coverage-refresh.yml

# .github/workflows/coverage-refresh.yml
name: 'Coverage Map Refresh'
on:
  schedule:
    - cron: '0 6 * * 1'      # weekly floor
  push:
    branches: [master]
    paths:
      - 'toolchain/mfc/test/cases.py'
      - 'src/**/*.fpp'
  workflow_dispatch:
permissions:
  contents: write
concurrency:
  group: coverage-refresh
  cancel-in-progress: true
jobs:
  refresh:
    if: github.repository == 'MFlowCode/MFC'
    # Wall clock here is dominated by the SLURM queue, not by the build: observed waits on
    # the phoenix `embers` QOS have reached 6h, and a 240-minute cap silently killed the
    # refresh of #1717 at 4h05m. Cap generously -- a refresh that never finishes leaves the
    # map behind, which is exactly what coverage-health.yml then reports.
    timeout-minutes: 480
    runs-on:
      group:  phoenix
      labels: gt
    steps:
      # persist-credentials: false stops actions/checkout from configuring the
      # default GITHUB_TOKEN as an http.extraheader, which otherwise OVERRIDES the
      # token embedded in the push URL below — making the push authenticate as
      # github-actions[bot] (which cannot bypass the require-PR rule) instead of
      # the CACHE_PUSH_TOKEN identity.
      - uses: actions/checkout@v5
        with: { clean: false, persist-credentials: false }
      - name: Build + collect coverage map (SLURM)
        run: bash .github/scripts/submit-slurm-job.sh .github/workflows/common/coverage-refresh.sh cpu none phoenix
      - name: Commit refreshed map
        env:
          CACHE_PUSH_TOKEN: ${{ secrets.CACHE_PUSH_TOKEN }}
        run: |
          # Compare coverage ENTRIES, not file bytes: _meta (built_at, git_sha) moves on
          # every rebuild, so `git diff` on the .gz always reported a change and the bot
          # pushed a no-op commit nearly every run. rc 0 = changed, 10 = unchanged.
          # The comparison script is stdlib-only, so the system interpreter is a fine
          # fallback if the SLURM job never got far enough to create build/venv.
          PY=build/venv/bin/python3
          [ -x "$PY" ] || PY=python3
          set +e
          "$PY" .github/scripts/coverage_map_changed.py
          changed=$?
          set -e
          # Every other code is a hard error, never a silent skip: an uncaught Python
          # exception exits 1 and a missing interpreter exits 127, and treating either as
          # "unchanged" would let a permanently broken comparison run permanently green.
          case "$changed" in
          0|10) ;;
          *)    echo "::error::Coverage map comparison failed (rc=$changed)."; exit 1 ;;
          esac
          if [ "$changed" -eq 0 ]; then
            git config user.name  "mfc-bot"
            git config user.email "mfc-bot@users.noreply.github.com"
            git add tests/coverage_map.json.gz
            # --no-verify: this bot commit stages only the binary coverage map; it
            # must not run the repo pre-commit hook (./mfc.sh precheck/spelling),
            # which is for source changes and aborts the commit on the runner.
            git commit --no-verify -m "test: refresh coverage map [skip ci]"
            # Push to master with CACHE_PUSH_TOKEN, a classic PAT from an org-owner
            # account. GitHub Apps cannot bypass the require-PR ruleset rule for
            # direct pushes, but a PAT authenticates as the user (OrganizationAdmin),
            # which IS an honored bypass actor. persist-credentials:false above
            # ensures this token is actually used for the push.
            git push "https://x-access-token:${CACHE_PUSH_TOKEN}@github.com/MFlowCode/MFC.git" HEAD:master
          else
            # Discard the rebuilt file so the runner's working tree matches master.
            git checkout -- tests/coverage_map.json.gz
          fi
          # Record that a refresh verified the map against THIS commit, in BOTH branches
          # above. coverage-health.yml cannot use the map's _meta.git_sha for this: git_sha
          # advances only when a commit lands, and the guard above deliberately skips the
          # commit when the entries are unchanged, so a coverage-relevant commit whose
          # coverage is identical left the map looking permanently stale to the health
          # check while this workflow was working fine.
          #
          # refs/coverage-map/ is outside refs/heads/ and refs/tags/ on purpose: a branch or
          # tag would fire the `push` trigger of any workflow that filters on paths alone
          # (homebrew.yml does), starting unrelated jobs on every refresh.
          #
          # Non-fatal: the map itself is already committed and pushed by this point, so a
          # failed bookkeeping push must not red a refresh that succeeded. It is not silent
          # either -- the warning lands in the run summary, and a ref that stops advancing
          # drops coverage-health.yml back to its wall-clock rule, which goes red within
          # MAX_AGE_DAYS.
          # $GITHUB_SHA, not HEAD: when the entries changed, HEAD is the bot's new map
          # commit, one past the commit this refresh actually rebuilt from. Either answers
          # the health check's ancestry question, but only $GITHUB_SHA names the same thing
          # in both branches -- the source state the map was built against.
          git push "https://x-access-token:${CACHE_PUSH_TOKEN}@github.com/MFlowCode/MFC.git" \
            --force "$GITHUB_SHA:refs/coverage-map/verified" \
            || echo "::warning::Could not update refs/coverage-map/verified; coverage-health.yml falls back to the age rule."