ci: add coverage reports

Add a coverage report when we run the tests. In a second step, merge all
reports and make sure we score above 75%. This is not a hard goal, but
we have aroudn 80% right now, which is a good starting point.

Signed-off-by: Christoph Steiger <christoph.steiger@siemens.com>

Author: Urist-McGit

.github/workflows/coverage.yml

@@ -0,0 +1,52 @@
+# Copyright (C) 2025 Siemens
+#
+# SPDX-License-Identifier: MIT
+
+name: Check coverage
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+
+jobs:
+  coverage:
+    name: Combine and check coverage
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: 3.13
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade coverage[toml]
+
+      - name: Download coverage data
+        uses: actions/download-artifact@v4
+        with:
+          name: coverage-data
+
+      - name: Combine coverage and fail it it’s under 75%
+        run: |
+          python -m coverage combine
+          python -m coverage html --skip-covered --skip-empty
+
+          # Report and write to summary.
+          python -m coverage report | sed 's/^/    /' >> $GITHUB_STEP_SUMMARY
+
+          # Report again and fail if under 75%.
+          python -Im coverage report --fail-under=100
+
+      - name: Upload HTML report if check failed
+        uses: actions/upload-artifact@v4
+        with:
+          name: html-report
+          path: htmlcov
+        if: ${{ failure() }}

.github/workflows/test.yml

@@ -2,7 +2,7 @@
 #
 # SPDX-License-Identifier: MIT
 
-name: Run Tests
+name: Tests
 
 on:
   pull_request:
@@ -32,6 +32,14 @@ jobs:
     - name: Run pytest
       run: pytest
 
+    - name: Upload coverage data
+      uses: actions/upload-artifact@v4
+      with:
+        name: coverage-data
+        path: .coverage.*
+        include-hidden-files: true
+        if-no-files-found: ignore
+
     - name: smoke test generate
       run: |
         debsbom -vv generate -t spdx -t cdx -o sbom --validate

.gitignore

@@ -1,4 +1,5 @@
 **/__pycache__
 *.json
 *.egg-info
+.coverage
 downloads/

README.md

@@ -1,3 +1,5 @@
+[![Tests](https://github.com/siemens/debsbom/actions/workflows/test.yml/badge.svg)](https://github.com/siemens/debsbom/actions/workflows/test.yml)
+
 # debsbom - SBOM generator for Debian-based distributions
 
 `debsbom` generates SBOMs (Software Bill of Materials) for distributions based on Debian in the two standard formats [SPDX](https://www.spdx.org) and [CycloneDX](https://www.cyclonedx.org).

pyproject.toml

@@ -36,6 +36,7 @@ Repository = "https://github.com/siemens/debsbom.git"
 [project.optional-dependencies]
 dev = [
   "pytest>=6.0",
+  "pytest-cov>=6",
   "black",
   "beartype>=0.20",
   "debsbom[download]",