From 0ffadfa578396171891b8d39dcd384848ab079a5 Mon Sep 17 00:00:00 2001
From: gloskull <gloskull24@gmail.com>
Date: Fri, 17 Jul 2026 18:44:51 +0100
Subject: [PATCH] Enforce coverage threshold in CI

---
 .github/workflows/ci.yml |  6 ++++++
 README.md                |  7 ++++++-
 scripts/coverage.sh      | 20 ++++++++++++++++++++
 3 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100755 scripts/coverage.sh

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9899a37..f477336 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,6 +27,12 @@ jobs:
         run: cargo clippy --all-targets --all-features -- -D warnings
       - name: Run tests
         run: cargo test
+      - name: Install coverage tooling
+        run: cargo install cargo-llvm-cov --locked
+      - name: Enforce coverage threshold
+        env:
+          COVERAGE_THRESHOLD: 80
+        run: scripts/coverage.sh
       - name: Fuzz test detection
         run: |
           if [ -d "contracts/utility_contracts/fuzz" ]; then
diff --git a/README.md b/README.md
index 2a092ec..e1ffe3d 100644
--- a/README.md
+++ b/README.md
@@ -98,6 +98,9 @@ cd contracts && cargo build --target wasm32-unknown-unknown --release
 # Test
 cargo test
 
+# Coverage (requires cargo-llvm-cov)
+COVERAGE_THRESHOLD=80 scripts/coverage.sh
+
 # Lint
 cargo fmt --all -- --check
 cargo clippy --all-targets --all-features -- -D warnings
@@ -115,7 +118,8 @@ The GitHub Actions workflow (`.github/workflows/ci.yml`) automatically runs on:
 2. **Code Quality**: `cargo fmt --all -- --check` + `cargo clippy --target wasm32-unknown-unknown -- -D warnings`
 3. **Build**: `cargo build --target wasm32-unknown-unknown --release`
 4. **Unit Tests**: `cargo test` including fuzz tests
-5. **Fuzz Tests**: Auto-detection and validation of fuzz infrastructure
+5. **Coverage Gate**: `scripts/coverage.sh` enforces the configured line coverage threshold (`COVERAGE_THRESHOLD`, default 80%) for both the root package and contracts workspace
+6. **Fuzz Tests**: Auto-detection and validation of fuzz infrastructure
 
 ### Local Development
 
@@ -124,6 +128,7 @@ cargo fmt --all -- --check
 cargo clippy --target wasm32-unknown-unknown -- -D warnings
 cargo build --target wasm32-unknown-unknown --release
 cargo test
+COVERAGE_THRESHOLD=80 scripts/coverage.sh
 ```
 
 ## ZK-SNARK Circuits for Sensor Privacy
diff --git a/scripts/coverage.sh b/scripts/coverage.sh
new file mode 100755
index 0000000..31bdc4d
--- /dev/null
+++ b/scripts/coverage.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+COVERAGE_THRESHOLD="${COVERAGE_THRESHOLD:-80}"
+CARGO_LLVM_COV_FLAGS=(--locked --all-features --workspace --fail-under-lines "${COVERAGE_THRESHOLD}")
+
+if ! command -v cargo-llvm-cov >/dev/null 2>&1; then
+  echo "cargo-llvm-cov is required. Install it with: cargo install cargo-llvm-cov --locked"
+  exit 127
+fi
+
+echo "Enforcing line coverage threshold: ${COVERAGE_THRESHOLD}%"
+
+echo "::group::Root package coverage"
+cargo llvm-cov "${CARGO_LLVM_COV_FLAGS[@]}"
+echo "::endgroup::"
+
+echo "::group::Contracts workspace coverage"
+cargo llvm-cov --manifest-path contracts/Cargo.toml "${CARGO_LLVM_COV_FLAGS[@]}"
+echo "::endgroup::"