gitlab_quality-test_tooling 3.16.0 → 3.19.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4c662ad8ff8b0b48b868eb201c12bd783c4a446bf0647d01e42778d59fd9f334
-  data.tar.gz: 3b26b7d715a0d55314e35194f490bef33aefc590356095bfb247e3f81cc2da5b
+  metadata.gz: 5fb5356dd9a684e76ccf4de875f66d77ee818bef86d1cd9792eb8db9d688cfe9
+  data.tar.gz: 75e5afd55644a124fbf09f4fe0edd8f298fb2614f54dd0884a8a18002d2fe6d8
 SHA512:
-  metadata.gz: b09d7935e13222a40f137f51a4ddc0164e3da841b9fc30eba901f8cead0f237a5ff1cc6c8df44a121e42d207fe0b1442e62ab3bc415f477a95a95ae05553c8c7
-  data.tar.gz: 2d9f33720064de7b9f8b78c00fafe7ff0b582e7554b7c7f7d89e690b080cf5e71aa515407e3825ce110f48221f3761816268841c594c823b2539576530a4e938
+  metadata.gz: 35ff364a8fbbd437bef5e94a6bedccf66b8288965fd6c136ce6c21baa3d9052ac44281e54dd3a11eb92dae156f6e9e123756fa526ddb24fd39c00450b1d7187e
+  data.tar.gz: 1de79819dcb8aadf7ef3994f54387008ff9d1e15ea4a0b0590caebe9cf2af99a2821dcc7008b7bff5b2df9da69d4103622624983ce7434272ec2e5663c1e6695

data/AGENTS.md

@@ -1,6 +1,6 @@
 # gitlab_quality-test_tooling
 
-Ruby gem providing test tooling for GitLab CI — metrics export, test quarantine, failure reporting, flaky test tracking, and code coverage analysis.
+Ruby gem providing test tooling for GitLab CI — test quarantine, failure reporting, flaky test tracking, and code coverage analysis.
 
 ## Tech Stack
 
@@ -70,11 +70,14 @@ Reference: https://docs.gitlab.com/ee/development/changelog.html
 
 ## Key Modules
 
-- **TestMetricsExporter** — Serializes RSpec results to ClickHouse (exception classes, failure messages, CI metadata)
-- **Report** — Creates/updates GitLab issues for test failures, flaky tests, slow tests
+- **Report** — Creates/updates GitLab issues for test failures, flaky tests, slow tests. `RelateFailureIssue` can also trigger a GitLab Duo Agent Platform workflow to investigate newly-created failure issues (see `--duo-analysis` on `exe/relate-failure-issue`); the agent posts its analysis back as an issue comment.
 - **TestQuarantine** — RSpec formatter that skips quarantined tests
 - **CodeCoverage** — Coverage analysis and responsibility patterns
-- **ClickHouse::Client** — Batch HTTP client for pushing metrics
+- **ClickHouse::Client** — HTTP query/insert client for ClickHouse, used by the code coverage subsystem
+
+## Review Guidance
+
+- `RelateFailureIssue#trigger_duo_analysis` deliberately rescues all `StandardError` (best-effort): a Duo/API failure must never block failure-issue creation. Preserve the broad rescue — don't narrow or remove it.
 
 ## Release Process
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    gitlab_quality-test_tooling (3.16.0)
+    gitlab_quality-test_tooling (3.19.1)
       activesupport (>= 7.0)
       amatch (~> 0.4.1)
       fog-google (~> 1.24, >= 1.24.1)

