1 commit into
base: 4.12.x
Choose a base branch
from
Open

Add codecov config #4568

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
177 changes: 177 additions & 0 deletions .github/workflows/coverage-generator.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,177 @@
name: Code Coverage Generator

on:
workflow_dispatch:
schedule:
# Daily 22:00 UTC (3.30 AM SL time).
- cron: '00 22 * * *'
Comment on lines +3 to +7

@coderabbitai coderabbitai Bot Apr 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
curl -s "https://api.github.com/repos/wso2/carbon-kernel" | jq -r '.default_branch'

Repository: wso2/carbon-kernel

Length of output: 66

🏁 Script executed:

#!/bin/bash
# Get full API response to diagnose the null result
curl -s "https://api.github.com/repos/wso2/carbon-kernel" | head -100

Repository: wso2/carbon-kernel

Length of output: 341

🏁 Script executed:

#!/bin/bash
# Check if the repository exists by testing different API endpoints
curl -s -w "\nHTTP Status: %{http_code}\n" "https://api.github.com/repos/wso2/carbon-kernel" | head -50

Repository: wso2/carbon-kernel

Length of output: 359

🏁 Script executed:

#!/bin/bash
# Try alternative approach: check git remote if this is a cloned repo
# and look for any branch/default-branch related files
git ls-files | grep -E "(branch|default)" || echo "No branch-related files found"
git config --get-all | grep -i branch || echo "No git config branch settings"

Repository: wso2/carbon-kernel

Length of output: 2541

🏁 Script executed:

#!/bin/bash
# Check current git branch
git symbolic-ref --short HEAD 2>/dev/null || git rev-parse --abbrev-ref HEAD || echo "Unable to determine branch"

Repository: wso2/carbon-kernel

Length of output: 66

🏁 Script executed:

#!/bin/bash
# Check git remote URL and look for any branch/PR information
git remote -v
echo "---"
git branch -a | head -20

Repository: wso2/carbon-kernel

Length of output: 294

🏁 Script executed:

#!/bin/bash
# Check if there are any other workflow files that might hint at branch strategy
find .github/workflows -name "*.yml" -o -name "*.yaml" | head -10 | xargs grep -l "branches:" 2>/dev/null || echo "No branch filters found in workflows"

Repository: wso2/carbon-kernel

Length of output: 94

Scheduled workflows only run on the default branch (master).

If this change is intended for the 4.12.x branch, the cron trigger on line 7 will never execute. Move this workflow to the default branch or remove the schedule trigger from non-default branches.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/coverage-generator.yml around lines 3 - 7, The scheduled
cron trigger (the schedule: and cron: '00 22 * * *' entries) will only run on
the repository's default branch (master), so either move this workflow file to
the default branch or remove the schedule block from this branch; update the
workflow by deleting the schedule: section (and its cron entry) if you intend to
keep it in the 4.12.x branch, or relocate the entire workflow file to master so
the cron will execute.


jobs:
build-source:
runs-on: ubuntu-latest

steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Set up Adopt JDK 21
uses: actions/setup-java@v4
with:
java-version: 21
distribution: "adopt"

- name: Build with Maven
run: |
mvn clean install -U -B -Dmaven.test.skip=true

- name: Cache source code
uses: actions/cache@v4
with:
path: .
key: ${{ runner.os }}-source-${{ github.sha }}

oidc-conformance-report:
needs: build-source
runs-on: ubuntu-latest

steps:
- name: Restore source code
uses: actions/cache@v4
with:
path: .
key: ${{ runner.os }}-source-${{ github.sha }}
restore-keys: |
${{ runner.os }}-source-

- name: Get the latest Jacoco report URL
id: get-artifact-url-oidc
run: |
GITHUB_API_URL="https://api.github.com"
OWNER="wso2"
REPO="product-is"
WORKFLOW_ID="oidc-conformance-test.yml"
GITHUB_TOKEN="${{ secrets.GITHUB_TOKEN }}"

