From df84388ab71239e392837a548a3e1c4d54c4c5de Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Wed, 12 Aug 2026 21:22:12 +0300 Subject: seed: initial Codecov Global YAML + plumbing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bootstrap content for the vyos org Codecov Global YAML mirror. codecov.yml is the comment-free dashboard-paste payload (Codecov strips comments on save); validate.yml gates all PRs against https://codecov.io/validate. AGENTS.md + README.md document the dashboard-paste protocol and language-applicability caveats. Companion repo: VyOS-Networks/codecov (filed Wave 2, ~1 week soak). Spec: [VYOS/894337074](https://vyos.atlassian.net/wiki/spaces/VYOS/pages/894337074) Phorge: T9078 IS: IS-609 ๐Ÿค– Generated by [robots](https://vyos.io) --- .coderabbit.yaml | 8 ++++++ .github/copilot-instructions.md | 1 + .github/workflows/validate.yml | 29 +++++++++++++++++++++ .mergify.yml | 4 +++ AGENTS.md | 21 ++++++++++++++++ README.md | 56 +++++++++++++++++++++++++++++++++++++++++ codecov.yml | 38 ++++++++++++++++++++++++++++ 7 files changed, 157 insertions(+) create mode 100644 .coderabbit.yaml create mode 120000 .github/copilot-instructions.md create mode 100644 .github/workflows/validate.yml create mode 100644 .mergify.yml create mode 100644 AGENTS.md create mode 100644 README.md create mode 100644 codecov.yml diff --git a/.coderabbit.yaml b/.coderabbit.yaml new file mode 100644 index 0000000..d6cc384 --- /dev/null +++ b/.coderabbit.yaml @@ -0,0 +1,8 @@ +# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json +inheritance: true + +knowledge_base: + jira: + project_keys: + - NOS + - VD diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md new file mode 120000 index 0000000..be77ac8 --- /dev/null +++ b/.github/copilot-instructions.md @@ -0,0 +1 @@ +../AGENTS.md \ No newline at end of file diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml new file mode 100644 index 0000000..f6096b0 --- /dev/null +++ b/.github/workflows/validate.yml @@ -0,0 +1,29 @@ +name: validate +on: + pull_request: + push: + branches: [production] + workflow_dispatch: + +jobs: + validate: + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Audit egress + continue-on-error: true + uses: bullfrogsec/bullfrog@7bc9b6e13e2dd9cbe5861f33bc26dc6bdb9d9ed2 # v0.10.0 + with: + egress-policy: audit + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + - name: Validate codecov.yml structure + run: | + set -euo pipefail + response=$(curl -sS --fail-with-body -X POST \ + --connect-timeout 10 --max-time 60 \ + --data-binary @codecov.yml \ + https://codecov.io/validate) + echo "$response" diff --git a/.mergify.yml b/.mergify.yml new file mode 100644 index 0000000..c3877f5 --- /dev/null +++ b/.mergify.yml @@ -0,0 +1,4 @@ +extends: mergify + +merge_protections_settings: + reporting_method: check-runs diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..c81cf6e --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,21 @@ +# Repo context for AI assistants + +This repo holds the **Codecov Global YAML** for the `vyos` GitHub organization. + +## What lives here +- `codecov.yml` โ€” the canonical, comment-free dashboard-paste payload. Mirror of + `https://app.codecov.io/account/gh/vyos/yaml`. +- `.github/workflows/validate.yml` โ€” required CI check; POSTs the file to + `https://codecov.io/validate` on every PR/push. +- `.mergify.yml` โ€” extends central [vyos/mergify](https://github.com/vyos/mergify). +- `.coderabbit.yaml` โ€” inherits from [vyos/coderabbit](https://github.com/vyos/coderabbit) + (`inheritance: true` is mandatory). +- `README.md` โ€” change protocol + dashboard-paste discipline. + +## Change protocol +1. PRs only. No direct dashboard edits. +2. Keep `codecov.yml` comment-free โ€” Codecov strips comments on dashboard save; any + explanatory content lives here in AGENTS.md or in README.md. +3. After merge to `production`, operator pastes from + `gh api repos/vyos/codecov/contents/codecov.yml?ref=production --jq '.content' | base64 -d` + into the dashboard. Repo is the source of truth; dashboard is a cache. diff --git a/README.md b/README.md new file mode 100644 index 0000000..9b91370 --- /dev/null +++ b/README.md @@ -0,0 +1,56 @@ +# vyos/codecov + +Codecov Global YAML for the `vyos` GitHub organization. + +This repo is the canonical source for the file rendered at +[`https://app.codecov.io/account/gh/vyos/yaml`](https://app.codecov.io/account/gh/vyos/yaml). +The dashboard is a cache; this repo's `production` branch