data/README.md

@@ -93,6 +93,7 @@ Usage: exe/relate-failure-issue [options]
                                      Labels to exclude when searching for existing issues
         --confidential               Makes created new issues confidential
         --dry-run                    Perform a dry-run (don't create or update issues)
+        --duo-analysis MODES         Start a GitLab Duo workflow to investigate failure issues (comma-separated modes; supported: create). Off by default
     -v, --version                    Show the version
     -h, --help                       Show the usage
 ```
@@ -263,6 +264,12 @@ Usage: exe/feature-readiness-evaluation [options]
 
 ### `exe/test-coverage`
 
+Runs in one of three modes:
+
+- **Full coverage-metrics export** (default, no `--per-test-coverage` / `--run-aggregation`): reads the LCOV report, Crystalball test map, and test reports, then exports the coverage-metrics and test-file-mapping tables. Requires the full argument set.
+- **Per-test coverage** (`--per-test-coverage GLOB`): inserts per-test rows into `code_coverage.test_coverage_per_file` and runs the daily `test_health_risk` aggregation unless `--skip-aggregation`. Needs only the `--clickhouse-*` options; `--test-reports` and `--jest-quarantine-file` are optional enrichment.
+- **Aggregation only** (`--run-aggregation`): runs the daily `test_health_risk` aggregation and exits. Needs only the `--clickhouse-*` options. Pair with `--skip-aggregation` on batched per-test inserts to aggregate once at the end instead of once per batch.
+
 ```shell
 Purpose: Export test coverage metrics to ClickHouse
 Usage: exe/test-coverage [options]
@@ -280,6 +287,10 @@ Options:
                                      ClickHouse shared database name
         --responsibility-patterns PATH
                                      Path to YAML file with responsibility classification patterns
+        --per-test-coverage GLOB     Per-test coverage mode (see above). Glob for per-test coverage JSON/NDJSON files.
+        --jest-quarantine-file PATH  Optional. Path to quarantined_vue3_specs.txt, ingested before the aggregation.
+        --skip-aggregation           Optional. With --per-test-coverage, insert rows without running the aggregation.
+        --run-aggregation            Run only the daily test_health_risk aggregation, then exit.
 
 Environment variables:
   GLCI_CLICKHOUSE_METRICS_PASSWORD   ClickHouse password (required, not passed via CLI for security)

data/exe/relate-failure-issue

@@ -66,6 +66,16 @@ options = OptionParser.new do |opts|
     params[:environment_issues_output_file] = file
   end
 
+  opts.on('--duo-analysis MODES', Array,
+    'Start a GitLab Duo Agent Platform workflow to investigate failure issues (the agent posts its ' \
+      'analysis back as a comment). Comma-separated modes; currently supported: create. Off by default.') do |modes|
+    supported = %w[create]
+    invalid = modes - supported
+    raise OptionParser::InvalidArgument, "#{invalid.join(',')} (supported: #{supported.join(',')})" if invalid.any?
+
+    params[:duo_analysis] = modes
+  end
+
   opts.on_tail('-v', '--version', 'Show the version') do
     require_relative "../lib/gitlab_quality/test_tooling/version"
     puts "#{$PROGRAM_NAME} : #{GitlabQuality::TestTooling::VERSION}"

data/exe/test-coverage

@@ -14,6 +14,7 @@ require_relative '../lib/gitlab_quality/test_tooling/code_coverage/click_house/p
 require_relative '../lib/gitlab_quality/test_tooling/code_coverage/click_house/test_file_mappings_table'
 require_relative '../lib/gitlab_quality/test_tooling/code_coverage/click_house/jest_quarantined_tests_table'
 require_relative '../lib/gitlab_quality/test_tooling/code_coverage/click_house/test_health_risk_aggregator'
+require_relative '../lib/gitlab_quality/test_tooling/code_coverage/click_house/test_health_score_snapshotter'
 require_relative '../lib/gitlab_quality/test_tooling/code_coverage/coverage_data'
 require_relative '../lib/gitlab_quality/test_tooling/code_coverage/lcov_file'
 require_relative '../lib/gitlab_quality/test_tooling/code_coverage/artifacts'
@@ -21,12 +22,12 @@ require_relative '../lib/gitlab_quality/test_tooling/code_coverage/test_report'
 require_relative '../lib/gitlab_quality/test_tooling/code_coverage/test_map'
 require_relative '../lib/gitlab_quality/test_tooling/code_coverage/test_file_mapping_data'
 require_relative '../lib/gitlab_quality/test_tooling/code_coverage/per_test_coverage_data'
+require_relative '../lib/gitlab_quality/test_tooling/code_coverage/per_test_coverage_exporter'
 require_relative '../lib/gitlab_quality/test_tooling/code_coverage/source_file_classifier'
 require_relative '../lib/gitlab_quality/test_tooling/code_coverage/responsibility_classifier'
 require_relative '../lib/gitlab_quality/test_tooling/code_coverage/responsibility_patterns_config'
 
