ci(all-green): merge/upload lcov only, drop per-run Codecov cache

istanbul JSON merging was the actual bottleneck on reruns (far slower
than lcov's merge on runs with many cells), for coverage detail
(branch/function) only Codecov read. Dropping JSON support outright
removes that cost instead of caching around it, at the cost of losing
that detail in Codecov.

With the merge now cheap, the per-run Codecov-upload cache (a
persisted run-id list plus an actions/cache step) no longer earns its
complexity — every rerun just redoes download, merge, and upload for
every run again.

Generated by Claude Code.

Author: rochdev

.github/actions/upload-coverage-artifact/action.yml

@@ -13,15 +13,14 @@ inputs:
 runs:
   using: composite
   steps:
-    # The reports live at `<report-dir>/node-<version>-<label>/{lcov.info,coverage-final.json}`, one
-    # level below `report-dir`, so the presence check has to recurse — a top-level-only probe finds
-    # nothing and silently skips the upload, which is what starved the Datadog coverage upload. Both
-    # formats ship: Datadog reads the lcov, Codecov reads the istanbul JSON (see
-    # `scripts/upload-coverage.mjs`).
+    # The reports live at `<report-dir>/node-<version>-<label>/lcov.info`, one level below
+    # `report-dir`, so the presence check has to recurse — a top-level-only probe finds nothing and
+    # silently skips the upload, which is what starved the Datadog coverage upload. Only lcov ships:
+    # both Datadog and Codecov ingest it (see `scripts/upload-coverage.mjs`).
     - id: check
       shell: bash
       run: |
-        count=$(find "${{ inputs.report-dir }}" \( -name lcov.info -o -name coverage-final.json \) -type f 2>/dev/null | wc -l | tr -d ' ')
+        count=$(find "${{ inputs.report-dir }}" -name lcov.info -type f 2>/dev/null | wc -l | tr -d ' ')
         echo "has_coverage=$([ "$count" -gt 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
     # The artifact name carries the grouping flag plus a per-cell suffix (`__<job>-<matrix-index>`)
     # so matrix cells that share a flag — cypress varies `spec` outside its flag — upload distinct
@@ -32,9 +31,7 @@ runs:
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: coverage-${{ inputs.flags }}__${{ github.job }}-${{ strategy.job-index }}
-        path: |
-          ${{ inputs.report-dir }}/**/lcov.info
-          ${{ inputs.report-dir }}/**/coverage-final.json
+        path: ${{ inputs.report-dir }}/**/lcov.info
         retention-days: 1
     - if: github.actor != 'dependabot[bot]' && steps.check.outputs.has_coverage == 'true' && steps.upload.outcome == 'failure'
       shell: bash
@@ -43,8 +40,6 @@ runs:
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: coverage-${{ inputs.flags }}__${{ github.job }}-${{ strategy.job-index }}
-        path: |
-          ${{ inputs.report-dir }}/**/lcov.info
-          ${{ inputs.report-dir }}/**/coverage-final.json
+        path: ${{ inputs.report-dir }}/**/lcov.info
         retention-days: 1
         overwrite: true

.github/workflows/all-green.yml

@@ -31,29 +31,17 @@ jobs:
       - uses: ./.github/actions/node
         with:
           version: active
-      - run: yarn add @actions/core @actions/github octokit istanbul-lib-coverage
+      - run: yarn add @actions/core @actions/github octokit
       - uses: ./.github/actions/dd-sts-api-key
         id: dd-sts
       - uses: ./.github/actions/datadog-ci
       - run: pip install --quiet codecov-cli
-      # Lets a rerun of this job for the same commit (e.g. retrying a flaky sibling workflow) skip
-      # redownloading artifacts and resubmitting uploads for sibling workflow runs a previous
-      # attempt already finished — see PROCESSED_RUNS_CACHE_PATH in all-green.mjs. The key includes
-      # the attempt number so every attempt's save is a new entry (an exact-key hit skips saving,
-      # which would drop this attempt's newly-processed runs); restore-keys falls back to the most
-      # recent previous attempt's cache.
-      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: .all-green-processed-runs.json
-          key: all-green-processed-runs-${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
-          restore-keys: |
-            all-green-processed-runs-${{ github.event.pull_request.head.sha || github.sha }}-
       # Polls sibling workflows and, as soon as each one reaches a final state, downloads its
       # artifacts, merges its reports, and uploads its junit/coverage to Datadog and Codecov —
       # instead of waiting for every workflow to finish before downloading or uploading anything.
-      # Datadog gets the merged lcov, Codecov gets the merged istanbul JSON (it reads branch/function
-      # coverage from that format, and its own cross-session merge for a shared file has been
-      # observed overwriting rather than summing when more than one session reports it).
+      # Both Datadog and Codecov get the same merged lcov — Codecov's own cross-session merge for a
+      # shared file has been observed overwriting rather than summing when more than one session
+      # reports it, so it's merged into one report per run before upload instead.
       # `master-coverage` is the flag `.codecov.yml` gates `codecov/patch` on; attached only on PRs
       # targeting master so release-branch PRs auto-pass. The SHA/PR are passed explicitly because
       # All Green checks out the merge ref, not the head the other workflows reported coverage for.

