From 3f1f7cfc8f40ac58ad4048359f9efa798e9903e0 Mon Sep 17 00:00:00 2001 From: "didericis (claude)" Date: Sat, 18 Jul 2026 05:33:41 -0400 Subject: [PATCH] ci(coverage): address review findings from PR #349 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Finding 1: set BOT_BOTTLE_BACKEND=firecracker on the coverage step so the integration suite actually exercises the Firecracker orchestration paths rather than defaulting to Docker - Finding 2: restrict the coverage job to push+workflow_dispatch only; PR-controlled code no longer executes on the privileged KVM runner automatically — maintainers trigger workflow_dispatch for trusted PRs - Finding 3: expand path filters to include workflow files, scripts, and README so changes to CI configuration trigger the workflow itself Co-Authored-By: Claude Sonnet 4.6 --- .gitea/workflows/test.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.gitea/workflows/test.yml b/.gitea/workflows/test.yml index 0ae0338..17d47e6 100644 --- a/.gitea/workflows/test.yml +++ b/.gitea/workflows/test.yml @@ -23,9 +23,16 @@ on: - main paths: - '**.py' + - '.gitea/workflows/**.yml' + - 'scripts/**' + - 'README.md' pull_request: paths: - '**.py' + - '.gitea/workflows/**.yml' + - 'scripts/**' + - 'README.md' + workflow_dispatch: jobs: unit: @@ -86,8 +93,15 @@ jobs: # and the network pool installed as the persistent systemd unit # (`./cli.py backend setup --backend=firecracker`). The preflight step # below fails fast with instructions if anything is missing. + # + # Security: this job executes PR-controlled code on a privileged runner + # (Docker, /dev/kvm, TAP/nft). It is restricted to push events (main + # branch) and manual workflow_dispatch by maintainers — it does NOT run + # on pull_request. Trusted PRs are validated by triggering workflow_dispatch + # on the PR branch before merging. coverage: runs-on: [self-hosted, kvm] + if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' steps: - name: Checkout uses: actions/checkout@v4 @@ -107,6 +121,8 @@ jobs: run: python3 -m pip install --user -r requirements-dev.txt - name: Combined coverage (unit + integration, incl. firecracker) + env: + BOT_BOTTLE_BACKEND: firecracker run: PYTHON=python3 bash scripts/coverage.sh critical - name: Diff-coverage gate (changed lines >= 90%)