ci(coverage): single combined Codecov upload, exclude legacy/entrypoints from the number

Consolidate coverage uploads into one combined report with after_n_builds
synchronisation; exclude legacy/entrypoint modules from the coverage metric.

Author: fgogolli

.github/workflows/ci-tests.yml

@@ -319,8 +319,26 @@ jobs:
         ls -la .coverage* 2>/dev/null || echo "no .coverage data files found"
 
     - name: Combine coverage and enforce combined threshold
+      id: coverage-gate
       run: make ci-tests-coverage-check
 
+    # Single deterministic Codecov upload: the combined report from ALL legs is
+    # sent once here, instead of each leg uploading separately.  Codecov then
+    # shows one stable number (no mid-run partial-merge flapping) and this needs
+    # no hardcoded leg count — it auto-scales to any number of provider legs.
+    # if: always() so the report uploads even when the threshold gate fails
+    # above (the job still fails on the gate; Codecov still gets the data).
+    - name: Upload combined coverage to Codecov
+      if: always()
+      continue-on-error: true
+      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v6
+      with:
+        token: ${{ secrets.CODECOV_TOKEN }}
+        files: coverage-combined.xml
+        name: combined
+        # Overwrite any prior partial report for this commit with the full merge.
+        override_commit: ${{ github.event.pull_request.head.sha || github.sha }}
+
   # Single stable required status check for branch protection.  Replaces listing
   # every individual job name (which drifts silently when jobs are renamed).
   # Register "CI Passed" as the sole required check in branch protection.

.github/workflows/reusable-test.yml

@@ -185,15 +185,12 @@ jobs:
             coverage-*.xml
             .coverage*
 
-      - name: Upload coverage to Codecov
-        if: inputs.upload-coverage && always()
-        continue-on-error: true
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v6
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: coverage-${{ inputs.test-type }}${{ inputs.provider != '' && format('-{0}', inputs.provider) || '' }}.xml
-          flags: ${{ inputs.test-type }}${{ inputs.provider != '' && format('-{0}', inputs.provider) || '' }}
-          name: ${{ inputs.test-type }}${{ inputs.provider != '' && format('-{0}', inputs.provider) || '' }}-tests
+      # NOTE: per-leg coverage is NOT uploaded to Codecov here.  The .coverage
+      # data files are uploaded as artifacts (above) and the coverage-combine
+      # fan-in job in ci-tests.yml merges them and uploads ONE combined report
+      # to Codecov.  A single upload gives Codecov one deterministic number
+      # (no mid-run partial-merge flapping) and auto-scales to any number of
+      # provider legs without a hardcoded after_n_builds count.
 
       - name: Upload test results to Codecov
         # Gated on upload-coverage: legs without pytest (e.g. ui-smoke) produce

codecov.yml

@@ -1,3 +1,8 @@
+# Coverage is uploaded to Codecov exactly ONCE, from the ci-tests
+# coverage-combine job, which merges every leg's .coverage data first.  A single
+# upload gives Codecov one deterministic number (no mid-run partial-merge
+# flapping) and needs no hardcoded leg count — it auto-scales to any number of
+# provider legs.
 coverage:
   status:
     project:
@@ -22,7 +27,14 @@ flags:
       - src/orb/
     carryforward: true
 
+# Kept in sync with [tool.coverage.run] omit in pyproject.toml so Codecov's
+# view matches the combined report we upload.
 ignore:
   - "tests/"
   - "docs/"
   - "scripts/"
+  - "src/orb/k8s_legacy/**"  # own separate test suite; runs outside the main legs
+  - "**/tests/**"            # test files under src/ are not production source
+  - "src/orb/__main__.py"    # thin process entrypoints — not unit-tested
+  - "src/orb/run.py"
+  - "src/orb/interface/server_daemon.py"

makefiles/ci.mk

@@ -168,6 +168,9 @@ ci-tests-infrastructure:  ## Run infrastructure tests only (matches ci.yml infra
 ci-tests-coverage-check:  ## Combined-coverage gate: merge per-leg data + enforce threshold
 	@echo "Combining per-leg coverage data and checking combined threshold ($(COVERAGE_THRESHOLD)%)..."
 	$(call run-tool,coverage,combine)
+	# Emit the merged XML BEFORE the threshold check so it is always produced
+	# for the single Codecov upload, even when the gate below fails.
+	$(call run-tool,coverage,xml -o coverage-combined.xml)
 	# `coverage report` uses --fail-under (the pytest-cov spelling
 	# --cov-fail-under is not valid for the coverage CLI).
 	$(call run-tool,coverage,report --fail-under=$(COVERAGE_THRESHOLD))

pyproject.toml

@@ -545,6 +545,20 @@ env = []
 [tool.coverage.run]
 source = ["src/orb"]
 branch = true
+omit = [
+    # k8s_legacy is the legacy HostFactory plugin: it has its own test suite
+    # under src/orb/k8s_legacy/tests (in pytest testpaths) that runs separately
+    # from the main legs, so it always shows 0% here and unfairly drags the
+    # combined number.  Exclude it from the main coverage report.
+    "src/orb/k8s_legacy/*",
+    # Test files that live under src/ are not production source.
+    "*/tests/*",
+    # Thin process entrypoints / daemon lifecycle: not meaningfully unit-tested
+    # (exercised via subprocess/integration, not the coverage-uploading legs).
+    "src/orb/__main__.py",
+    "src/orb/run.py",
+    "src/orb/interface/server_daemon.py",
+]
 
 [tool.coverage.report]
 precision = 2