Fail the PR when its changed files aren't fully covered

.github/workflows/config.yml

@@ -57,8 +57,15 @@ jobs:
 
           gem install couve
 
-          git diff --name-only origin/${{ github.event.pull_request.base.ref }}...HEAD \
-            | couve coverage/codeclimate.json coverage-report.md --changed-files -
+          # couve still writes coverage-report.md even when it fails the gate below,
+          # so the actual `exit 1` is deferred to a later step, after the comment
+          # (which shows exactly which lines are uncovered) has had a chance to post.
+          if git diff --name-only origin/${{ github.event.pull_request.base.ref }}...HEAD \
+            | couve coverage/codeclimate.json coverage-report.md --changed-files - --fail-on-low-coverage; then
+            echo "COVERAGE_OK=true" >> "$GITHUB_ENV"
+          else
+            echo "COVERAGE_OK=false" >> "$GITHUB_ENV"
+          fi
 
       - name: Post or update the coverage comment on the PR
         if: github.event_name == 'pull_request'
@@ -83,3 +90,7 @@ jobs:
           else
             gh api -X POST "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" -F body=@full-comment.md
           fi
+
+      - name: Fail if the PR's changed files aren't fully covered
+        if: github.event_name == 'pull_request' && env.COVERAGE_OK == 'false'
+        run: exit 1

spec/spec_helper.rb

@@ -6,7 +6,11 @@
     SimpleCov::Formatter::JSONFormatter,
     SimpleCov::Formatter::HTMLFormatter
   ])
-  SimpleCov.start
+  SimpleCov.start do
+    # Test support code is exercised by the specs that use it, not covered
+    # on its own — the coverage gate only applies to product code.
+    add_filter '/spec/support/'
+  end
 end
 
 require "bundler/setup"