 params = {}
-required_params = [:test_reports, :coverage_report, :test_map, :clickhouse_url, :clickhouse_database, :clickhouse_username, :clickhouse_shared_database, :responsibility_patterns]
 
 options = OptionParser.new do |opts|
   opts.banner = "Usage: #{$PROGRAM_NAME} [options]"
@@ -68,19 +69,35 @@ options = OptionParser.new do |opts|
   end
 
   opts.on('--per-test-coverage GLOB',
-    'Optional. Glob pattern for per-test coverage JSON files. ' \
-      'When provided, populates code_coverage.test_coverage_per_file and runs the ' \
-      'daily test_health_risk aggregation. (e.g., "tmp/per-test-coverage-*.json")') do |pattern|
+    'Per-test coverage mode. Glob for per-test coverage JSON/NDJSON files. ' \
+      'Inserts rows into code_coverage.test_coverage_per_file and runs the daily ' \
+      'test_health_risk aggregation unless --skip-aggregation. Needs only the ' \
+      '--clickhouse-* options; --test-reports and --jest-quarantine-file are ' \
+      'optional enrichment. (e.g., "tmp/per-test-coverage-*.ndjson")') do |pattern|
     params[:per_test_coverage] = pattern
   end
 
   opts.on('--jest-quarantine-file PATH',
     'Optional. Path to quarantined_vue3_specs.txt. When provided alongside ' \
       '--per-test-coverage, populates code_coverage.jest_quarantined_tests_today ' \
-      'before the nightly aggregation so Jest tests count toward is_quarantined.') do |path|
+      'before the aggregation so Jest tests count toward is_quarantined.') do |path|
     params[:jest_quarantine_file] = path
   end
 
+  opts.on('--skip-aggregation',
+    'Optional. With --per-test-coverage, insert rows (and ingest the jest ' \
+      'quarantine file) without running the test_health_risk aggregation. Use ' \
+      'when streaming many batches, then run --run-aggregation once at the end.') do
+    params[:skip_aggregation] = true
+  end
+
+  opts.on('--run-aggregation',
+    'Run only the daily test_health_risk aggregation over ' \
+      'code_coverage.test_coverage_per_file, then exit. Needs only the ' \
+      '--clickhouse-* options.') do
+    params[:run_aggregation] = true
+  end
+
   opts.separator ""
   opts.separator "Environment variables:"
   opts.separator "  GLCI_CLICKHOUSE_METRICS_PASSWORD   ClickHouse password (required, not passed via CLI for security)"
@@ -102,31 +119,81 @@ options = OptionParser.new do |opts|
   opts.parse(ARGV)
 end
 
-if params.any? && (required_params - params.keys).none?
-  clickhouse_password = ENV.fetch('GLCI_CLICKHOUSE_METRICS_PASSWORD', nil)
-  if clickhouse_password.to_s.strip.empty?
-    puts "Error: GLCI_CLICKHOUSE_METRICS_PASSWORD environment variable must be set and not empty"
-    exit 1
+mode =
+  if params[:run_aggregation]
+    puts "Warning: --per-test-coverage is ignored in --run-aggregation mode." if params[:per_test_coverage]
+    :aggregation
+  elsif params[:per_test_coverage]
+    :per_test
+  else
+    :full_export
   end
 
-  [:clickhouse_url, :clickhouse_database, :clickhouse_username, :clickhouse_shared_database].each do |param|
-    if params[param].to_s.strip.empty?
-      puts "Error: --#{param.to_s.tr('_', '-')} cannot be empty"
-      exit 1
-    end
-  end
+# Per-test and aggregation-only modes are self-contained: they touch only the
+# ClickHouse connection, not the LCOV report, Crystalball test map, or
+# responsibility patterns the full coverage-metrics export needs.
+clickhouse_required = [:clickhouse_url, :clickhouse_database, :clickhouse_username]
+full_export_required =
+  [:test_reports, :coverage_report, :test_map, :responsibility_patterns, :clickhouse_shared_database] + clickhouse_required
+required_params = mode == :full_export ? full_export_required : clickhouse_required
 
