From ef57e90e0accf64bbff38a0d6e2e71cc62502fa6 Mon Sep 17 00:00:00 2001 From: Jaro-c <75870284+Jaro-c@users.noreply.github.com> Date: Mon, 27 Jul 2026 22:22:48 -0500 Subject: [PATCH 1/3] ci: enforce the coverage floor per package, and keep the fuzz corpus MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adopts both halves of Glyndor/.github#106. The coverage floor now has to hold in every package rather than on average. This module ran at 91% against a gate of 90 while auth/oauth sat at 87.7% and internal/keymanager at 85.7% — the two with the most attack surface were the two thinnest, and internal/clock at 100% was paying for them. Every package clears 90 today, which is exactly when a floor is cheapest to adopt: it locks in a state that already holds instead of demanding new work. The fuzz corpus now survives between runs. It never did: setup-go restores GOCACHE but does not save it again on a cache hit, so each week started from the seed corpus and re-explored the same ground. Measured here, a cold 60s run of FuzzParseJWK finds 219 new interesting inputs and 300s finds 293 — a single run saturates well before its budget, so the budget was never the constraint. Starting from zero was. Pinned by SHA rather than tag: Glyndor/.github is only tagged once a consumer has proved a workflow green, and this is that consumer. Closes #218. Closes #225. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com> --- .github/workflows/ci.yml | 7 ++++++- .github/workflows/fuzz.yml | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ade32f2..a45863c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -11,6 +11,11 @@ permissions: jobs: go: - uses: Glyndor/.github/.github/workflows/go-ci.yml@7099f8a9c8be91fa1732fe2402268b338771233f # v1.10.1 + uses: Glyndor/.github/.github/workflows/go-ci.yml@045903bf83a58651f119bc7d952aa45242b897c5 with: coverage-threshold: 90 + # Every package clears this today, which is exactly when a floor is + # cheapest to adopt. The aggregate alone let auth/oauth sit at 87.7% and + # internal/keymanager at 85.7% — the two with the most attack surface — + # while a fully covered clock helper paid for them. + per-package-coverage-threshold: 90 diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 6e6d093..67202f1 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -10,7 +10,7 @@ permissions: jobs: fuzz: - uses: Glyndor/.github/.github/workflows/go-fuzz.yml@7099f8a9c8be91fa1732fe2402268b338771233f # v1.10.1 + uses: Glyndor/.github/.github/workflows/go-fuzz.yml@045903bf83a58651f119bc7d952aa45242b897c5 with: fuzztime: "60s" targets: >- From f1323f464f2a8c0ac9321430aa2ceb5da14e3b1c Mon Sep 17 00:00:00 2001 From: Jaro-c <75870284+Jaro-c@users.noreply.github.com> Date: Mon, 27 Jul 2026 22:24:18 -0500 Subject: [PATCH 2/3] test: temporarily raise the floor to 96 to prove the gate fails Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com> --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a45863c..3406592 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,4 +18,4 @@ jobs: # cheapest to adopt. The aggregate alone let auth/oauth sit at 87.7% and # internal/keymanager at 85.7% — the two with the most attack surface — # while a fully covered clock helper paid for them. - per-package-coverage-threshold: 90 + per-package-coverage-threshold: 96 From 382807a58c357f278b97a59c5760ea03e7f32a9d Mon Sep 17 00:00:00 2001 From: Jaro-c <75870284+Jaro-c@users.noreply.github.com> Date: Mon, 27 Jul 2026 22:25:33 -0500 Subject: [PATCH 3/3] Revert "test: temporarily raise the floor to 96 to prove the gate fails" The gate names every package under the floor with a ::error:: annotation and fails the job, verified at 96 where six packages are under it. Back to 90, which every package clears. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com> --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3406592..a45863c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,4 +18,4 @@ jobs: # cheapest to adopt. The aggregate alone let auth/oauth sit at 87.7% and # internal/keymanager at 85.7% — the two with the most attack surface — # while a fully covered clock helper paid for them. - per-package-coverage-threshold: 96 + per-package-coverage-threshold: 90