is the source of truth. + +Sibling repo: [VyOS-Networks/codecov](https://github.com/VyOS-Networks/codecov) for the +VyOS-Networks org. Both repos hold byte-identical `codecov.yml` at design time; any future +delta is enumerated in the per-org delta table below โ€” never as comments in `codecov.yml` +(Codecov strips them on dashboard save). + +## Change protocol + +1. PRs only. No direct dashboard edits. +2. PRs run the `validate` workflow which POSTs `codecov.yml` to + `https://codecov.io/validate`. The check must pass. +3. After merge to `production`: + ```bash + gh api repos/vyos/codecov/contents/codecov.yml?ref=production \ + --jq '.content' | base64 -d + ``` + Operator pastes this content into the dashboard editor (linked above), saves, + and re-opens the tab to confirm the saved content matches. + +## Paste protocol (operator) + +1. Open https://app.codecov.io/account/gh/vyos/yaml in browser. +2. Fetch the merged file via `gh api ... | base64 -d` (above). +3. Paste into the dashboard editor. +4. Save. +5. Re-open the dashboard tab. **Codecov strips comments** โ€” the saved content + should match the paste content because the file is comment-free. +6. Capture the Codecov change-history audit-log row (timestamp, user, prior version) + to the IS ticket as evidence. +7. Record merge commit SHA + paste timestamp + audit-log reference in the IS ticket. + +## Per-org delta (vyos vs VyOS-Networks) + +(none at the time of last update โ€” both orgs paste byte-identical `codecov.yml`) + +## Language-applicability caveat + +The numeric thresholds (`project.threshold: 1%`, `patch.target: 70%`, `patch.threshold: 5%`) +and the `ignore` patterns (`**/*.config.{ts,js,mjs,cjs}`, `**/*.d.ts`, `.next/`, `public/`) +are Next.js-derived from the canary in [VyOS-Networks/next-js-vyos](https://github.com/VyOS-Networks/next-js-vyos). +They are reasonable starting points for JS/TS repos and harmless for non-JS repos (the +`ignore` patterns simply don't match Python/C++/Ansible paths and the thresholds apply to +whatever does upload coverage). Repos in other languages that opt into Codecov should +override numerics in their per-repo `.codecov.yml`. + +## Onboarding a new repo to Codecov coverage + +(deferred โ€” see spec ยง9 follow-up; the playbook lives in `docs/per-repo-onboarding.md` once +the first non-canary opt-in lands) diff --git a/codecov.yml b/codecov.yml new file mode 100644 index 0000000..3c08860 --- /dev/null +++ b/codecov.yml @@ -0,0 +1,38 @@ +codecov: + require_ci_to_pass: true + +coverage: + precision: 1 + round: down + status: + project: + default: + target: auto + threshold: 1% + informational: true + if_ci_failed: ignore + only_pulls: false + patch: + default: + target: 70% + threshold: 5% + informational: true + if_ci_failed: ignore + +comment: + layout: "header, diff, flags, files" + behavior: default + require_changes: false + require_base: no + require_head: yes + +ignore: + - "tests/" + - "scripts/" + - "**/*.config.ts" + - "**/*.config.js" + - "**/*.config.mjs" + - "**/*.config.cjs" + - "**/*.d.ts" + - ".next/" + - "public/" -- cgit v1.2.3 From cf580caa3db4b4b1adaa541301d3d9ab8de5323b Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Wed, 12 Aug 2026 21:36:15 +0300 Subject: docs: clarify validate trigger scope + document tests/ and scripts/ ignore intent MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review-driven doc-only changes (CodeRabbit round 1 on PR #1): - AGENTS.md: the validate workflow runs on every PR and on pushes to production (the push branch-filter is deliberate; feature-branch pushes are covered by the pull_request trigger without duplicate runs) - README.md: document the intent of the global tests/ and scripts/ ignore patterns and the per-repo override path codecov.yml payload unchanged (byte-frozen to spec Appendix B). T9078: IS-609 ๐Ÿค– Generated by [robots](https://vyos.io) --- AGENTS.md | 2 +- README.md | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index c81cf6e..8a2dc4c 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -6,7 +6,7 @@ This repo holds the **Codecov Global YAML** for the `vyos` GitHub organization. - `codecov.yml` โ€” the canonical, comment-free dashboard-paste payload. Mirror of `https://app.codecov.io/account/gh/vyos/yaml`. - `.github/workflows/validate.yml` โ€” required CI check; POSTs the file to - `https://codecov.io/validate` on every PR/push. + `https://codecov.io/validate` on every PR and on pushes to `production`. - `.mergify.yml` โ€” extends central [vyos/mergify](https://github.com/vyos/mergify). - `.coderabbit.yaml` โ€” inherits from [vyos/coderabbit](https://github.com/vyos/coderabbit) (`inheritance: true` is mandatory). diff --git a/README.md b/README.md index 9b91370..f8c0125 100644 --- a/README.md +++ b/README.md @@ -47,8 +47,11 @@ and the `ignore` patterns (`**/*.config.