ci: require exact-head production coverage evidence

[seonghobae]

Purpose

Rebuild DiskSage's fail-closed exact-head production coverage gate from protected main and use it to expose, localize, and close real production coverage gaps rather than preserving the historical narrow allowlist.

Exact current state

• Independently revalidated live protected main: 7a86b3dae0c941bc59edfde146c9d7498a0c75a0.
• Current exact source head: a1762379cc2c79e235a53cdb4a46f5e0ac8d57ac.
• PR base snapshot remains historical metadata and is not used as a substitute for the live protected-base tip.
• The bounded diff remains coverage-control-only: .github/workflows/test.yml, CHANGELOG.md, docs/development/coverage-evidence.md, src/lib/coverageEvidenceWorkflow.test.ts, src/lib/frontendCoverageScope.test.ts, and vitest.config.ts.

No source, security, CSP, tenant-authority, Cargo-metadata, Podman, or release-provenance product changes are carried into this replacement.

Coverage contract

• explicitly check out and bind every Test checkout-bearing job and evidence artifact to the exact pull-request head;
• run normal frontend coverage/check/build validation;
• measure Rust with cargo llvm-cov --branch using a dated nightly and llvm-tools-preview;
• keep the production Rust graph measured with --no-cfg-coverage and --no-cfg-coverage-nightly;
• require non-empty exact 100% region/statement-equivalent, branch, function, and line totals;
• expand frontend coverage from the historical five-file allowlist to all source-controlled production TypeScript under src/lib and src/routes, excluding only test/spec/declaration files;
• produce coverage-evidence.json only when the unchanged exact head fully satisfies the gate.

Real RED evidence

The predecessor exact head ce2b3a2445ca867a5184089b91ceded5cc94577a proved this is not an infrastructure-only failure. Its exact Rust report measured:

• region/statement-equivalent: 95,374 / 112,237 = 84.98%;
• branch: 20,826 / 34,333 = 60.66%;
• function: 8,795 / 9,648 = 91.16%;
• line: 39,899 / 43,563 = 91.59%.

The normal frontend npm run coverage lane also failed under the expanded production scope. These failures are product-quality evidence; thresholds and real production scope must not be weakened merely to make the gate green.

Actionable diagnostic contract

The first diagnostic used cargo llvm-cov --summary-only, which correctly proved the aggregate RED but could not identify files/lines to target. Current head fixes that observability defect test-first without changing the threshold:

• collect full bounded llvm-cov JSON rather than summary-only JSON;
• emit only repository-relative src-tauri/... paths;
• retain the 20 largest uncovered files;
• include bounded uncovered region/branch/function/line counts;
• include at most 40 repository-relative uncovered line numbers per reported file;
• write the diagnostic to the job log and GitHub step summary and upload it even when the exact 100% gate fails.

This diagnostic is failure evidence, never success evidence. The next root-cause-changing work is to use exact-current-head diagnostics to add realistic tests for real uncovered production behavior, not exclusions or synthetic coverage.

Supersession and evidence discipline

This is the clean current-main successor to #147. #147's source intent was reconstructed rather than force-rebased and its older checks/reviews/approvals do not transfer. The stale #133 Podman PR is already closed after its product delta was partitioned to #150 and its generic coverage delta to this coverage line. Release provenance is separately owned by the current release line (#154); canonical acquisition documentation is separately owned by #149.

Required before merge

Keep Draft while this exact head discovers and closes the real current production coverage gaps. Merge only when an unchanged exact head satisfies Test/Release/security/SAST plus exact frontend and Rust production coverage and all applicable package/provenance/repository-policy gates, no valid current-head review finding remains, and live governance is satisfied. Queued, pending, skipped-required, cancelled, absent, failed, stale-head/base, predecessor-head, synthetic-only, status-only, or diagnostic-only evidence is not passing. No version is bumped and no release is published by this change.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3fc9f28e-3e31-4563-aecf-282ab18451cd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by #156 after protected main advanced through #155. The successor starts directly from protected main a8996bfe2e5327f1b9e32ccee71aa4b362b81ca4, is zero commits behind that reconstruction base, and preserves the same seven-file coverage-control delta. The source blobs for docs/development/coverage-evidence.md, src-tauri/tests/duplicate_audit_coverage.rs, src/lib/coverageEvidenceWorkflow.test.ts, src/lib/frontendCoverageScope.test.ts, .github/workflows/test.yml, and vitest.config.ts were preserved byte-for-byte; CHANGELOG.md preserves the same single coverage entry on top of current main. No checks/reviews/approvals from this predecessor transfer to #156.