feat: add test coverage reporting using Coverport

Integrate coverport for test code coverage reporting

See: https://github.com/konflux-ci/coverport

Signed-off-by: David Turecek <[email protected]>

Author: msu8

.github/workflows/codecov.yml

@@ -19,3 +19,6 @@ jobs:
         run: make test
       - name: Codecov
         uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          flags: unit-tests

.github/workflows/pr.yaml

@@ -132,6 +132,9 @@ jobs:
           make test
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          flags: unit-tests
   gitlint:
     name: Run gitlint checks
     runs-on: ubuntu-24.04

.tekton/integration-service-pull-request.yaml

@@ -222,6 +222,7 @@ spec:
       - name: BUILD_ARGS
         value:
         - $(params.build-args[*])
+        - ENABLE_COVERAGE=true
       - name: BUILD_ARGS_FILE
         value: $(params.build-args-file)
       - name: SOURCE_ARTIFACT

.tekton/integration-service-push.yaml

@@ -194,6 +194,48 @@ spec:
         workspace: git-auth
       - name: netrc
         workspace: netrc
+    - name: build-instrumented-image
+      params:
+      - name: IMAGE
+        value: $(params.output-image).instrumented
+      - name: DOCKERFILE
+        value: $(params.dockerfile)
+      - name: CONTEXT
+        value: $(params.path-context)
+      - name: HERMETIC
+        value: $(params.hermetic)
+      - name: PREFETCH_INPUT
+        value: $(params.prefetch-input)
+      - name: IMAGE_EXPIRES_AFTER
+        value: $(params.image-expires-after)
+      - name: COMMIT_SHA
+        value: $(tasks.clone-repository.results.commit)
+      - name: BUILD_ARGS
+        value:
+        - $(params.build-args[*])
+        - ENABLE_COVERAGE=true
+      - name: BUILD_ARGS_FILE
+        value: $(params.build-args-file)
+      - name: SOURCE_ARTIFACT
+        value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
+      - name: CACHI2_ARTIFACT
+        value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
+      runAfter:
+      - prefetch-dependencies
+      taskRef:
+        params:
+        - name: name
+          value: buildah-oci-ta
+        - name: bundle
+          value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.7@sha256:b54509f5f695c0c89de4587a403099a26da5cdc3707037edd4b7cf4342b63edd
+        - name: kind
+          value: task
+        resolver: bundles
+      when:
+      - input: $(tasks.init.results.build)
+        operator: in
+        values:
+        - "true"
     - matrix:
         params:
         - name: PLATFORM

Dockerfile

@@ -15,8 +15,17 @@ COPY --chown=1001:0 go.sum go.sum
 # Copy the go source
 COPY --chown=1001:0 . .
 
-# Build
-RUN CGO_ENABLED=0 go build -a -o manager cmd/main.go \
+# Build arguments
+ARG ENABLE_COVERAGE=false
+
+# Build with or without coverage instrumentation
+RUN if [ "$ENABLE_COVERAGE" = "true" ]; then \
+        echo "Building with coverage instrumentation..."; \
+        CGO_ENABLED=0 go build -cover -covermode=atomic -tags=coverage -o manager ./cmd; \
+    else \
+        echo "Building production binary..."; \
+        CGO_ENABLED=0 go build -a -o manager ./cmd; \
+    fi \
  && CGO_ENABLED=0 go build -a -o snapshotgc cmd/snapshotgc/snapshotgc.go
 
 ARG ENABLE_WEBHOOKS=true

cmd/coverage_init.go

@@ -0,0 +1,9 @@
+//go:build coverage
+
+package main
+
+// This file is only included when building with -tags=coverage.
+// It starts a coverage HTTP server that allows collecting coverage data
+// from the running binary during E2E tests.
+
+import _ "github.com/konflux-ci/coverport/instrumentation/go" // starts coverage server via init()