-  begin
-    uri = URI.parse(params[:clickhouse_url])
-    unless uri.is_a?(URI::HTTP) || uri.is_a?(URI::HTTPS)
-      puts "Error: --clickhouse-url must be a valid HTTP or HTTPS URL"
-      exit 1
-    end
-  rescue URI::InvalidURIError
-    puts "Error: --clickhouse-url is not a valid URL format"
+unless params.any? && (required_params - params.keys).none?
+  puts "Missing argument(s). Required arguments are: #{required_params}\nPassed arguments are: #{params}\n"
+  puts options
+  exit 1
+end
+
+clickhouse_password = ENV.fetch('GLCI_CLICKHOUSE_METRICS_PASSWORD', nil)
+if clickhouse_password.to_s.strip.empty?
+  puts "Error: GLCI_CLICKHOUSE_METRICS_PASSWORD environment variable must be set and not empty"
+  exit 1
+end
+
+non_empty_params = mode == :full_export ? clickhouse_required + [:clickhouse_shared_database] : clickhouse_required
+non_empty_params.each do |param|
+  next unless params[param].to_s.strip.empty?
+
+  puts "Error: --#{param.to_s.tr('_', '-')} cannot be empty"
+  exit 1
+end
+
+begin
+  uri = URI.parse(params[:clickhouse_url])
+  unless uri.is_a?(URI::HTTP) || uri.is_a?(URI::HTTPS)
+    puts "Error: --clickhouse-url must be a valid HTTP or HTTPS URL"
     exit 1
   end
+rescue URI::InvalidURIError
+  puts "Error: --clickhouse-url is not a valid URL format"
+  exit 1
+end
 
+clickhouse_data = {
+  url: params[:clickhouse_url],
+  database: params[:clickhouse_database],
+  username: params[:clickhouse_username],
+  password: clickhouse_password
+}
+
+case mode
+when :aggregation
+  GitlabQuality::TestTooling::CodeCoverage::ClickHouse::TestHealthRiskAggregator.new(**clickhouse_data).run
+  # Best-effort: the score snapshot is a non-critical add-on, so it must not
+  # fail the job after the aggregation has already succeeded.
+  begin
+    GitlabQuality::TestTooling::CodeCoverage::ClickHouse::TestHealthScoreSnapshotter.new(**clickhouse_data).run
+  rescue StandardError => e
+    warn "Warning: score snapshot failed (aggregation succeeded), continuing: #{e.message}"
+  end
+when :per_test
+  GitlabQuality::TestTooling::CodeCoverage::PerTestCoverageExporter.new(
+    coverage_glob: params[:per_test_coverage],
+    clickhouse: clickhouse_data,
+    test_reports: params[:test_reports],
+    jest_quarantine_file: params[:jest_quarantine_file],
+    skip_aggregation: params.fetch(:skip_aggregation, false)
+  ).run
+when :full_export
   artifacts = GitlabQuality::TestTooling::CodeCoverage::Artifacts.new(
     coverage_report: params[:coverage_report],
     test_map: params[:test_map],
@@ -181,13 +248,6 @@ if params.any? && (required_params - params.keys).none?
     test_classifications
   )
 
