ci: surface code coverage on pull requests

.codecov.yml

@@ -0,0 +1,30 @@
+coverage:
+  # Both gates are informational — they show up in PR comments and Codecov
+  # status checks but never block merge. Flip `informational: false` later
+  # when we want to enforce a floor.
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 1%
+        informational: true
+    patch:
+      default:
+        target: auto
+        informational: true
+
+comment:
+  layout: "diff, flags, files"
+  behavior: default
+  require_changes: false
+
+ignore:
+  # Vendored third-party code we don't own
+  - "3rd/**"
+  # Build artifacts and generated headers
+  - "build/**"
+  - "**/*.pb.h"
+  - "**/*.pb.cc"
+  # Test sources themselves don't need to be coverage targets
+  - "**/tests/**"
+  - "**/test_*.cpp"

.github/workflows/build_debug.yml

@@ -3,6 +3,8 @@ name: Debug Builds
 on:
   push:
     branches: [ develop, master, release/** ]
+  pull_request:
+    branches: [ develop ]
 
 env:
   CTEST_OUTPUT_ON_FAILURE: 1
@@ -12,6 +14,10 @@ env:
 jobs:
   code-coverage:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
     outputs:
       version_number: ${{ steps.build.outputs.version }}
     steps:
@@ -67,8 +73,18 @@ jobs:
           name: pktvisor
           verbose: true
 
+      - name: Report coverage to PR
+        if: github.event_name == 'pull_request'
+        uses: zgosalvez/github-actions-report-lcov@7d72c57ce4bc101a4a0bf9d726b6c435abde8439 #v7.0.10
+        with:
+          coverage-files: build/coverage.info
+          artifact-name: code-coverage-report
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          update-comment: true
+
   build:
     runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request'
     steps:
       - uses: actions/checkout@v6
 
@@ -113,6 +129,7 @@ jobs:
   package:
     needs: build
     runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request'
     steps:
       - name: Download to workspace
         uses: actions/download-artifact@v8

CMakeLists.txt

@@ -92,7 +92,13 @@ if(CODE_COVERAGE)
     setup_target_for_coverage_lcov(
             NAME coverage
             EXECUTABLE ctest
-            EXCLUDE "3rd/*" "cmd/*" "libs/*" "${PROJECT_BINARY_DIR}/*")
+            LCOV_ARGS --ignore-errors unused
+            EXCLUDE
+                "3rd/*"
+                "libs/*"
+                "${PROJECT_BINARY_DIR}/*"
+                "/usr/*"
+                "*/c++/*")
 endif()
 
 set(VISOR_STATIC_PLUGINS)