# Get the latest successful workflow run
WORKFLOW_RUNS=$(curl -s -H "Authorization: token $GITHUB_TOKEN" "$GITHUB_API_URL/repos/$OWNER/$REPO/actions/workflows/$WORKFLOW_ID/runs?status=success&per_page=1")
Comment on lines +46 to +56

@coderabbitai coderabbitai Bot Apr 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
curl -s "https://api.github.com/repos/wso2/product-is/actions/workflows/oidc-conformance-test.yml/runs?status=success&per_page=5" \
  | jq -r '.workflow_runs[] | [.id, .head_branch, .head_sha, .created_at] | `@tsv`'

curl -s "https://api.github.com/repos/wso2/product-is/actions/workflows/fapi-oidc-conformance-test.yml/runs?status=success&per_page=5" \
  | jq -r '.workflow_runs[] | [.id, .head_branch, .head_sha, .created_at] | `@tsv`'

Repository: wso2/carbon-kernel

Length of output: 541

🏁 Script executed:

cat -n .github/workflows/coverage-generator.yml | head -180

Repository: wso2/carbon-kernel

Length of output: 7172

Pin external coverage artifacts to the branch being reported.

The GitHub API calls at lines 56 and 116 fetch the latest successful workflow run across all branches, and line 169 uses Jenkins lastSuccessfulBuild without branch restriction. This means coverage artifacts from a different branch or commit than the sources Codecov is indexing can be published together.

To fix, add branch filtering to the GitHub API queries:

  • Line 56: Add &head_branch=main (or appropriate branch name) to the API query
  • Line 116: Add &head_branch=main to the API query
  • Line 169: Specify a branch-specific Jenkins build URL instead of lastSuccessfulBuild
🧰 Tools
🪛 actionlint (1.7.12)

[error] 48-48: workflow command "set-output" was deprecated. use echo "{name}={value}" >> $GITHUB_OUTPUT instead: https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions

(deprecated-commands)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/coverage-generator.yml around lines 46 - 56, Update the
GitHub API queries and Jenkins artifact lookup to pin artifacts to the branch
being reported: in the job step named "Get the latest Jacoco report URL" (id:
get-artifact-url-oidc) and the other GitHub API call used later (the second
workflow run fetch), append the head_branch query parameter (e.g.,
&head_branch=main or the appropriate branch variable) to the runs API URL so the
call only returns runs for that branch; for the Jenkins artifact fetch that
currently uses lastSuccessfulBuild, replace it with a branch-specific build
endpoint (or parameterize the job name/build selector for the target branch) so
artifacts are obtained from the exact branch instead of the last successful
build across branches.

RUN_ID=$(echo $WORKFLOW_RUNS | jq -r '.workflow_runs[0].id')

if [ "$RUN_ID" == "null" ]; then
echo "No successful workflow runs found"
exit 1
fi

# Get the artifacts for the workflow run
ARTIFACTS=$(curl -s -H "Authorization: token $GITHUB_TOKEN" "$GITHUB_API_URL/repos/$OWNER/$REPO/actions/runs/$RUN_ID/artifacts")
ARTIFACT_URL=$(echo $ARTIFACTS | jq -r '.artifacts[] | select(.name == "jacoco-xml") | .archive_download_url')

if [ "$ARTIFACT_URL" == "null" ]; then
echo "Artifact not found"
exit 1
fi

echo "::set-output name=artifact-url::$ARTIFACT_URL"

@coderabbitai coderabbitai Bot Apr 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
rg -n '::set-output' .github/workflows

Repository: wso2/carbon-kernel

Length of output: 276

🏁 Script executed:

cat -n .github/workflows/coverage-generator.yml | sed -n '65,80p'

Repository: wso2/carbon-kernel

Length of output: 851

🏁 Script executed:

cat -n .github/workflows/coverage-generator.yml | sed -n '125,140p'

Repository: wso2/carbon-kernel

Length of output: 855

Replace deprecated ::set-output with $GITHUB_OUTPUT environment variable.