-  clickhouse_data = {
-    url: params[:clickhouse_url],
-    database: params[:clickhouse_database],
-    username: params[:clickhouse_username],
-    password: clickhouse_password
-  }
-
   shared_clickhouse_data = {
     url: params[:clickhouse_url],
     database: params[:clickhouse_shared_database],
@@ -210,36 +270,4 @@ if params.any? && (required_params - params.keys).none?
   )
   test_file_mappings_table = GitlabQuality::TestTooling::CodeCoverage::ClickHouse::TestFileMappingsTable.new(**shared_clickhouse_data)
   test_file_mappings_table.push(test_file_mapping_data.as_db_table)
-
-  # Per-test coverage export (optional). Only runs when --per-test-coverage
-  # was provided AND at least one matching artifact exists.
-  if params[:per_test_coverage]
-    per_test_files = Dir.glob(params[:per_test_coverage])
-    if per_test_files.any?
-      per_test_data = GitlabQuality::TestTooling::CodeCoverage::PerTestCoverageData.new(
-        per_test_files,
-        tests_to_categories: tests_to_categories,
-        feature_categories_to_teams: category_owners.feature_categories_to_teams,
-        captured_sha: ENV.fetch('CI_COMMIT_SHA', '')
-      )
-      per_test_coverage_table = GitlabQuality::TestTooling::CodeCoverage::ClickHouse::PerTestCoverageTable.new(**clickhouse_data)
-      per_test_coverage_table.push(per_test_data.as_db_table)
-
-      if params[:jest_quarantine_file] && File.exist?(params[:jest_quarantine_file])
-        jest_qt = GitlabQuality::TestTooling::CodeCoverage::ClickHouse::JestQuarantinedTestsTable.new(**clickhouse_data)
-        jest_qt.populate(quarantine_file: params[:jest_quarantine_file])
-      elsif params[:jest_quarantine_file]
-        puts "Jest quarantine file not found at #{params[:jest_quarantine_file]}; skipping jest quarantine ingestion."
-      end
-
-      aggregator = GitlabQuality::TestTooling::CodeCoverage::ClickHouse::TestHealthRiskAggregator.new(**clickhouse_data)
-      aggregator.run
-    else
-      puts "No per-test coverage artifacts matched #{params[:per_test_coverage]}; skipping per-test export and aggregation."
-    end
-  end
-else
-  puts "Missing argument(s). Required arguments are: #{required_params}\nPassed arguments are: #{params}\n"
-  puts options
-  exit 1
 end

data/lib/gitlab_quality/test_tooling/code_coverage/click_house/per_test_coverage_table.rb

@@ -20,7 +20,15 @@ module GitlabQuality
         # unioned into one row by the loader, not handed in as duplicates.
         class PerTestCoverageTable < GitlabQuality::TestTooling::CodeCoverage::ClickHouse::Table
           TABLE_NAME = "test_coverage_per_file"
-          BATCH_SIZE = 500
+          # Cap each INSERT by rendered byte size rather than a fixed row count.
+          # test_coverage_per_file is a SharedReplacingMergeTree partitioned by
+          # month, so every INSERT lands a part in one partition; hundreds of
+          # tiny inserts pile up parts faster than background merges collapse
+          # them, and ClickHouse throttles inserts once the per-partition part
+          # count climbs. Batching by bytes keeps the part count low while
+          # bounding each statement well within ClickHouse's limits, regardless
+          # of how wide a row's covered-line bitmap is.
+          MAX_BATCH_BYTES = 4 * 1024 * 1024
           # Intentionally generous ceiling on line numbers. Real source files
           # are thousands of lines; generated artifacts (large GraphQL schemas,
           # bundled JS, JSON manifests) can run past 100k. The cap is set to
@@ -45,10 +53,11 @@ module GitlabQuality
 
             return logger.warn("#{LOG_PREFIX} No valid data found after sanitization, skipping ClickHouse export!") if sanitized_data.empty?
 
-            total_batches = (sanitized_data.size.to_f / BATCH_SIZE).ceil
-            sanitized_data.each_slice(BATCH_SIZE).with_index do |batch, index|
-              logger.debug("#{LOG_PREFIX} Pushing batch #{index + 1} of #{total_batches} (#{batch.size} rows)")
-              client.query(build_insert_sql(batch), format: "TabSeparated")
+            batch_index = 0
+            each_byte_limited_batch(sanitized_data) do |rows_sql|
+              batch_index += 1
+              logger.debug("#{LOG_PREFIX} Pushing batch #{batch_index} (#{rows_sql.size} rows)")
+              client.query(build_insert_sql(rows_sql), format: "TabSeparated")
             end
             logger.info("#{LOG_PREFIX} Successfully pushed #{sanitized_data.size} records to #{full_table_name}")
           rescue StandardError => e
@@ -115,16 +124,40 @@ module GitlabQuality
             }
           end
 
