Merge pull request #5 from Progmasoft/ci/qualityHEADmain

Add CodeQL, Codecov, Codacy, Renovate and actionlint

1 files changed, 44 insertions, 0 deletions

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7d357e0..4e96a45 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,6 +36,50 @@ jobs:
       - run: bazelisk test //...
       - run: bazelisk build //:tazelish
 
+  coverage-report:
+    name: Coverage report
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # Clang's own coverage, read by the LLVM tools of the runner's Clang.
+      - run: >-
+          bazelisk coverage //Tests:tests
+          --combined_report=lcov
+          --instrumentation_filter=^//:
+          --repo_env=BAZEL_USE_LLVM_NATIVE_COVERAGE=1
+          --repo_env=BAZEL_LLVM_PROFDATA=/usr/bin/llvm-profdata-18
+          --repo_env=BAZEL_LLVM_COV=/usr/bin/llvm-cov-18
+      - run: cp "$(bazelisk info output_path)/_coverage/_coverage_report.dat" lcov.info
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: tazelish-coverage
+          path: lcov.info
+          if-no-files-found: error
+          retention-days: 1
+
+  coverage:
+    # Fork PRs cannot receive the OIDC token required for Codecov uploads.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    needs: coverage-report
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      # Keep the OIDC-capable job apart from the build.
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: tazelish-coverage
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          use_oidc: true
+          files: lcov.info
+          fail_ci_if_error: true
+
   required:
     name: CI Required
     if: always()