From f2a6f7c5c70f71a2cccc08590c3fd17dd23726c4 Mon Sep 17 00:00:00 2001
From: kite <lizhengfeng.lzf@alibaba-inc.com>
Date: Sat, 27 Jun 2026 11:13:22 +0800
Subject: [PATCH] ci: add 80% statement coverage threshold check

Add coverage threshold enforcement in CI workflow and Makefile to satisfy
OpenSSF Best Practices Silver badge test_statement_coverage80 criterion.
---
 .github/workflows/ci.yml                   | 16 ++++++++++++++--
 Makefile                                   | 16 ++++++++++++++--
 internal/config/rules/system_rules_test.go |  2 +-
 3 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a36405c..ef44b2a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,8 +29,20 @@ jobs:
           go install golang.org/x/vuln/cmd/govulncheck@latest
           govulncheck ./...
 
-      - name: Test
-        run: go test -v -race -count=1 ./...
+      - name: Test with coverage
+        run: |
+          go test -v -race -count=1 -coverprofile=coverage.out ./...
+          go tool cover -func=coverage.out | grep total: | awk '{print $3}'
+
+      - name: Check coverage threshold
+        run: |
+          COVERAGE=$(go tool cover -func=coverage.out | grep total: | awk '{print $3}' | sed 's/%//')
+          echo "Total coverage: ${COVERAGE}%"
+          if awk "BEGIN {exit !($COVERAGE < 80)}"; then
+            echo "FAIL: Coverage ${COVERAGE}% is below 80% threshold"
+            exit 1
+          fi
+          echo "PASS: Coverage ${COVERAGE}% meets 80% threshold"
 
       - name: Build
         run: go build -o /dev/null ./cmd/opencodereview
diff --git a/Makefile b/Makefile
index bb83bc0..af0803f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: build test clean run help fmt vet check \
+.PHONY: build test clean run help fmt vet check coverage \
 	build-all dist sha256sum version-info \
 	build-linux-amd64 build-linux-arm64 build-darwin-amd64 build-darwin-arm64 \
 	build-windows-amd64 build-windows-arm64
@@ -36,8 +36,20 @@ PACKAGES := $(shell $(GO) list ./... | grep -v /extensions/)
 test:
 	LC_ALL=C $(GO) test -v -race -count=1 $(PACKAGES)
 
+COVERAGE_THRESHOLD := 80
+
+coverage:
+	LC_ALL=C $(GO) test -count=1 -coverprofile=coverage.out $(PACKAGES)
+	$(GO) tool cover -func=coverage.out | grep total:
+	@COVERAGE=$$($(GO) tool cover -func=coverage.out | grep total: | awk '{print $$3}' | sed 's/%//'); \
+	if awk "BEGIN {exit !($$COVERAGE < $(COVERAGE_THRESHOLD))}"; then \
+		echo "FAIL: Coverage $${COVERAGE}% is below $(COVERAGE_THRESHOLD)% threshold"; \
+		exit 1; \
+	fi; \
+	echo "PASS: Coverage $${COVERAGE}% meets $(COVERAGE_THRESHOLD)% threshold"
+
 clean:
-	rm -rf $(DIST_DIR)
+	rm -rf $(DIST_DIR) coverage.out
 
 run: build
 	$(DIST_DIR)/$(BINARY_NAME) --staged
diff --git a/internal/config/rules/system_rules_test.go b/internal/config/rules/system_rules_test.go
index 8d18fdf..374e077 100644
--- a/internal/config/rules/system_rules_test.go
+++ b/internal/config/rules/system_rules_test.go
@@ -1281,7 +1281,7 @@ func TestResolveRuleEntries_PathTraversalBlocked(t *testing.T) {
 	}
 
 	entries := []ProjectRuleEntry{
-		{Path: "**/*.go", Rule: outside}, // absolute path to outside — allowed
+		{Path: "**/*.go", Rule: outside},         // absolute path to outside — allowed
 		{Path: "**/*.ts", Rule: "../outside.md"}, // relative traversal — blocked
 	}
 	resolveRuleEntries(entries, dir)