From 3128133a88b4554441328ae083c457fd2bfca22f Mon Sep 17 00:00:00 2001 From: Ryan Duguid Date: Sun, 1 Nov 2026 08:25:12 +1100 Subject: [PATCH 1/2] ci: add Codecov, Snyk, SonarCloud and Codacy badges --- .github/workflows/ci.yml | 48 +++++++++++++++++++++++++++++++++++++++- CITATION.cff | 4 ++-- CONTRIBUTING.md | 29 ++++++++++++++++++++++++ README.md | 4 ++-- codecov.yml | 11 +++++++++ llms.txt | 8 +++---- 6 files changed, 95 insertions(+), 9 deletions(-) create mode 100644 CONTRIBUTING.md create mode 100644 codecov.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1f52de1..4e19bf2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -44,11 +44,57 @@ jobs: run: Set-MpPreference -DisableRealtimeMonitoring $true - run: cargo fmt --check - run: cargo clippy --all-targets --locked -- -D warnings + # Coverage needs llvm-tools and a prebuilt cargo-llvm-cov, with no fallback to compiling it. + - if: runner.os == 'Linux' + run: rustup component add llvm-tools + - if: runner.os == 'Linux' + uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31 + with: + tool: cargo-llvm-cov@0.9.1 + fallback: none # Timing-bounded tests (1 s and 5 s durable-write and retirement budgets) fail closed when the # runner is contended: Windows runs them serially, Linux on two threads. Temporary files stay # on the workspace drive: a durable write's median was 6 to 9 ms on the Windows system drive # and 0.2 to 0.6 ms there (3 runners, 30 October 2026). - - run: cargo test --locked -- --test-threads=${{ matrix.os == 'windows-latest' && 1 || 2 }} + - if: runner.os == 'Windows' + run: cargo test --locked -- --test-threads=1 env: TEMP: ${{ runner.temp }} TMP: ${{ runner.temp }} + # The Linux leg runs the same tests under cargo-llvm-cov for the Codecov report. + - if: runner.os == 'Linux' + run: cargo llvm-cov --locked --lcov --output-path coverage-rust.lcov -- --test-threads=2 + env: + TEMP: ${{ runner.temp }} + TMP: ${{ runner.temp }} + - if: runner.os == 'Linux' + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + with: + name: coverage-rust + path: coverage-rust.lcov + retention-days: 1 + + # The upload runs apart from the tests so the OIDC token is never available + # while test code runs. A Codecov outage fails only this job. + codecov: + name: upload coverage to Codecov + needs: check + if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: read + id-token: write # Authenticate the Codecov upload with OIDC; no stored token. + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: coverage-rust + - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1 + with: + use_oidc: true + files: coverage-rust.lcov + disable_search: true + fail_ci_if_error: true diff --git a/CITATION.cff b/CITATION.cff index 7d30cea..65fbbef 100644 --- a/CITATION.cff +++ b/CITATION.cff @@ -5,8 +5,8 @@ type: software authors: - name: "EquityBot" abstract: "Ask ChatGPT, or the OpenAI or Azure OpenAI API, about your source files from a CLI or MCP server, and keep each answer as a durable session. A Rust port of Calvino." -repository-code: "https://github.com/EquityBot/Industrious" -license-url: "https://github.com/EquityBot/Industrious/blob/main/LICENSE" +repository-code: "https://github.com/EquityBot/Alcuin" +license-url: "https://github.com/EquityBot/Alcuin/blob/main/LICENSE" keywords: - azure-openai - chatgpt diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..34b6a84 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,29 @@ +# Contributing + +Report bugs and request features in +[GitHub issues](https://github.com/EquityBot/Alcuin/issues). For a suspected +security vulnerability, follow [SECURITY.md](SECURITY.md) instead of opening an +issue. + +## Pull requests + +Propose changes as a pull request against `main`. A change lands on `main` only +when the `check (ubuntu-latest)` and `check (windows-latest)` checks from +[ci.yml](.github/workflows/ci.yml) and the `Attribution policy` check pass. The +attribution check fails a pull request whose title, commit trailers or +identities credit an AI tool. + +Run what CI runs before opening one: + +```bash +cargo fmt --check +cargo clippy --all-targets --locked -- -D warnings +cargo test --locked +``` + +New functionality and bug fixes come with automated tests, in `tests/` or the +module's `#[cfg(test)]` tests, run by `cargo test --locked` in CI. + +CI runs the offline tests only. Tests that need a signed-in browser or a live +provider are marked `#[ignore]` and run only on request, with your own +accounts. diff --git a/README.md b/README.md index 2c49520..245f6a5 100644 --- a/README.md +++ b/README.md @@ -9,8 +9,8 @@
