upload_coverage_pr.yaml

name: Upload Coverage Report (PR)

# cspell:ignore mapfile

on:
  # This workflow is triggered after every successful execution
  # of `Generate Coverage Report` workflow.
  workflow_run:
    workflows: ["Generate Coverage Report (PR)"]
    types:
      - completed

permissions:
  actions: write
  contents: write
  issues: write
  pull-requests: write

jobs:
  coverage:
    name: Upload Coverage Report
    environment: coverage
    runs-on: ubuntu-latest
    steps:
      # Codecov requires a checkout. This trusted workflow must check out only the
      # default branch before retrieving fork-produced artifacts.
      - name: Checkout trusted repository
        uses: actions/checkout@v7
        with:
          path: repo_root

      - name: "Download existing coverage report"
        id: prepare_report
        uses: actions/github-script@v9
        with:
          script: |
            var fs = require('fs');

            // List artifacts of the workflow run that triggered this workflow
            var artifacts = await github.rest.actions.listWorkflowRunArtifacts({
               owner: context.repo.owner,
               repo: context.repo.repo,
               run_id: context.payload.workflow_run.id,
            });

            let codecovReport = artifacts.data.artifacts.filter((artifact) => {
              return artifact.name == "codecov_report";
            });

            if (codecovReport.length != 1) {
              throw new Error("Unexpected number of {codecov_report} artifacts: " + codecovReport.length);
            }

            var download = await github.rest.actions.downloadArtifact({
               owner: context.repo.owner,
               repo: context.repo.repo,
               artifact_id: codecovReport[0].id,
               archive_format: 'zip',
            });
            fs.writeFileSync('codecov_report.zip', Buffer.from(download.data));

            let prNumber = artifacts.data.artifacts.filter((artifact) => {
              return artifact.name == "pr_number";
            });

            if (prNumber.length != 1) {
              throw new Error("Unexpected number of {pr_number} artifacts: " + prNumber.length);
            }

            var download = await github.rest.actions.downloadArtifact({
               owner: context.repo.owner,
               repo: context.repo.repo,
               artifact_id: prNumber[0].id,
               archive_format: 'zip',
            });
            fs.writeFileSync('pr_number.zip', Buffer.from(download.data));

            let commitSha = artifacts.data.artifacts.filter((artifact) => {
              return artifact.name == "commit_sha";
            });

            if (commitSha.length != 1) {
              throw new Error("Unexpected number of {commit_sha} artifacts: " + commitSha.length);
            }

            var download = await github.rest.actions.downloadArtifact({
               owner: context.repo.owner,
               repo: context.repo.repo,
               artifact_id: commitSha[0].id,
               archive_format: 'zip',
            });
            fs.writeFileSync('commit_sha.zip', Buffer.from(download.data));

      - id: parse_previous_artifacts
        run: |
          artifact_dir=coverage_artifacts
          mkdir -p "$artifact_dir"

          extract_artifact() (
            archive_path="$1"
            expected_file="$2"
            extraction_dir=$(mktemp -d)
            trap 'rm -rf "$extraction_dir"' EXIT

            mapfile -t archive_entries < <(unzip -Z1 "$archive_path")
            if [[ ${#archive_entries[@]} -ne 1 || "${archive_entries[0]}" != "$expected_file" ]]; then
              echo "Expected only $expected_file in $archive_path" >&2
              exit 1
            fi

            unzip -j "$archive_path" -d "$extraction_dir"
            artifact_path="$extraction_dir/$expected_file"
            if [[ ! -f "$artifact_path" || -L "$artifact_path" ]]; then
              echo "Expected regular artifact file: $artifact_path" >&2
              exit 1
            fi

            mv "$artifact_path" "$artifact_dir/$expected_file"
          )

          extract_artifact codecov_report.zip codecov.json
          extract_artifact pr_number.zip pr_number.txt
          extract_artifact commit_sha.zip commit_sha.txt

          pr_number=$(<"$artifact_dir/pr_number.txt")
          commit_sha=$(<"$artifact_dir/commit_sha.txt")
          if [[ ! "$pr_number" =~ ^[0-9]+$ ]]; then
            echo "Expected numeric pull request number" >&2
            exit 1
          fi
          if [[ ! "$commit_sha" =~ ^[0-9a-f]{40}$ ]]; then
            echo "Expected 40-character hexadecimal commit SHA" >&2
            exit 1
          fi

          echo "Detected PR is: $pr_number"
          echo "Detected commit_sha is: $commit_sha"

          # Make the params available as step output
          echo "override_pr=$pr_number" >> "$GITHUB_OUTPUT"
          echo "override_commit=$commit_sha" >> "$GITHUB_OUTPUT"

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v7
        with:
          verbose: true
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ${{ github.workspace }}/coverage_artifacts/codecov.json
          fail_ci_if_error: true
          # Manual overrides for these parameters are needed because automatic detection
          # in codecov-action does not work for non-`pull_request` workflows.
          # In `main` branch push, these default to empty strings since we want to run
          # the analysis on HEAD.
          override_commit: ${{ steps.parse_previous_artifacts.outputs.override_commit || '' }}
          override_pr: ${{ steps.parse_previous_artifacts.outputs.override_pr || '' }}
          working-directory: ${{ github.workspace }}/repo_root
          # Location where coverage report files are searched for
          directory: ${{ github.workspace }}