scripts/all-green.mjs

@@ -3,7 +3,6 @@ import { Octokit } from 'octokit'
 import { summary } from '@actions/core'
 import { context } from '@actions/github'
 import { downloadArtifacts } from './download-artifacts.mjs'
-import { loadProcessedRunIds, saveProcessedRunIds } from './processed-runs.mjs'
 import { logUploads } from './run-upload.mjs'
 import { uploadAllJunit } from './upload-junit.mjs'
 import {
@@ -12,15 +11,6 @@ import {
 
 /* eslint-disable no-console */
 
-// Persisted across All Green job attempts for the same commit (see all-green.yml's cache step).
-// Only the Codecov upload is worth caching — it's the slow part (a `codecovcli` child process per
-// run) and is confirmable per-run, immediately. The Datadog junit/coverage batch uploads are cheap
-// and can only be confirmed as one call covering every currently-downloaded run, so they're always
-// redone in full every attempt; caching them would risk silently dropping a run's data if the batch
-// call failed after that run had been skipped from download.
-const PROCESSED_RUNS_CACHE_PATH = '.all-green-processed-runs.json'
-const cachedRunIds = loadProcessedRunIds(PROCESSED_RUNS_CACHE_PATH)
-
 const {
   BASE_REF,
   DELAY,
@@ -114,41 +104,30 @@ async function getRuns () {
   }
 }
 
-// Runs already dispatched to `processRun` this attempt, so a run settling across more than one
+// Runs already dispatched to `processRun`, so a run settling across more than one
 // `scheduleProcessing` call (e.g. after a retry) isn't downloaded/uploaded twice.
 const dispatchedRunIds = new Set()
 const processingPromises = []
-// Runs whose Codecov upload has succeeded, either in a previous job attempt (seeded from
-// `cachedRunIds`) or this one. Persisted to disk the moment a new run succeeds — see `processRun`
-// — so a mid-run cancellation or crash still leaves that progress on disk for the next attempt,
-// instead of only ever saving once at the very end.
-const codecovDoneRunIds = new Set(cachedRunIds)
 
 /**
  * Download a single finished workflow run's junit and coverage artifacts, merge them, and upload
- * the coverage merge to Codecov unless a previous job attempt already did.
+ * the coverage merge to Codecov.
  *
  * @param {{ id: number, name: string }} run
  * @returns {Promise<void>}
  */
 async function processRun (run) {
   const { downloaded, failed } = await downloadArtifacts(octokit, { owner, repo, token: GITHUB_TOKEN, runs: [run] })
 
-  const alreadyOnCodecov = cachedRunIds.has(run.id)
   const coverageResults = await uploadCoverage(run, {
     sha: HEAD_SHA,
     branch: HEAD_BRANCH,
     prNumber: PR_NUMBER,
     eventName: GITHUB_EVENT_NAME,
     baseRef: BASE_REF,
-  }, alreadyOnCodecov)
+  })
   const downloadSummary = failed > 0 ? `${downloaded} artifact(s), ${failed} failed` : `${downloaded} artifact(s)`
   logUploads(`${run.name} (${downloadSummary})`, coverageResults)
-
-  if (!alreadyOnCodecov && failed === 0 && coverageResults.every(result => result.code === 0)) {
-    codecovDoneRunIds.add(run.id)
-    saveProcessedRunIds(PROCESSED_RUNS_CACHE_PATH, codecovDoneRunIds)
-  }
 }
 
 /**

scripts/group-coverage.mjs

@@ -1,28 +1,26 @@
 import { mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
 