go.mod

@@ -13,6 +13,7 @@ require (
 	github.com/google/go-containerregistry v0.20.6
 	github.com/google/go-github/v45 v45.2.0
 	github.com/konflux-ci/application-api v0.0.0-20250324201748-5a9670bf7679
+	github.com/konflux-ci/coverport/instrumentation/go v0.0.0-20251127115143-b5207b335f8b
 	github.com/konflux-ci/operator-toolkit v0.0.0-20240402130556-ef6dcbeca69d
 	github.com/konflux-ci/release-service v0.0.0-20240514150425-d25d533f66ba
 	github.com/onsi/ginkgo/v2 v2.23.4

go.sum

@@ -278,6 +278,8 @@ github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zt
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/konflux-ci/application-api v0.0.0-20250324201748-5a9670bf7679 h1:mtLA7dQ9iIncxYoOLgty2B1l1cucnp/tsbxQaKn9Myw=
 github.com/konflux-ci/application-api v0.0.0-20250324201748-5a9670bf7679/go.mod h1:948Z+a1IbfRT0RtoHzWWSN9YEucSbMJTHaMhz7dVICc=
+github.com/konflux-ci/coverport/instrumentation/go v0.0.0-20251127115143-b5207b335f8b h1:NoriO1KRc+7d2/JA07JizqxP0LlA2oJdD5AuQOvEIjE=
+github.com/konflux-ci/coverport/instrumentation/go v0.0.0-20251127115143-b5207b335f8b/go.mod h1:WVMHU9A2464s/vjH1xOTm4LJDD4xP+VlEiU+KM0gkSU=
 github.com/konflux-ci/operator-toolkit v0.0.0-20240402130556-ef6dcbeca69d h1:z7j3mglNoXvIrw5Vz/Ul+izoITRaqYURPIWrFoEyHgI=
 github.com/konflux-ci/operator-toolkit v0.0.0-20240402130556-ef6dcbeca69d/go.mod h1:AcChx7FjpYSIkDvQgaUKyauuF0PXm3ivB5MqZSC9Eis=
 github.com/konflux-ci/release-service v0.0.0-20240514150425-d25d533f66ba h1:04A7d9bdym9vY6dXqjFE6RaB3elm7sSthnQQA/IBQxk=

integration-tests/pipelines/konflux-e2e-tests.yaml

@@ -46,7 +46,7 @@ spec:
           - name: revision
             value: main
           - name: pathInRepo
-            value: tasks/test-metadata/0.3/test-metadata.yaml
+            value: tasks/test-metadata/0.4/test-metadata.yaml
       params:
         - name: SNAPSHOT
           value: $(params.SNAPSHOT)
@@ -110,9 +110,9 @@ spec:
         - name: component-name
           value: integration-service
         - name: component-image-repository
-          value: $(tasks.test-metadata.results.container-repo)
+          value: $(tasks.test-metadata.results.instrumented-container-repo)
         - name: component-image-tag
-          value: $(tasks.test-metadata.results.container-tag)
+          value: $(tasks.test-metadata.results.instrumented-container-tag)
         - name: component-pr-owner
           value: $(tasks.test-metadata.results.pull-request-author)
         - name: component-pr-sha
@@ -158,6 +158,35 @@ spec:
         - name: test-environment
           value: "upstream"
   finally:
+    - name: collect-and-upload-coverage
+      params:
+        - name: instrumented-images
+          value: "$(tasks.test-metadata.results.instrumented-container-repo):$(tasks.test-metadata.results.instrumented-container-tag)"
+        - name: cluster-access-secret-name
+          value: kfg-$(context.pipelineRun.name)
+        - name: test-name
+          value: e2e-tests
+        - name: oci-container
+          value: "$(params.oci-container-repo):$(context.pipelineRun.name)-coverport"
+        - name: codecov-flags
+          value: e2e-tests
+        - name: credentials-secret-name
+          value: "integration-service-coverport-secrets"
+      taskRef:
+        resolver: git
+        params:
+          - name: url
+            value: https://github.com/konflux-ci/tekton-integration-catalog.git
+          - name: revision
+            value: main
+          - name: pathInRepo
+            value: tasks/coverport-coverage/0.1/coverport-coverage.yaml
+      when:
+        - input: $(tasks.konflux-e2e-tests.status)
+          operator: in
+          values:
+            - Succeeded
+            - Failed
     - name: store-pipeline-status
       taskRef:
         resolver: git