From ef9dba6fbbcc994a81325fb4bd6a1d123b49c641 Mon Sep 17 00:00:00 2001
From: luiz_c <luizcarlos@asseinfo.com.br>
Date: Tue, 18 Aug 2026 15:11:07 -0300
Subject: [PATCH] Fail the PR when its changed files aren't fully covered
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Turns on couve's --fail-on-low-coverage gate. The couve call is
wrapped instead of run directly, because a failing step aborts
immediately and would skip the comment-posting step — the result is
captured into COVERAGE_OK and the actual exit 1 is deferred to a
final step, so the coverage comment (showing exactly which lines are
uncovered) always posts before the job goes red.

Also excludes spec/support/ from SimpleCov tracking: test-support code
(matchers, helpers) is exercised by the specs that use it, not covered
on its own, and gating on it would incentivize test-for-a-test specs
that verify nothing about br_danfe's actual behavior. Same reasoning
facil123 documents in docs/padroes-de-programacao/testes-automatizados/o-que-nao-cobrir.md.

This PR's own diff only touches this workflow file and spec_helper.rb,
neither tracked by coverage, so it passes its own gate cleanly.
Backfilling specs for the 5 pre-existing product-code gaps is separate
follow-up work.

Refs #283

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/workflows/config.yml | 15 +++++++++++++--
 spec/spec_helper.rb          |  6 +++++-
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/config.yml b/.github/workflows/config.yml
index 94cf5b9..58a3550 100644
--- a/.github/workflows/config.yml
+++ b/.github/workflows/config.yml
@@ -57,8 +57,15 @@ jobs:
 
           gem install couve
 
-          git diff --name-only origin/${{ github.event.pull_request.base.ref }}...HEAD \
-            | couve coverage/codeclimate.json coverage-report.md --changed-files -
+          # couve still writes coverage-report.md even when it fails the gate below,
+          # so the actual `exit 1` is deferred to a later step, after the comment
+          # (which shows exactly which lines are uncovered) has had a chance to post.
+          if git diff --name-only origin/${{ github.event.pull_request.base.ref }}...HEAD \
+            | couve coverage/codeclimate.json coverage-report.md --changed-files - --fail-on-low-coverage; then
+            echo "COVERAGE_OK=true" >> "$GITHUB_ENV"
+          else
+            echo "COVERAGE_OK=false" >> "$GITHUB_ENV"
+          fi
 
       - name: Post or update the coverage comment on the PR
         if: github.event_name == 'pull_request'
@@ -83,3 +90,7 @@ jobs:
           else
             gh api -X POST "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" -F body=@full-comment.md
           fi
+
+      - name: Fail if the PR's changed files aren't fully covered
+        if: github.event_name == 'pull_request' && env.COVERAGE_OK == 'false'
+        run: exit 1
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 8ce5479..56b6e80 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -6,7 +6,11 @@
     SimpleCov::Formatter::JSONFormatter,
     SimpleCov::Formatter::HTMLFormatter
   ])
-  SimpleCov.start
+  SimpleCov.start do
+    # Test support code is exercised by the specs that use it, not covered
+    # on its own — the coverage gate only applies to product code.
+    add_filter '/spec/support/'
+  end
 end
 
 require "bundler/setup"