-          def build_insert_sql(batch)
-            rows_sql = batch.map { |record| build_row_sql(record) }.join(",\n")
+          # Render an INSERT from already-built per-row SQL fragments. Callers
+          # group the fragments by byte size via `each_byte_limited_batch`.
+          def build_insert_sql(rows_sql)
             <<~SQL
               INSERT INTO #{full_table_name}
                 (timestamp, ci_project_path, test_file, source_file, covered_lines, total_lines, feature_category, `group`, stage, section, captured_sha)
               VALUES
-              #{rows_sql}
+              #{rows_sql.join(",\n")}
             SQL
           end
 
+          # Yield arrays of rendered row SQL grouped so each INSERT stays under
+          # MAX_BATCH_BYTES. A record whose own rendered size exceeds the cap is
+          # still emitted alone rather than dropped.
+          def each_byte_limited_batch(records)
+            batch = []
+            batch_bytes = 0
+
+            records.each do |record|
+              row_sql = build_row_sql(record)
+
+              if batch.any? && batch_bytes + row_sql.bytesize > MAX_BATCH_BYTES
+                yield batch
+                batch = []
+                batch_bytes = 0
+              end
+
+              batch << row_sql
+              batch_bytes += row_sql.bytesize
+            end
+
+            yield batch if batch.any?
+          end
+
           # Precondition: `record[:covered_lines]` is the sanitised integer
           # array produced upstream by `sanitize_lines` (via
           # `sanitized_data_record`). Values are positive integers within

data/lib/gitlab_quality/test_tooling/code_coverage/click_house/test_health_risk_aggregation.sql

@@ -71,27 +71,44 @@ WITH
     GROUP BY test_file
     HAVING is_flaky
   ),
-  -- Jest quarantine comes from a flat file (quarantined_vue3_specs.txt) rather
-  -- than the issue-based RSpec ledger. It is populated into this helper table
-  -- by JestQuarantinedTestsTable before each nightly aggregation run.
-  jest_quarantine_status AS (
-    SELECT test_file
-    FROM code_coverage.jest_quarantined_tests_today FINAL
+  test_ownership AS (
+    -- Authoritative test-file ownership from test_metrics, which resolves
+    -- feature_category to group/stage/section from a current source. The
+    -- per-test coverage export's own CategoryOwners mapping is stale (it fetches
+    -- a dated stages.yml), so many rows arrive with a blank group; this is the
+    -- fallback. argMax pins the latest ownership per file over the risk window.
+    SELECT
+      file_path,
+      argMax(`group`, timestamp) AS owner_group,
+      argMax(stage, timestamp) AS owner_stage,
+      argMax(section, timestamp) AS owner_section
+    FROM test_metrics.test_results
+    WHERE timestamp >= now() - INTERVAL {risk_window}
+      AND `group` NOT IN ('', 'unknown')
+    GROUP BY file_path
   ),
   per_test_status AS (
     SELECT
-      tc.source_file,
-      tc.`group`,
-      tc.stage,
-      tc.section,
-      tc.total_lines,
-      tc.covered_lines,
-      (coalesce(qs.is_quarantined, FALSE) OR (jq.test_file IS NOT NULL)) AS is_quarantined,
+      tc.source_file AS source_file,
+      -- Fall back to test_metrics ownership when the coverage row has no group
+      -- (stale CategoryOwners mapping). Resolve all three off the same condition
+      -- so the team stays internally consistent. Alias the passthrough columns to
+      -- bare names too: the analyzer otherwise keeps the `tc.` qualifier once the
+      -- ownership join is in play, and per_file references them unqualified.
+      if(tc.`group` != '', tc.`group`, own.owner_group) AS `group`,
+      if(tc.`group` != '', tc.stage, own.owner_stage) AS stage,
+      if(tc.`group` != '', tc.section, own.owner_section) AS section,
+      tc.total_lines AS total_lines,
+      tc.covered_lines AS covered_lines,
+      -- Jest quarantine is a flat list (quarantined_vue3_specs.txt), loaded into
+      -- jest_quarantined_tests_today by JestQuarantinedTestsTable before each run.
+      (coalesce(qs.is_quarantined, FALSE)
+        OR tc.test_file IN (SELECT test_file FROM code_coverage.jest_quarantined_tests_today FINAL)) AS is_quarantined,
       coalesce(fs.is_flaky, FALSE) AS is_flaky
     FROM code_coverage.test_coverage_per_file tc FINAL
-    LEFT JOIN quarantine_status      qs ON qs.test_file = tc.test_file
-    LEFT JOIN jest_quarantine_status jq ON jq.test_file = tc.test_file
-    LEFT JOIN flaky_status           fs ON fs.test_file = tc.test_file
+    LEFT JOIN quarantine_status qs ON qs.test_file = tc.test_file
+    LEFT JOIN flaky_status      fs ON fs.test_file = tc.test_file
+    LEFT JOIN test_ownership own ON own.file_path = tc.test_file
     WHERE tc.timestamp >= now() - INTERVAL {coverage_window}
   ),
   per_file AS (

