Merge branch 'main' into embedded-otel-collector

Author: aphralG

.codecov.yml

@@ -0,0 +1,54 @@
+# Codecov configuration file
+# This file configures code coverage reporting and requirements for the project
+coverage:
+
+  # Coverage status configuration
+  status:
+
+    # Project-level coverage settings
+    project:
+
+      # Default status check configuration
+      default:
+
+        # The minimum required coverage value for the project
+        target: 80%
+
+        # The allowed coverage decrease before failing the status check
+        threshold: 0%
+
+        # Whether to run coverage checks only on pull requests
+        only_pulls: false
+
+    # Patch-level coverage settings
+    patch:
+
+      default:
+
+        target: 80%
+        threshold: 0%
+        only_pulls: false
+
+comment:
+  layout: "header,diff,files,footer"
+  behavior: default
+  require_changes: false
+  require_base: false
+  require_head: true
+
+
+# Ignore files or packages matching their paths
+ignore:
+  - '\.pb\.go$'       # Excludes all protobuf generated files
+  - '\.gen\.go'      # Excludes generated files
+  - '^fake_.*\.go'    # Excludes fakes
+  - '^test/.*$'
+  - 'app.go'          # app.go and main.go should be tested by integration tests.
+  - 'main.go'
+  # ignore metadata generated files
+  - 'metadata/generated_.*\.go'
+  # ignore wrappers around gopsutil
+  - 'internal/datasource/host'
+  - 'internal/watcher/process'
+  - 'pkg/nginxprocess'
+

.github/workflows/ci.yml

@@ -68,14 +68,11 @@ jobs:
                 cache: false
           - name: Run Unit Tests
             run: make unit-test
-          - name: Check Coverage
-            uses: vladopajic/go-test-coverage@dd4b1f21c4e48db0425e1187d2845404b1206919
+          - name: Uplaod Test Coverage
+            uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
             with:
-              config: ./.testcoverage.yaml
-              ## when token is not specified (value '') this feature is turned off
-              git-token: ${{ github.ref_name == 'main' && secrets.GITHUB_TOKEN || '' }}
-              ## name of orphaned branch where badges are stored
-              git-branch: badges
+              files: ./build/test/coverage.out
+              token: ${{ secrets.CODECOV_TOKEN }}
 
   race-condition-test:
       name: Unit tests with race condition detection
@@ -293,7 +290,7 @@ jobs:
           name: nginx-agent-unsigned-snapshots
           path: build
       - name: Login to Docker Registry
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: ${{ secrets.TEST_REGISTRY_URL }}
           username: ${{ secrets.REGISTRY_USERNAME }}
@@ -414,7 +411,7 @@ jobs:
           name: nginx-agent-unsigned-snapshots
           path: build
       - name: Login to Docker Registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: ${{ secrets.TEST_REGISTRY_URL }}
           username: ${{ secrets.REGISTRY_USERNAME }}

.github/workflows/dependency-review.yml

@@ -25,6 +25,6 @@ jobs:
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: "Dependency Review"
-        uses: actions/dependency-review-action@595b5aeba73380359d98a5e087f648dbb0edce1b # v4.7.3
+        uses: actions/dependency-review-action@56339e523c0409420f6c2c9a2f4292bbb3c07dd3 # v4.8.0
         with:
           config-file: "nginxinc/k8s-common/dependency-review-config.yml@main"

.github/workflows/release-branch.yml

@@ -100,7 +100,7 @@ jobs:
 
       - name: Create Draft Release
         if: ${{ needs.vars.outputs.github_release == 'true' }}
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         id: release
         env:
           version: ${{ inputs.packageVersion }}
@@ -270,7 +270,7 @@ jobs:
 
       - name: Get Id Token
         if: ${{ inputs.publishPackages == true }}
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         id: idtoken
         with:
           script: |
@@ -299,7 +299,7 @@ jobs:
           ref: ${{ inputs.releaseBranch }}
 
       - name: Create Pull Request
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const { repo, owner } = context.repo;

.github/workflows/scorecards.yml

@@ -55,6 +55,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
+        uses: github/codeql-action/upload-sarif@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3.30.6
         with:
           sarif_file: results.sarif

.testcoverage.yaml

@@ -153,7 +153,7 @@ $(TEST_BUILD_DIR)/coverage.out:
 .PHONY: coverage
 coverage: $(TEST_BUILD_DIR)/coverage.out
 	@echo "Checking code coverage"
-	@$(GORUN) $(GOTESTCOVERAGE) --config=./.testcoverage.yaml
+	@printf "Total code coverage: " && $(GOTOOL) cover -func=$(TEST_BUILD_DIR)/coverage.out | grep 'total:' | awk '{print $$3}'
 
 build-mock-management-plane-grpc:
 	mkdir -p $(BUILD_DIR)/mock-management-plane-grpc