Lines 73 and 133 use the deprecated ::set-output syntax which has been replaced by GitHub Actions. Migrate to the $GITHUB_OUTPUT environment variable to ensure long-term compatibility.

Proposed fix 
-          echo "::set-output name=artifact-url::$ARTIFACT_URL"
+          echo "artifact-url=$ARTIFACT_URL" >> "$GITHUB_OUTPUT"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
echo "::set-output name=artifact-url::$ARTIFACT_URL"
echo "artifact-url=$ARTIFACT_URL" >> "$GITHUB_OUTPUT"
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/coverage-generator.yml at line 73, Replace the deprecated
echo "::set-output name=artifact-url::$ARTIFACT_URL" usage with the new
$GITHUB_OUTPUT method: instead of using ::set-output, append
"artifact-url=$ARTIFACT_URL" to the file referenced by $GITHUB_OUTPUT (same
change for the other occurrence around the second set-output), ensuring the
variable name matches "artifact-url" so downstream steps read it the same way;
update both occurrences in the workflow where ::set-output is used.


- name: Download latest Jacoco report
run: |
curl -L -o artifact-oidc.zip \
-H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
${{ steps.get-artifact-url-oidc.outputs.artifact-url }}

- name: Unzip Jacoco report
run: |
unzip artifact-oidc.zip -d ./artifacts-oidc

- name: Upload coverage reports to Codecov for OIDC
uses: codecov/codecov-action@v4
with:
token: ${{ secrets.CODECOV_TOKEN }}
files: ./artifacts-oidc/jacoco.xml
flags: conformance-oidc
disable_search: true

fapi-conformance-report:
needs: build-source
runs-on: ubuntu-latest

steps:
- name: Restore source code
uses: actions/cache@v4
with:
path: .
key: ${{ runner.os }}-source-${{ github.sha }}
restore-keys: |
${{ runner.os }}-source-

- name: Get the latest Jacoco report URL
id: get-artifact-url-fapi
run: |
GITHUB_API_URL="https://api.github.com"
OWNER="wso2"
REPO="product-is"
WORKFLOW_ID="fapi-oidc-conformance-test.yml"
GITHUB_TOKEN="${{ secrets.GITHUB_TOKEN }}"

# Get the latest successful workflow run
WORKFLOW_RUNS=$(curl -s -H "Authorization: token $GITHUB_TOKEN" "$GITHUB_API_URL/repos/$OWNER/$REPO/actions/workflows/$WORKFLOW_ID/runs?status=success&per_page=1")
RUN_ID=$(echo $WORKFLOW_RUNS | jq -r '.workflow_runs[0].id')

if [ "$RUN_ID" == "null" ]; then
echo "No successful workflow runs found"
exit 1
fi

# Get the artifacts for the workflow run
ARTIFACTS=$(curl -s -H "Authorization: token $GITHUB_TOKEN" "$GITHUB_API_URL/repos/$OWNER/$REPO/actions/runs/$RUN_ID/artifacts")
ARTIFACT_URL=$(echo $ARTIFACTS | jq -r '.artifacts[] | select(.name == "jacoco-xml") | .archive_download_url')

if [ "$ARTIFACT_URL" == "null" ]; then
echo "Artifact not found"
exit 1
fi

echo "::set-output name=artifact-url::$ARTIFACT_URL"

- name: Download the latest Jacoco report
run: |
curl -L -o artifact-fapi.zip \
-H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
${{ steps.get-artifact-url-fapi.outputs.artifact-url }}

- name: Unzip Jacoco report
run: |
unzip artifact-fapi.zip -d ./artifacts-fapi

- name: Upload coverage reports to Codecov for FAPI
uses: codecov/codecov-action@v4
with:
token: ${{ secrets.CODECOV_TOKEN }}
files: ./artifacts-fapi/jacoco.xml
flags: conformance-fapi
disable_search: true

integration-test-report:
needs: build-source
runs-on: ubuntu-latest

steps:
- name: Restore source code
uses: actions/cache@v4
with:
path: .
key: ${{ runner.os }}-source-${{ github.sha }}
restore-keys: |
${{ runner.os }}-source-

