@scalequality/check 0.3.1 → 0.4.0

package/README.md

@@ -45,3 +45,32 @@ scalequality:
 
 Any other CI: run the same `npx @scalequality/check` command, with `SQ_TOKEN`
 exposed as a secret/variable.
+
+## Measured coverage
+
+Coverage is only real once the tests have run. If this job produces a coverage
+report, the check finds it and ScaleQuality shows **measured line coverage**
+instead of a directional estimate. Nothing to configure: run your tests with
+coverage before this step.
+
+```yaml
+- run: mvn verify                     # writes target/site/jacoco/jacoco.xml
+- run: npx @scalequality/check --token "$SQ_TOKEN" --project <projectId>
+```
+
+Recognised out of the box: JaCoCo (`jacoco.xml`), LCOV (`lcov.info`), Cobertura
+(`coverage.xml`, `coverage.cobertura.xml`), Istanbul (`coverage-summary.json`),
+Clover (`clover.xml`) and Go (`coverage.out`). Multi-module builds are summed.
+
+The reports are copied into a temporary `.sqreports/` folder so they survive the
+archive's build-output exclusions, and that folder is removed before the command
+exits — including when the job is cancelled.
+
+Report somewhere unusual? Point at it in `scalequality.properties` at the repo
+root:
+
+```properties
+sq.coverage.reportPaths=ops/reports/jacoco-aggregate.xml
+```
+
+Full guide: https://scalequality.io/docs/continuous-measurement

package/bin/check.mjs

@@ -5,9 +5,9 @@
 // build. Pure Node 18+ (global fetch/FormData/Blob), no npm dependencies.
 
 import { tmpdir } from "node:os"
-import { join } from "node:path"
+import { join, dirname, relative, sep } from "node:path"
 import { spawnSync } from "node:child_process"
-import { readFileSync, existsSync, statSync, rmSync } from "node:fs"
+import { readFileSync, writeFileSync, existsSync, statSync, rmSync, readdirSync, mkdirSync, copyFileSync } from "node:fs"
 
 const args = process.argv.slice(2)
 const flag = (name) => {
@@ -123,8 +123,92 @@ function slimReport(stdout, ref) {
   return json
 }
 
