coverage.yml

name: Coverage
on: [ pull_request, push ]
permissions:
  contents: read
jobs:
  coverage:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
        with:
          egress-policy: audit
          allowed-endpoints: >
            api.github.com:443
            cli.codecov.io:443
            codecov.io:443
            crates.io:443
            github.com:443
            index.crates.io:443
            kv4gacprodeus2file3.blob.core.windows.net:443
            objects.githubusercontent.com:443
            static.crates.io:443
            static.rust-lang.org:443
            storage.googleapis.com:443
            uploader.codecov.io:443

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@6e2226b90b9a51735a2363fdd379c7545cfd8748 # cargo-llvm-cov
      - name: Install dependencies
        run: sudo apt-get install -y libmagic-dev
      - name: Generate code coverage
        run: cargo llvm-cov --features=sqlite --workspace --lcov --output-path lcov.info
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303 # v5.1.2
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: lcov.info
          fail_ci_if_error: false