{ts,js,mjs,cjs}`, `**/*.d.ts`, `.next/`, are Next.js-derived from the canary in [VyOS-Networks/next-js-vyos](https://github.com/VyOS-Networks/next-js-vyos). They are reasonable starting points for JS/TS repos and harmless for non-JS repos (the `ignore` patterns simply don't match Python/C++/Ansible paths and the thresholds apply to -whatever does upload coverage). Repos in other languages that opt into Codecov should -override numerics in their per-repo `.codecov.yml`. +whatever does upload coverage). The root `tests/` and `scripts/` patterns are also globally +ignored: coverage *of* test code and utility scripts is intentionally excluded from +reporting. A repo whose `scripts/` (or `tests/`) tree holds coverage-bearing product code +should override the `ignore` list in its per-repo `.codecov.yml`. Repos in other languages +that opt into Codecov should likewise override numerics in their per-repo `.codecov.yml`. ## Onboarding a new repo to Codecov coverage -- cgit v1.2.3 From 0e0ad13beb357b83faffcda48586641ebfd88b7b Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Wed, 12 Aug 2026 21:52:35 +0300 Subject: fix: address adversarial-review findings (validate error visibility + portable paste snippets) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - validate.yml: stream curl output directly; the response=$(...) capture under set -euo pipefail swallowed the validation error body on non-2xx (job failed with a bare exit code and no explanation) - AGENTS.md + README.md: quote the ?ref=production endpoint (zsh globs bare ?) and fetch via Accept: application/vnd.github.raw instead of jq + base64 (BSD/GNU base64 flag drift) codecov.yml payload unchanged (byte-frozen to spec Appendix B). T9078: IS-609 ๐Ÿค– Generated by [robots](https://vyos.io) --- .github/workflows/validate.yml | 5 ++--- AGENTS.md | 2 +- README.md | 6 +++--- 3 files changed, 6 insertions(+), 7 deletions(-) diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index f6096b0..4741ea8 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -22,8 +22,7 @@ jobs: - name: Validate codecov.yml structure run: | set -euo pipefail - response=$(curl -sS --fail-with-body -X POST \ + curl -sS --fail-with-body -X POST \ --connect-timeout 10 --max-time 60 \ --data-binary @codecov.yml \ - https://codecov.io/validate) - echo "$response" + https://codecov.io/validate diff --git a/AGENTS.md b/AGENTS.md index 8a2dc4c..fc6d9b6 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -17,5 +17,5 @@ This repo holds the **Codecov Global YAML** for the `vyos` GitHub organization. 2. Keep `codecov.yml` comment-free โ€” Codecov strips comments on dashboard save; any explanatory content lives here in AGENTS.md or in README.md. 3. After merge to `production`, operator pastes from - `gh api repos/vyos/codecov/contents/codecov.yml?ref=production --jq '.content' | base64 -d` + `gh api 'repos/vyos/codecov/contents/codecov.yml?ref=production' -H "Accept: application/vnd.github.raw"` into the dashboard. Repo is the source of truth; dashboard is a cache. diff --git a/README.md b/README.md index f8c0125..1d8a22e 100644 --- a/README.md +++ b/README.md @@ -18,8 +18,8 @@ delta is enumerated in the per-org delta table below โ€” never as comments in `c `https://codecov.io/validate`. The check must pass. 3. After merge to `production`: ```bash - gh api repos/vyos/codecov/contents/codecov.yml?ref=production \ - --jq '.content' | base64 -d + gh api 'repos/vyos/codecov/contents/codecov.yml?ref=production' \ + -H "Accept: application/vnd.github.raw" ``` Operator pastes this content into the dashboard editor (linked above), saves, and re-opens the tab to confirm the saved content matches. @@ -27,7 +27,7 @@ delta is enumerated in the per-org delta table below โ€” never as comments in `c ## Paste protocol (operator) 1. Open https://app.codecov.io/account/gh/vyos/yaml in browser. -2. Fetch the merged file via `gh api ... | base64 -d` (above). +2. Fetch the merged file via the quoted `gh api` raw-content command (above). 3. Paste into the dashboard editor. 4. Save. 5. Re-open the dashboard tab. **Codecov strips comments** โ€” the saved content -- cgit v1.2.3