data/lib/gitlab_quality/test_tooling/code_coverage/click_house/test_health_score_snapshot.sql

@@ -0,0 +1,31 @@
+-- Freezes today's per-pillar Test Health Index scores into the history table.
+--
+-- Reads one pillar's score view (the same view the dashboard reads, so the
+-- snapshot and the dashboard cannot diverge) and tags each row with the
+-- snapshot date and the pillar. Run once per pillar by
+-- TestHealthScoreSnapshotter, right after the daily risk aggregation refreshes
+-- test_health_risk_per_group, which the view reads.
+--
+-- Idempotency: the target is a SharedReplacingMergeTree keyed by
+-- (snapshot_date, level, group, stage, section, pillar) with a version column,
+-- so re-running for the same snapshot_date upserts and the last run of the day
+-- wins on merge. No "final run of the day" detection is needed.
+--
+-- Parameter substitution uses {name} braces, replaced via gsub in
+-- TestHealthScoreSnapshotter#build_sql after each value passes a regex check:
+--   {snapshot_date} : the date stamp for this run, e.g. '2026-05-07'
+--   {pillar}        : quarantine | slow (names the view and tags the rows)
+INSERT INTO code_coverage.test_health_score_history
+  (snapshot_date, level, `group`, stage, section, pillar, score, rag_status, formula_version, factors)
+SELECT
+  toDate('{snapshot_date}') AS snapshot_date,
+  level,
+  `group`,
+  stage,
+  section,
+  '{pillar}' AS pillar,
+  score,
+  rag_status,
+  formula_version,
+  factors
+FROM code_coverage.test_health_scores_{pillar};