-import istanbulLibCoverage from 'istanbul-lib-coverage'
-
-// Merges one workflow run's downloaded per-cell `coverage-*` artifacts into a single lcov file and a
-// single istanbul JSON file under `coverage-upload/<run-id>/`, scoped to that run alone. All Green
-// calls this as soon as a sibling workflow finishes, instead of waiting for every workflow to
-// complete before merging and uploading anything — the goal is for each workflow's coverage to reach
-// Datadog and Codecov shortly after that workflow finishes, in parallel with the rest still running.
+// Merges one workflow run's downloaded per-cell `coverage-*` artifacts into a single lcov file under
+// `coverage-upload/<run-id>/`, scoped to that run alone. All Green calls this as soon as a sibling
+// workflow finishes, instead of waiting for every workflow to complete before merging and uploading
+// anything — the goal is for each workflow's coverage to reach Datadog and Codecov shortly after that
+// workflow finishes, in parallel with the rest still running.
 //
-// Codecov reads branch/function coverage from istanbul's JSON; Datadog only ingests the lcov — see
-// `upload-coverage.mjs`. Both formats need a real per-file merge, not concatenation: every matrix
-// cell in a workflow run (each Node.js version, each plugin partition) writes its own complete
-// report, so a shared source file's coverage shows up once per cell. Concatenating lcov's `SF:`
-// blocks produces a report with duplicate `SF:` sections per file, which downstream lcov consumers
-// resolve by keeping only the last block for that file rather than summing across blocks — silently
-// discarding most of the branch/function data every earlier cell had recorded. A naive object merge
-// of istanbul's JSON has the same failure mode. Uploading either format unmerged across sessions has
-// the same problem one level up: Codecov's own cross-session merge has been observed overwriting
-// rather than summing a shared file's coverage when more than one session reports it, so every
-// format is merged down to one report per run before upload instead of relying on the backend to
-// reconcile per-session duplicates. `mergeLcov` sums `DA:`/`FNDA:`/`BRDA:` hit counts per file across
-// cells (the way `lcov --add-tracefile` does), and `mergeCoverageJson` uses
-// `istanbul-lib-coverage`'s `merge` to do the same for the JSON report.
+// Both Datadog and Codecov ingest lcov only — istanbul JSON support (which Codecov used to read
+// branch/function coverage from) was dropped: it doubled the merge cost on runs with many cells
+// (`istanbul-lib-coverage`'s merge is far slower than `mergeLcov`) for coverage the lcov format
+// doesn't carry (branch/function hit counts) — an acceptable trade-off. Merging is still required,
+// not concatenation: every matrix cell in a workflow run (each Node.js version, each plugin
+// partition) writes its own complete report, so a shared source file's coverage shows up once per
+// cell. Concatenating lcov's `SF:` blocks produces a report with duplicate `SF:` sections per file,
+// which downstream lcov consumers resolve by keeping only the last block for that file rather than
+// summing across blocks — silently discarding most of the coverage every earlier cell had recorded.
+// Uploading unmerged across sessions has the same problem one level up: Codecov's own cross-session
+// merge has been observed overwriting rather than summing a shared file's coverage when more than one
+// session reports it, so lcov is merged down to one report per run before upload instead of relying
+// on the backend to reconcile per-session duplicates. `mergeLcov` sums `DA:`/`FNDA:`/`BRDA:` hit
+// counts per file across cells, the way `lcov --add-tracefile` does.
 //
 // Per-integration/per-area flags were dropped: `.codecov.yml` only gates the separate
 // `master-coverage` flag (attached to every upload regardless of grouping), so a finer-grained flag
@@ -35,7 +33,6 @@ const ARTIFACT_PREFIX = 'coverage-'
 
 const REPORTS = new Map([
   ['lcov.info', 'lcov'],
-  ['coverage-final.json', 'json'],
 ])
 
