Skip to content

Add GitHub coverage reporting workflow #702

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
arussell-nvidia wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add GitHub coverage reporting workflow #702

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3a39221
Add GitHub coverage reporting workflow
arussell-nvidia Jun 23, 2026
2dc9c2e
Address coverage workflow review feedback
arussell-nvidia Jun 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
114 changes: 114 additions & 0 deletions .github/workflows/coverage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,114 @@
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Coverage

on:
push:
branches: [ main, 'release/*.*.x' ]
pull_request:
workflow_dispatch:

# For PRs, cancel superseded coverage runs. For main/release pushes, let each
# published signal complete.
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
ctest-coverage-ubuntu:
name: CTest coverage (Ubuntu)
runs-on: ubuntu-22.04
permissions:
contents: read
timeout-minutes: 45

steps:
- name: Checkout code
uses: actions/checkout@v6

@coderabbitai coderabbitai Bot Jun 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the workflow with line numbers
sed -n '1,220p' .github/workflows/coverage.yml | cat -n

Repository: NVIDIA/IsaacTeleop

Length of output: 4648

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,220p' .github/workflows/coverage.yml | cat -n

Repository: NVIDIA/IsaacTeleop

Length of output: 4648

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,220p' .github/workflows/coverage.yml | cat -n

Repository: NVIDIA/IsaacTeleop

Length of output: 4648

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,220p' .github/workflows/coverage.yml | cat -n

Repository: NVIDIA/IsaacTeleop

Length of output: 4648

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,220p' .github/workflows/coverage.yml | cat -n

Repository: NVIDIA/IsaacTeleop

Length of output: 4648

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,220p' .github/workflows/coverage.yml | cat -n

Repository: NVIDIA/IsaacTeleop

Length of output: 4648

Pin the GitHub Actions refs to commit SHAs. actions/checkout@v6 and actions/upload-artifact@v6 are mutable tag refs; lock both to immutable SHAs to reduce supply-chain risk. (Lines 28, 105)

🧰 Tools
🪛 zizmor (1.26.1)

[error] 28-28: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/coverage.yml at line 28, The workflow currently uses
mutable GitHub Actions tags for actions/checkout and actions/upload-artifact, so
update both references to immutable commit SHAs to lock the versions. Locate the
uses entries for actions/checkout and actions/upload-artifact in the coverage
workflow and replace the tag refs with the pinned SHA equivalents while keeping
the same action behavior.

Source: Linters/SAST tools

@arussell-nvidia arussell-nvidia Jun 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 2dc9c2e: pinned actions/checkout and actions/upload-artifact to the resolved v6 commit SHAs, and added persist-credentials: false to checkout since this workflow does not push back to the repo.

with:
fetch-depth: 0

- name: Install uv
uses: ./.github/actions/setup-uv

- name: Install Apt dependencies
run: |
sudo apt-get update
sudo apt-get install -y build-essential cmake ninja-build ccache gcovr clang-format-14 \
libx11-dev libvulkan-dev glslang-tools libxrandr-dev libxinerama-dev libxcursor-dev \
libxi-dev libxext-dev libxkbcommon-dev libwayland-dev wayland-protocols \
autoconf automake libtool pkg-config libudev-dev

- name: Configure coverage build
run: |
set -euo pipefail
cmake -S . -B build-coverage -G Ninja \
-DCMAKE_BUILD_TYPE=Debug \
-DISAAC_TELEOP_PYTHON_VERSION=3.11 \
-DBUILD_VIZ=OFF \
-DBUILD_PLUGINS=OFF \
-DBUILD_EXAMPLES=OFF \
-DBUNDLE_ROBOTIC_GROUNDING=OFF \
-DENABLE_CLOUDXR_BUNDLE_CHECK=OFF \
-DENABLE_CLANG_FORMAT_CHECK=OFF \
-DCMAKE_C_COMPILER_LAUNCHER=ccache \
-DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
-DCMAKE_C_FLAGS="--coverage -O0 -g" \
-DCMAKE_CXX_FLAGS="--coverage -O0 -g" \
-DCMAKE_EXE_LINKER_FLAGS="--coverage" \
-DCMAKE_SHARED_LINKER_FLAGS="--coverage" \
-DCMAKE_MODULE_LINKER_FLAGS="--coverage"

- name: Build
run: cmake --build build-coverage --parallel 4

- name: Run CTest
run: ctest --test-dir build-coverage --output-on-failure --parallel 4

- name: Generate coverage report
run: |
set -euo pipefail
mkdir -p coverage/html

gcovr_args=(
--root "${GITHUB_WORKSPACE}"
--object-directory build-coverage/src
--filter "src/"
--exclude "src/.*/.*_tests/.*"
--exclude "src/.*/tests/.*"
--exclude "src/.*/python_tests/.*"
)

gcovr "${gcovr_args[@]}" --txt --output coverage/summary.txt --print-summary | tee coverage/totals.txt
gcovr "${gcovr_args[@]}" --xml-pretty --output coverage/coverage.xml
gcovr "${gcovr_args[@]}" --html-details --output coverage/html/index.html

- name: Publish coverage summary
run: |
set -euo pipefail
{
echo "## CTest coverage"
echo
echo "Native coverage was generated from the Debug CTest build with plugins, examples, and Televiz disabled."
echo
echo "### Totals"
echo '```'
cat coverage/totals.txt
echo '```'
echo
echo "Download the \`isaacteleop-coverage\` artifact for the HTML report and Cobertura XML."
} >> "${GITHUB_STEP_SUMMARY}"

- name: Upload coverage artifact
if: ${{ always() }}
uses: actions/upload-artifact@v6
with:
name: isaacteleop-coverage
path: |
coverage/summary.txt

@jiwenc-nv jiwenc-nv Jun 24, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just to confirm: is this the same coverage report format that NVIDIA's internal tooling expects?

@arussell-nvidia arussell-nvidia Jun 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Confirmed: the workflow generates Cobertura XML with gcovr --xml-pretty and now publishes it explicitly as coverage/cobertura.xml, alongside the HTML and text summaries in the isaacteleop-coverage artifact. If NVIDIA internal tooling expects a different filename/path in addition to Cobertura XML, I can add that too.

coverage/totals.txt
coverage/coverage.xml
coverage/html
if-no-files-found: warn

@coderabbitai coderabbitai Bot Jun 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Fail the job when expected coverage artifacts are missing.

Line 113 uses warn, which can mask a broken coverage output path and still report a successful run.

Suggested fix 
-        if-no-files-found: warn
+        if-no-files-found: error

Based on learnings: “if the expected output files are not produced, fail the run instead of silently succeeding.”

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
if-no-files-found: warn
if-no-files-found: error
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/coverage.yml at line 113, The coverage artifact upload is
configured to only warn when files are missing, which can hide broken coverage
generation and still pass the workflow. Update the artifact upload step in the
coverage workflow to fail the job when expected coverage files are absent by
changing the existing if-no-files-found setting on the upload action, keeping
the rest of the coverage job unchanged.

Source: Learnings

@arussell-nvidia arussell-nvidia Jun 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 2dc9c2e: changed if-no-files-found to error, and renamed the XML artifact to coverage/cobertura.xml so a report generation/path issue fails loudly.

retention-days: 14
Loading