Create new action to measure code coverage of our test suite

[g1rly-c0d3r]

Fixes #8264 #8228

This adds a new Github action that will run on PRs that will generate a report of code coverage that is downloadable for one day. This also adds support for running pytest as a test runner so that we can measure our backend code coverage from our tests.

Checklist

• Self-review the PR after opening it to make sure the changes look good and
  self-explanatory (or properly documented)
• Add relevant issue to release milestone
• Add pr to documentation list
• Add automated tests

Testing instructions

Since you can not manually trigger a workflow on any other branch than main:

• trivially change a file
• push changes to this branch
  • The Coverage workflow should attempt to run
• Follow the instructions here to download the report, and make sure that the workflow succeeded
• Ensure that the report.tar.bz2 archive is not empty

Summary by CodeRabbit

• New Features
  • Added an automated “Coverage” workflow on push and manual runs, publishing a downloadable coverage report artifact.
• Bug Fixes
  • Improved workflow triggering to run only when relevant backend/frontend changes occur and to skip specific automated commits.
• Chores
  • Added pytest.ini to set the default DJANGO_SETTINGS_MODULE.
  • Updated testing dependencies with coverage and pytest-django.
  • Updated workflow documentation to include the required COVERAGE_SCRIPT_CLONE secret details.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR adds a Coverage GitHub Actions workflow with change detection, containerized execution, report collection, pytest defaults, testing dependencies, and documentation for the coverage-clone secret.

Changes

Coverage workflow and test setup

Layer / File(s)	Summary
Workflow triggers and change detection .github/workflows/coverage.yml	Defines workflow guards, classifies frontend and backend changes, and exposes outputs for downstream execution.
Environment setup and coverage report .github/workflows/coverage.yml, .github/workflows/README.md	Installs prerequisites, clones coverage tooling, configures and starts Docker services, collects database and service output, uploads the report artifact, and documents COVERAGE_SCRIPT_CLONE.
Pytest defaults and test dependencies pytest.ini, requirements-testing.txt	Sets the Django settings module for pytest and adds coverage and pytest-django.

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant ChangesJob
  participant SetupAndRunJob
  participant DockerCompose
  GitHubActions->>ChangesJob: trigger coverage workflow
  ChangesJob->>ChangesJob: detect changed paths
  ChangesJob->>SetupAndRunJob: pass change outputs
  SetupAndRunJob->>DockerCompose: start Docker stack
  SetupAndRunJob->>DockerCompose: collect logs and database output
  SetupAndRunJob->>GitHubActions: upload coverage report

Loading

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states the main change: adding a new action to measure test coverage.
Linked Issues check	✅ Passed	The workflow, artifact upload, and pytest support align with #8264’s goal of automated coverage analysis.
Out of Scope Changes check	✅ Passed	The added README, pytest config, and testing dependencies all support the coverage workflow and are in scope.
Automatic Tests	✅ Passed	PASS: the PR only adds coverage/pytest workflow config and no app logic, and the repo already has backend tests, so no new automated tests were necessary.
Testing Instructions	✅ Passed	The testing steps align with the workflow’s push/manual-dispatch flow and artifact validation; GitHub docs require workflow_dispatch to exist on the default branch.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch issue-8264

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Warning

One or more dependencies are approaching or past End-of-Life.
Please plan upgrades accordingly.

STATUS=WARNING
NODE_VERSION=20
NODE_CYCLE=20
EOL_DATE=2026-04-30
DAYS_REMAINING=-76

--- Node.js ---
Version: 20
EOL: 2026-04-30
Status: WARNING

STATUS=OK
PYTHON_VERSION=3.12
PYTHON_CYCLE=3.12
EOL_DATE=2028-10-31
DAYS_REMAINING=839

--- Python ---
Version: 3.12
EOL: 2028-10-31
Status: OK

STATUS=WARNING
DJANGO_VERSION=4.2
DJANGO_CYCLE=4.2
EOL_DATE=2026-04-07
DAYS_REMAINING=-99

--- Django ---
Version: 4.2
EOL: 2026-04-07
Status: WARNING

[coderabbitai]

Actionable comments posted: 6

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/coverage.yml (1)

1-110: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Add a permissions: block to follow least-privilege principle.