 /**
@@ -231,44 +228,21 @@ function mergeLcov (reportPaths) {
 }
 
 /**
- * Sum per-statement/branch/function hit counts across every cell's istanbul JSON report, so a
- * source file exercised by more than one cell keeps every cell's coverage instead of only the last
- * report merged for that file.
- *
- * @param {string[]} reportPaths
- * @returns {object}
- */
-function mergeCoverageJson (reportPaths) {
-  const map = istanbulLibCoverage.createCoverageMap({})
-  for (const reportPath of reportPaths) {
-    map.merge(JSON.parse(readFileSync(reportPath, 'utf8')))
-  }
-  return map.toJSON()
-}
-
-/**
- * Merge a single workflow run's downloaded coverage reports into one lcov file and one istanbul
- * JSON file for upload.
+ * Merge a single workflow run's downloaded coverage reports into one lcov file for upload.
  *
  * @param {string|number} runId
  * @param {string} [inputDir]
  * @param {string} [outputDir]
- * @param {boolean} [skipJson] Skip merging the istanbul JSON reports — only Codecov reads them
- *   (see `upload-coverage.mjs`), and `istanbul-lib-coverage`'s merge is far slower than `mergeLcov`
- *   on a run with many cells, so a run whose Codecov upload already succeeded in a previous job
- *   attempt can skip this merge entirely instead of paying for it only to discard the result.
- * @returns {{ lcovDir: string|null, jsonDir: string|null }} Directories containing the merged
- *   `lcov.info` and `coverage-final.json`, each null if the run produced no report in that format
- *   (or, for `jsonDir`, if `skipJson` was set).
+ * @returns {{ lcovDir: string|null }} Directory containing the merged `lcov.info`, null if the run
+ *   produced no coverage report.
  */
-function mergeRunCoverage (runId, inputDir = INPUT_DIR, outputDir = OUTPUT_DIR, skipJson = false) {
+function mergeRunCoverage (runId, inputDir = INPUT_DIR, outputDir = OUTPUT_DIR) {
   const files = collectCoverageFiles(join(inputDir, String(runId)), [], { runId: String(runId) })
-  if (files.length === 0) return { lcovDir: null, jsonDir: null }
+  if (files.length === 0) return { lcovDir: null }
 
   const { reportsByArtifact, artifacts } = planCoverageGroups(files)
   const reports = artifacts.flatMap(artifact => reportsByArtifact.get(artifact))
   const lcovReportPaths = reports.filter(r => r.format === 'lcov').map(r => r.reportPath)
-  const jsonReportPaths = skipJson ? [] : reports.filter(r => r.format === 'json').map(r => r.reportPath)
 
   let lcovDir = null
   if (lcovReportPaths.length > 0) {
@@ -277,14 +251,7 @@ function mergeRunCoverage (runId, inputDir = INPUT_DIR, outputDir = OUTPUT_DIR,
     writeFileSync(join(lcovDir, 'lcov.info'), mergeLcov(lcovReportPaths))
   }
 
-  let jsonDir = null
-  if (jsonReportPaths.length > 0) {
-    jsonDir = join(outputDir, String(runId), 'json')
-    mkdirSync(jsonDir, { recursive: true })
-    writeFileSync(join(jsonDir, 'coverage-final.json'), JSON.stringify(mergeCoverageJson(jsonReportPaths)))
-  }
-
-  return { lcovDir, jsonDir }
+  return { lcovDir }
 }
 
-export { OUTPUT_DIR, mergeCoverageJson, mergeLcov, mergeRunCoverage, planCoverageGroups }
+export { OUTPUT_DIR, mergeLcov, mergeRunCoverage, planCoverageGroups }

scripts/group-coverage.spec.mjs

@@ -5,7 +5,7 @@ import { join } from 'node:path'
 
 import { afterEach, beforeEach, describe, it } from 'mocha'
 
-import { mergeCoverageJson, mergeLcov, mergeRunCoverage, planCoverageGroups } from './group-coverage.mjs'
+import { mergeLcov, mergeRunCoverage, planCoverageGroups } from './group-coverage.mjs'
 
 /**
  * One cell's discovered report set: one `lcov` entry per Node.js version the cell ran.
@@ -138,32 +138,6 @@ describe('group-coverage', () => {
     })
   })
 