- name: Download integration Jacoco XML report
run: |
mkdir artifacts-integration
curl -L -o ./artifacts-integration/jacoco.xml https://wso2.org/jenkins/job/products/job/product-is/lastSuccessfulBuild/artifact/modules/integration/tests-integration/tests-backend/target/jacoco/coverage/jacoco.xml

- name: Upload coverage reports to Codecov for integration tests
uses: codecov/codecov-action@v4
with:
token: ${{ secrets.CODECOV_TOKEN }}
files: ./artifacts-integration/jacoco.xml
flags: integration
disable_search: true
8 changes: 8 additions & 0 deletions .github/workflows/pr-builder.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,3 +43,11 @@ jobs:
${{ runner.os }}-
- name: Build with Maven
run: mvn clean install -U -B
- name: Delete SNAPSHOT artifacts
run: find ~/.m2/repository/ -name "*-SNAPSHOT" -type d -print -prune -exec rm -r {} +
- name: Upload coverage reports to Codecov
uses: codecov/codecov-action@v4
with:
token: ${{ secrets.CODECOV_TOKEN }}
files: "**/target/coverage-reports/site/jacoco-aggregate/jacoco.xml"
flags: unit
Comment on lines +48 to +53

@coderabbitai coderabbitai Bot Apr 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

Does codecov/codecov-action@v4 still auto-discover coverage files when the filesinput is set, and isdisable_search: true required to limit the upload to only the provided JaCoCo XML file(s)?

💡 Result:

No, codecov/codecov-action@v4 does not stop auto-discovering coverage files when the files input is set; the specified files are added to those found by the default search. Yes, disable_search: true is required to limit the upload to only the provided JaCoCo XML file(s), disabling the automatic search.

Citations:

Add disable_search: true to restrict Codecov upload to the specified file only.

The codecov/codecov-action@v4 automatically discovers coverage files regardless of the files input. Without disable_search: true, this step will merge any other JaCoCo reports from the Maven build into the unit flag, defeating the purpose of uploading only the aggregate report on line 52.

Proposed fix 
       - name: Upload coverage reports to Codecov
         uses: codecov/codecov-action@v4
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: "**/target/coverage-reports/site/jacoco-aggregate/jacoco.xml"
           flags: unit
+          disable_search: true
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Upload coverage reports to Codecov
uses: codecov/codecov-action@v4
with:
token: ${{ secrets.CODECOV_TOKEN }}
files: "**/target/coverage-reports/site/jacoco-aggregate/jacoco.xml"
flags: unit
- name: Upload coverage reports to Codecov
uses: codecov/codecov-action@v4
with:
token: ${{ secrets.CODECOV_TOKEN }}
files: "**/target/coverage-reports/site/jacoco-aggregate/jacoco.xml"
flags: unit
disable_search: true
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/pr-builder.yml around lines 48 - 53, The Codecov upload
step ("Upload coverage reports to Codecov") using codecov/codecov-action@v4
currently relies on the files input but still auto-discovers other JaCoCo
reports; add the input disable_search: true to that action invocation to force
upload only of the specified files pattern
("**/target/coverage-reports/site/jacoco-aggregate/jacoco.xml") and prevent
merging other reports into the unit flag.

23 changes: 23 additions & 0 deletions codecov.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
codecov:
require_ci_to_pass: yes
notify:
wait_for_ci: yes
max_report_age: false

coverage:
status:
project: off
patch: off

flag_management:
default_rules:
carryforward: true
individual_flags:
- name: unit
statuses:
- type: project
target: auto
threshold: null
- type: patch
target: 80%
threshold: 40%
Loading