The workflow has no permissions: block, so it inherits the default token permissions (which may be broad depending on repo settings). Since this workflow only needs to read code and upload artifacts, it should use minimal permissions. This is flagged by zizmor.

🔒 Proposed fix

+permissions:
+  contents: read
+
 name: Coverage

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/coverage.yml around lines 1 - 110, The Coverage workflow
currently relies on default GITHUB_TOKEN scope, so add an explicit
least-privilege permissions block at the workflow level. Update the workflow
definition for the Coverage job set so it only grants the minimal access needed
for actions like actions/checkout and actions/upload-artifact, and keep the rest
of the jobs unchanged. Reference the workflow’s top-level configuration near the
existing on: and jobs: sections when applying the fix.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/coverage.yml:
- Line 31: The checkout steps in the workflow are persisting GitHub credentials
in .git/config, which triggers the artipacked warning. Update both
actions/checkout usages in the workflow to set persist-credentials to false,
since neither checkout needs to push or amend commits. Make the change on each
checkout step so the token is not retained after checkout.
- Around line 54-57: The setup job condition references an undefined changes
output, so frontend-only changes never satisfy the workflow gate. Update the if
expression in the setup job to use the actual output name exposed by the changes
job (the frontend-related output defined alongside backend_changed and
frontend/frontend_changes), and keep the workflow_dispatch branch intact so the
setup job triggers correctly for frontend-only edits.
- Around line 3-5: The coverage workflow is missing the pull_request trigger, so
its PR-specific logic in the changes job can never run. Update the workflow’s on
block to include pull_request alongside push and workflow_dispatch, and verify
the changes job condition still correctly evaluates for pull_request events by
referencing the existing changes job and event-based condition logic.
- Around line 17-23: The workflow condition in the `if` block is fragile because
`github.event.head_commit` can be null for `workflow_dispatch` events, so the
existing `head_commit.committer.name` checks in the coverage workflow should be
made null-safe. Update the conditional logic to explicitly handle
`workflow_dispatch` separately or guard access to `github.event.head_commit`
before reading `committer.name`, while preserving the existing `Hosted Weblate`,
`github-actions`, and forked pull request exclusions.
- Around line 52-107: The workflow splits setup and execution into separate
jobs, but GitHub Actions runners are ephemeral so the installed run-coverage
script and started Docker containers from setup are not available in run. Update
the coverage workflow by merging the setup and run steps into a single job (or
otherwise ensure all required artifacts/services are recreated in run), using
the setup and run job names as the key locations to refactor.

In @.github/workflows/README.md:
- Around line 72-83: Fix the broken markdown links in the COVERAGE_SCRIPT_CLONE
documentation table by updating the development repo link to use a fully
qualified GitHub URL and correcting the PR anchor so it points to the actual
pull request number shown as `#8278`. Update the affected entries in the README
table so the links resolve properly without changing the surrounding wording or
structure.

---

Outside diff comments:
In @.github/workflows/coverage.yml:
- Around line 1-110: The Coverage workflow currently relies on default
GITHUB_TOKEN scope, so add an explicit least-privilege permissions block at the
workflow level. Update the workflow definition for the Coverage job set so it
only grants the minimal access needed for actions like actions/checkout and
actions/upload-artifact, and keep the rest of the jobs unchanged. Reference the
workflow’s top-level configuration near the existing on: and jobs: sections when
applying the fix.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e7dc0191-b0ed-47f9-9398-a9251ff1841c

📥 Commits

Reviewing files that changed from the base of the PR and between 0ce7b0c and 9ef2fcb.

📒 Files selected for processing (4)

• .github/workflows/README.md
• .github/workflows/coverage.yml
• pytest.ini
• requirements-testing.txt