tangle

commit 1538b5b847fd83af7c8d56784ac2a9f49038862b
parent 904a261440744fabee906be38defb45e9f90be82
Author: triesap <tyson@radroots.org>
Date:   Sat,  6 Jun 2026 14:13:43 -0700

quality: require full coverage

- fail coverage when any workspace source line remains uncovered
- print missing coverage lines from the coverage script
- add a guard for coverage script, CI, validation, and Nix wiring
- run the coverage gate from the workspace check script

Diffstat:
A
crates/tangle/tests/coverage_gate.rs
 | 
53
+++++++++++++++++++++++++++++++++++++++++++++++++++++
M
scripts/check.sh
 | 
1
+
M
scripts/coverage.sh
 | 
2
+-

3 files changed, 55 insertions(+), 1 deletion(-)
diff --git a/crates/tangle/tests/coverage_gate.rs b/crates/tangle/tests/coverage_gate.rs
@@ -0,0 +1,53 @@
+#![forbid(unsafe_code)]
+
+use std::fs;
+use std::path::{Path, PathBuf};
+
+#[test]
+fn coverage_script_requires_workspace_full_line_coverage() {
+    let script = read("scripts/coverage.sh");
+
+    assert!(script.contains("cargo llvm-cov --version"));
+    assert!(script.contains("cargo llvm-cov clean --workspace"));
+    assert!(script.contains("cargo llvm-cov --workspace --all-targets"));
+    assert!(script.contains("--show-missing-lines"));
+    assert!(script.contains("--fail-under-lines 100"));
+    assert!(script.contains("--fail-uncovered-lines 0"));
+}
+
+#[test]
+fn ci_and_validation_contract_require_coverage_gate() {
+    let ci = read("scripts/ci.sh");
+    let validation = read("ci/workspace-validation.toml");
+
+    assert!(ci.contains("scripts/coverage.sh"));
+    assert!(validation.contains("id = \"coverage\""));
+    assert!(validation.contains("command = \"scripts/coverage.sh\""));
+    assert!(validation.contains("\"cargo-llvm-cov\""));
+    assert!(validation.contains("\"llvm-cov\""));
+    assert!(validation.contains("\"llvm-profdata\""));
+}
+
+#[test]
+fn nix_coverage_app_provisions_coverage_tools_and_environment() {
+    let flake = read("flake.nix");
+
+    assert!(flake.contains("pkgs.cargo-llvm-cov"));
+    assert!(flake.contains("pkgs.llvmPackages.llvm"));
+    assert!(flake.contains("LLVM_COV=\"$(command -v llvm-cov)\""));
+    assert!(flake.contains("LLVM_PROFDATA=\"$(command -v llvm-profdata)\""));
+    assert!(flake.contains("coverage = mkScript"));
+    assert!(flake.contains("scripts/coverage.sh"));
+}
+
+fn read(path: &str) -> String {
+    fs::read_to_string(workspace_root().join(path)).expect(path)
+}
+
+fn workspace_root() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .parent()
+        .and_then(Path::parent)
+        .expect("workspace root")
+        .to_path_buf()
+}
diff --git a/scripts/check.sh b/scripts/check.sh
@@ -2,6 +2,7 @@
 set -euo pipefail
 
 cargo fmt --all -- --check
+cargo test -p tangle --test coverage_gate
 cargo test -p tangle --test source_comments
 cargo test -p tangle --test unsafe_code
 cargo check --workspace --all-targets
diff --git a/scripts/coverage.sh b/scripts/coverage.sh
@@ -7,4 +7,4 @@ if ! cargo llvm-cov --version >/dev/null 2>&1; then
 fi
 
 cargo llvm-cov clean --workspace
-cargo llvm-cov --workspace --all-targets --fail-under-lines 100
+cargo llvm-cov --workspace --all-targets --show-missing-lines --fail-under-lines 100 --fail-uncovered-lines 0