+// Coverage reports live in exactly the directories the archive excludes: JaCoCo
+// writes to target/ and build/, Istanbul to coverage/. So the one moment where a
+// REAL coverage number is sitting on disk — right after this job ran the tests —
+// was also the one moment we threw it away, and every Maven project came back
+// with no measured coverage even with a green suite behind it.
+//
+// The reports are copied into .sqreports/ under FLAT, indexed names, with an
+// index.json holding each one's original path. Mirroring the original directory
+// tree looked tidier and did not work: bsdtar does not anchor `--exclude=./target`
+// to the root, so a staged copy at `.scalequality/coverage/target/...` was dropped
+// on macOS while surviving under GNU tar. Measured, not assumed — and a layout
+// whose behaviour depends on which tar the runner ships is not a layout.
+// Every staged name here is `<n>-<basename>`, which no exclude pattern can match.
+const COVERAGE_NAMES = [
+  { re: /^jacoco(TestReport)?\.xml$/i, format: "jacoco" },
+  { re: /^lcov\.info$/i, format: "lcov" },
+  { re: /^coverage-summary\.json$/i, format: "istanbul" },
+  { re: /^coverage\.cobertura\.xml$/i, format: "cobertura" },
+  { re: /^cobertura(-coverage)?\.xml$/i, format: "cobertura" },
+  { re: /^coverage\.xml$/i, format: "cobertura" },
+  { re: /^clover\.xml$/i, format: "clover" },
+  { re: /^(coverage|cover)\.out$/i, format: "go" },
+]
+const COVERAGE_SKIP = new Set(["node_modules", ".git", ".venv", "venv", "vendor", "__pycache__", ".sqreports"])
+const COVERAGE_STAGE = ".sqreports"
+const MAX_REPORT_BYTES = 25 * 1024 * 1024
+const MAX_REPORTS = 40
+
+function stageCoverageReports() {
+  const root = process.cwd()
+  const stage = join(root, COVERAGE_STAGE)
+  rmSync(stage, { recursive: true, force: true })
+  // The staged copies must not outlive this process under ANY exit path. A
+  // cancelled job or a network failure that left them behind would show up as
+  // untracked files in the customer's checkout, and a pipeline that runs
+  // `git diff --exit-code` after the gate would fail because of us.
+  const clean = () => { try { rmSync(stage, { recursive: true, force: true }) } catch { /* best effort */ } }
+  process.on("exit", clean)
+  for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+    process.on(sig, () => { clean(); process.exit(130) })
+  }
+
+  const index = []
+  let bytes = 0
+  const walk = (dir, depth) => {
+    if (depth > 7 || index.length >= MAX_REPORTS || bytes >= MAX_REPORT_BYTES) return
+    let entries
+    try { entries = readdirSync(dir, { withFileTypes: true }) } catch { return }
+    for (const e of entries) {
+      if (index.length >= MAX_REPORTS || bytes >= MAX_REPORT_BYTES) return
+      const abs = join(dir, e.name)
+      if (e.isDirectory()) {
+        if (!COVERAGE_SKIP.has(e.name)) walk(abs, depth + 1)
+        continue
+      }
+      const hit = COVERAGE_NAMES.find((c) => c.re.test(e.name))
+      if (!hit) continue
+      let size = 0
+      try { size = statSync(abs).size } catch { continue }
+      if (size === 0 || bytes + size > MAX_REPORT_BYTES) continue
+      const staged = `${index.length}-${e.name}`
+      try {
+        mkdirSync(stage, { recursive: true })
+        copyFileSync(abs, join(stage, staged))
+      } catch { continue }
+      bytes += size
+      index.push({ file: staged, path: relative(root, abs).split(sep).join("/"), format: hit.format })
+    }
+  }
+  walk(root, 0)
+
+  if (index.length) {
+    try {
+      writeFileSync(join(stage, "index.json"), JSON.stringify({ version: 1, reports: index }))
+    } catch { /* the archive just goes without them */ }
+    const shown = index.slice(0, 3).map((r) => r.path).join(", ")
+    log(`ScaleQuality: found ${index.length} coverage report(s) — ${shown}${index.length > 3 ? " …" : ""}`)
+  } else {
+    log("ScaleQuality: no coverage report found in this job. Run your tests with coverage before this step to get a measured %.")
+  }
+  return { stage, count: index.length }
+}
+
 async function main() {
   const auth = { Authorization: `Bearer ${token}` }
+  const coverage = stageCoverageReports()
 
   // Upload THIS checkout (the runner already has the code) instead of asking the server
   // to clone the repo from outside — that needed a stored provider credential and failed
@@ -142,10 +226,14 @@ async function main() {
     "-C", process.cwd(), ".",
   ], { encoding: "utf8" })
   if (!(existsSync(archivePath) && statSync(archivePath).size > 0)) {
+    rmSync(coverage.stage, { recursive: true, force: true })
     fail(`could not archive the checkout (tar unavailable or failed). ${tr.error?.message || (tr.stderr || "").trim()}`)
   }
   const buf = readFileSync(archivePath)
   rmSync(archivePath, { force: true })
+  // The staged copies exist only to ride along in the archive. Leaving them
+  // behind would dirty the working tree of the job that ran us.
+  rmSync(coverage.stage, { recursive: true, force: true })
   const sizeMB = buf.length / (1024 * 1024)
   if (sizeMB > 60) fail(`checkout archive too large (${sizeMB.toFixed(0)}MB > 60MB limit). Reduce clone depth or exclude build output.`)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalequality/check",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "ScaleQuality continuous code-maturity check for CI. Re-measures your repo on every build and fails the pipeline below your maturity line.",
   "type": "module",
   "bin": {