data/lib/gitlab_quality/test_tooling/code_coverage/click_house/test_health_score_snapshotter.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+require_relative 'client'
+require_relative 'table'
+
+module GitlabQuality
+  module TestTooling
+    module CodeCoverage
+      module ClickHouse
+        # Freezes the day's per-pillar Test Health Index scores into
+        # `code_coverage.test_health_score_history`. Reads the per-pillar score
+        # views (the same views the dashboard reads, so the snapshot cannot
+        # diverge from the live score) and tags each row with the snapshot date
+        # and the pillar.
+        #
+        # Runs right after TestHealthRiskAggregator in the daily job: the views
+        # read `test_health_risk_per_group`, which the aggregator has just
+        # refreshed, so the freeze captures the current day. The producer never
+        # holds the score formula; it copies whatever the views compute.
+        class TestHealthScoreSnapshotter
+          include Client
+
+          SQL_FILE = File.expand_path('test_health_score_snapshot.sql', __dir__)
+
+          # One INSERT per pillar. The token names the view
+          # (test_health_scores_<pillar>) and tags the row's `pillar` column.
+          # Flaky is excluded until it is scored live.
+          PILLARS = %w[quarantine slow].freeze
+
+          DATE_PATTERN = /\A\d{4}-\d{2}-\d{2}\z/
+
+          def initialize(url:, database:, username: nil, password: nil, logger: nil)
+            @url = url
+            @database = database
+            @username = username
+            @password = password
+            @logger = logger || ::Logger.new($stdout, level: ::Logger::INFO)
+          end
+
+          # @param snapshot_date [Date, String] date stamp for this run; defaults to today.
+          # @return [void]
+          def run(snapshot_date: Date.today)
+            PILLARS.each do |pillar|
+              logger.info("#{LOG_PREFIX} Snapshotting #{pillar} scores snapshot_date=#{snapshot_date}")
+              client.query(build_sql(snapshot_date: snapshot_date, pillar: pillar), format: "TabSeparated")
+            end
+            inserted = fetch_row_count(snapshot_date)
+            logger.info("#{LOG_PREFIX} Score snapshot wrote #{inserted} rows for snapshot_date=#{snapshot_date}")
+          rescue StandardError => e
+            logger.error("#{LOG_PREFIX} Score snapshot failed for #{snapshot_date}: #{e.message}")
+            raise
+          end
+
+          private
+
+          attr_reader :url, :database, :username, :password, :logger
+
+          def build_sql(snapshot_date:, pillar:)
+            File.read(SQL_FILE)
+              .gsub('{snapshot_date}', validate_date(snapshot_date))
+              .gsub('{pillar}', validate_pillar(pillar))
+          end
+
+          # DateTime/Time `to_s` includes the time portion and is rejected.
+          def validate_date(value)
+            str = value.to_s
+            raise ArgumentError, "Invalid snapshot_date: #{value.inspect}" unless DATE_PATTERN.match?(str)
+
+            str
+          end
+
+          # The pillar names the view and is interpolated into the SQL, so
+          # restrict it to the known set rather than a looser pattern.
+          def validate_pillar(value)
+            raise ArgumentError, "Invalid pillar: #{value.inspect}" unless PILLARS.include?(value)
+
+            value
+          end
+
+          # Returns 'unknown' on any error so a transient count-query failure
+          # can't mask the success of the actual INSERTs.
+          def fetch_row_count(snapshot_date)
+            count_sql = "SELECT count() FROM code_coverage.test_health_score_history FINAL " \
+              "WHERE snapshot_date = toDate('#{validate_date(snapshot_date)}')"
+            result = client.query(count_sql, format: "JSONCompact")
+            result&.dig('data', 0, 0) || 'unknown'
+          rescue StandardError => e
+            logger.debug("#{LOG_PREFIX} Could not fetch post-snapshot row count: #{e.message}")
+            'unknown'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/gitlab_quality/test_tooling/code_coverage/per_test_coverage_data.rb

@@ -50,6 +50,12 @@ module GitlabQuality
         # catching unrelated standard exceptions.
         ParseError = Class.new(StandardError)
 
+        # Source files we never want in coverage risk. Vendored gems (bundled
+        # into vendor/ruby in CI) are touched by nearly every test, which both
+        # inflates the export volume and pollutes the coverage-risk metrics with
+        # third-party code we don't own. Dropped before aggregation.
+        EXCLUDED_SOURCE_PREFIXES = %w[vendor/].freeze
+
         # @param coverage_files [Array<String>] paths to per-test coverage JSON artifacts
         # @param tests_to_categories [Hash<String, Array<String>>] test_file => [feature_category]
         # @param feature_categories_to_teams [Hash<String, Hash>] category => {group:, stage:, section:}
@@ -73,6 +79,8 @@ module GitlabQuality
             each_example(path) do |example_id, files|
               test_file = extract_test_file_path(example_id)
               files.each do |source_file, line_hits|
+                next if excluded_source_file?(source_file)
+
                 covered, total = parse_line_hits(line_hits)
                 next if covered.empty?
 
@@ -168,6 +176,14 @@ module GitlabQuality
           end
           [covered, total]
         end
+
+        # True for source files excluded from coverage entirely (e.g. vendored
+        # gems). Strips a leading ./ so both "vendor/..." and "./vendor/..."
+        # match.
+        def excluded_source_file?(source_file)
+          normalized = source_file.to_s.delete_prefix('./')
+          EXCLUDED_SOURCE_PREFIXES.any? { |prefix| normalized.start_with?(prefix) }
+        end
       end
     end
   end