Harden tiered coverage gate and release workflow

Signed-off-by: Nathan Gillett <nathan@intentproof.io>

Author: Nathan Gillett

.github/workflows/release-pypi.yml

@@ -42,9 +42,6 @@ jobs:
       - name: Install dependencies
         run: pip install -e ".[dev]"
 
-      - name: Run tests with coverage
-        run: pytest -q
-
       - name: Enforce coverage threshold
         run: bash ./scripts/run-coverage-gate.sh
 

scripts/check-coverage.sh

@@ -23,8 +23,8 @@ if [[ -z "${TOTAL_MIN:-}" ]]; then
   exit 2
 fi
 
-if [[ ! -f "$COVERAGE_JSON" ]]; then
-  echo "coverage json not found: $COVERAGE_JSON (run pytest with --cov first)" >&2
+if [[ ! -f "${ROOT}/${COVERAGE_JSON}" ]]; then
+  echo "coverage json not found: ${ROOT}/${COVERAGE_JSON} (run pytest with --cov first)" >&2
   exit 2
 fi
 
@@ -64,9 +64,12 @@ for file_path, entry in data.get("files", {}).items():
     stmts = int(summary.get("num_statements", 0))
     if stmts == 0:
         continue
-    pct = float(summary.get("percent_covered", 0))
     total += stmts
-    covered += int(round(stmts * pct / 100.0))
+    file_covered = summary.get("covered_lines")
+    if file_covered is None:
+        missing = entry.get("missing_lines") or summary.get("missing_lines") or []
+        file_covered = stmts - len(missing)
+    covered += int(file_covered)
 print(covered, total)
 PY
 }
@@ -92,7 +95,8 @@ while IFS= read -r rule; do
 $(stats_for_prefix "$prefix")
 EOF
   if [[ "$t" -eq 0 ]]; then
-    echo "  ${prefix} (min ${min}%): no statements in profile, skipped"
+    echo "  ${prefix} (min ${min}%): no statements in profile, FAIL" >&2
+    fail=1
     continue
   fi
   report_threshold "  ${prefix}" "$c" "$t" "$min" || fail=1

scripts/check-coverage_critical_prefix_test.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Regression test: critical tiers must fail when a prefix matches nothing.
+set -euo pipefail
+
+root="$(mktemp -d)"
+trap 'rm -rf "$root"' EXIT
+
+mkdir -p "$root/scripts"
+cp "$(dirname "$0")/check-coverage.sh" "$root/scripts/"
+
+cat >"$root/scripts/coverage-tiers.conf" <<'EOF'
+TOTAL_MIN=50
+CRITICAL_RULES=(
+  "95:src/intentproof/missing/"
+)
+EOF
+
+cat >"$root/coverage.json" <<'EOF'
+{
+  "files": {
+    "src/intentproof/canon.py": {
+      "summary": {
+        "covered_lines": 2,
+        "num_statements": 2,
+        "percent_covered": 66.66666666666666
+      }
+    }
+  }
+}
+EOF
+
+if bash "$root/scripts/check-coverage.sh" "$root/coverage.json" >/dev/null 2>&1; then
+  echo "FAIL: expected gate to fail for missing critical prefix" >&2
+  exit 1
+fi
+
+echo "PASS: missing critical prefix fails the gate"