-[![tests](https://github.com/EquityBot/Industrious/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/EquityBot/Industrious/actions/workflows/ci.yml) [![CodeQL](https://github.com/EquityBot/Industrious/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/EquityBot/Industrious/actions/workflows/codeql.yml) [![Snyk](https://github.com/EquityBot/Alcuin/actions/workflows/snyk.yml/badge.svg?branch=main)](https://github.com/EquityBot/Alcuin/actions/workflows/snyk.yml)
-[![OpenSSF Scorecard](https://raw.githubusercontent.com/ryanduguid/.github/badges/EquityBot/Industrious.svg)](https://scorecard.dev/viewer/?uri=github.com/EquityBot/Industrious)
+[![tests](https://github.com/EquityBot/Alcuin/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/EquityBot/Alcuin/actions/workflows/ci.yml) [![Codecov](https://codecov.io/gh/EquityBot/Alcuin/graph/badge.svg)](https://codecov.io/gh/EquityBot/Alcuin) [![CodeQL](https://github.com/EquityBot/Alcuin/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/EquityBot/Alcuin/actions/workflows/codeql.yml) [![Snyk](https://github.com/EquityBot/Alcuin/actions/workflows/snyk.yml/badge.svg?branch=main)](https://github.com/EquityBot/Alcuin/actions/workflows/snyk.yml) [![SonarCloud](https://sonarcloud.io/api/project_badges/measure?project=EquityBot_Industrious&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=EquityBot_Industrious) [![Codacy code quality](https://app.codacy.com/project/badge/Grade/64b01c5d3b174763951ce4fa40124a84)](https://app.codacy.com/gh/EquityBot/Alcuin/dashboard)
+[![OpenSSF Scorecard](https://raw.githubusercontent.com/ryanduguid/.github/badges/EquityBot/Alcuin.svg)](https://scorecard.dev/viewer/?uri=github.com/EquityBot/Alcuin)
[![rust: 1.99+](.github/assets/badges/rust.svg)](https://www.rust-lang.org/) [![licence: FSL-1.1-ALv2](.github/assets/badges/licence.svg)](LICENSE)
diff --git a/codecov.yml b/codecov.yml new file mode 100644 index 0000000..97f177d --- /dev/null +++ b/codecov.yml @@ -0,0 +1,11 @@ +# Codecov reports coverage for the README badge. Its statuses are +# informational, so it never decides a merge, and it posts no comments. +coverage: + status: + project: + default: + informational: true + patch: + default: + informational: true +comment: false diff --git a/llms.txt b/llms.txt index a02cc87..5c83fd6 100644 --- a/llms.txt +++ b/llms.txt @@ -9,13 +9,13 @@ Version 0.1.0 (unreleased). Needs Rust 1.99 or later; install from a checkout wi ## Start -- [README](https://github.com/EquityBot/Industrious#readme): install, use, settings and known limitations. -- [SECURITY.md](https://github.com/EquityBot/Industrious/blob/main/SECURITY.md): what Industrious can reach and how to report a vulnerability. +- [README](https://github.com/EquityBot/Alcuin#readme): install, use, settings and known limitations. +- [SECURITY.md](https://github.com/EquityBot/Alcuin/blob/main/SECURITY.md): what Industrious can reach and how to report a vulnerability. ## Docs -- [CHANGELOG.md](https://github.com/EquityBot/Industrious/blob/main/CHANGELOG.md): changes in each release. -- [NOTICE](https://github.com/EquityBot/Industrious/blob/main/NOTICE): licence terms and Oracle's retained MIT notice. +- [CHANGELOG.md](https://github.com/EquityBot/Alcuin/blob/main/CHANGELOG.md): changes in each release. +- [NOTICE](https://github.com/EquityBot/Alcuin/blob/main/NOTICE): licence terms and Oracle's retained MIT notice. ## Related From db6bad39851f7fe425256b50e84e590ae5d4a326 Mon Sep 17 00:00:00 2001 From: Ryan Duguid Date: Sun, 1 Nov 2026 09:27:03 +1100 Subject: [PATCH 2/2] ci: keep Codecov outages off the tests badge The codecov job continues on error, so a Codecov outage cannot turn the tests badge red; the upload still fails its own job. --- .github/workflows/ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4e19bf2..a82b106 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -82,6 +82,7 @@ jobs: if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest timeout-minutes: 10 + continue-on-error: true permissions: contents: read id-token: write # Authenticate the Codecov upload with OIDC; no stored token.