-  describe('mergeCoverageJson', () => {
-    let dir
-
-    beforeEach(() => {
-      dir = mkdtempSync(join(tmpdir(), 'group-coverage-json-'))
-    })
-
-    afterEach(() => {
-      rmSync(dir, { force: true, recursive: true })
-    })
-
-    it('sums statement hit counts for the same file across reports', () => {
-      const a = join(dir, 'a.json')
-      const b = join(dir, 'b.json')
-      const statementMap = { 0: { start: { line: 1, column: 0 }, end: { line: 1, column: 10 } } }
-      writeFileSync(a, JSON.stringify({
-        'shared.js': { path: 'shared.js', statementMap, fnMap: {}, branchMap: {}, s: { 0: 1 }, f: {}, b: {} },
-      }))
-      writeFileSync(b, JSON.stringify({
-        'shared.js': { path: 'shared.js', statementMap, fnMap: {}, branchMap: {}, s: { 0: 2 }, f: {}, b: {} },
-      }))
-      const merged = mergeCoverageJson([a, b])
-      assert.equal(merged['shared.js'].s[0], 3)
-    })
-  })
-
   describe('mergeRunCoverage', () => {
     let dir
 
@@ -182,57 +156,24 @@ describe('group-coverage', () => {
       mkdirSync(cellDir, { recursive: true })
       writeFileSync(join(cellDir, 'lcov.info'), 'SF:a.js\nDA:1,1\nend_of_record\n')
 
-      const { lcovDir, jsonDir } = mergeRunCoverage('42', input, output)
+      const { lcovDir } = mergeRunCoverage('42', input, output)
 
       assert.equal(lcovDir, join(output, '42', 'lcov'))
-      assert.equal(jsonDir, null)
       assert.equal(
         readFileSync(join(lcovDir, 'lcov.info'), 'utf8'),
         'SF:a.js\nDA:1,1\nLF:1\nLH:1\nend_of_record\n'
       )
     })
 
-    it('merges the given run\'s json cells into <output>/<runId>/json/coverage-final.json', () => {
-      const input = join(dir, 'coverage-results')
-      const output = join(dir, 'coverage-upload')
-      const cellDir = join(input, '42', 'coverage-apm-integrations-axios__a-0', 'node-20-x')
-      mkdirSync(cellDir, { recursive: true })
-      const statementMap = { 0: { start: { line: 1, column: 0 }, end: { line: 1, column: 10 } } }
-      writeFileSync(join(cellDir, 'coverage-final.json'), JSON.stringify({
-        'a.js': { path: 'a.js', statementMap, fnMap: {}, branchMap: {}, s: { 0: 1 }, f: {}, b: {} },
-      }))
-
-      const { lcovDir, jsonDir } = mergeRunCoverage('42', input, output)
-
-      assert.equal(lcovDir, null)
-      assert.equal(jsonDir, join(output, '42', 'json'))
-      assert.equal(JSON.parse(readFileSync(join(jsonDir, 'coverage-final.json'), 'utf8'))['a.js'].s[0], 1)
-    })
-
-    it('returns null for both directories when the run produced no coverage', () => {
+    it('returns null when the run produced no coverage', () => {
       const input = join(dir, 'coverage-results')
       mkdirSync(input, { recursive: true })
       assert.deepEqual(
         mergeRunCoverage('42', input, join(dir, 'coverage-upload')),
-        { lcovDir: null, jsonDir: null }
+        { lcovDir: null }
       )
     })
 
-    it('skips the json merge when skipJson is set, but still merges lcov', () => {
-      const input = join(dir, 'coverage-results')
-      const output = join(dir, 'coverage-upload')
-      const cellDir = join(input, '42', 'coverage-apm-integrations-axios__a-0', 'node-20-x')
-      mkdirSync(cellDir, { recursive: true })
-      writeFileSync(join(cellDir, 'lcov.info'), 'SF:a.js\nDA:1,1\nend_of_record\n')
-      writeFileSync(join(cellDir, 'coverage-final.json'), JSON.stringify({}))
-
-      const { lcovDir, jsonDir } = mergeRunCoverage('42', input, output, true)
-
-      assert.equal(lcovDir, join(output, '42', 'lcov'))
-      assert.equal(jsonDir, null)
-      assert.equal(existsSync(join(output, '42', 'json')), false)
-    })
-
     it('ignores other runs\' cells', () => {
       const input = join(dir, 'coverage-results')
       const otherCellDir = join(input, '7', 'coverage-appsec-express__job-0', 'node-20-x')
@@ -241,7 +182,7 @@ describe('group-coverage', () => {
 
       assert.deepEqual(
         mergeRunCoverage('42', input, join(dir, 'coverage-upload')),
-        { lcovDir: null, jsonDir: null }
+        { lcovDir: null }
       )
       assert.equal(existsSync(join(dir, 'coverage-upload', '42')), false)
     })