chore: add pytest-cov coverage reporting and update GitHub Actions

.github/workflows/duvet-test-server.yml

@@ -14,11 +14,11 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       # There are a lot of submodules here
       # This initializes the checkouts in parallel (--jobs)
-      # rather than in series the way actions/checkout@v5 does it.
+      # rather than in series the way actions/checkout@v6 does it.
 
       - name: Get CPU count
         id: cpu-count
@@ -42,7 +42,7 @@ jobs:
 
 
       - name: Checkout CPP code cpp-v3
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           submodules: recursive
           repository: aws/aws-sdk-cpp
@@ -64,7 +64,7 @@ jobs:
 
       - name: Upload duvet reports
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: test-server-reports
           include-hidden-files: true
@@ -95,7 +95,7 @@ jobs:
 
       - name: Upload compliance dashboard
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: compliance-dashboard
           include-hidden-files: true

.github/workflows/duvet.yml

@@ -32,7 +32,7 @@ jobs:
         run: make duvet
 
       - name: Upload duvet reports
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: reports
           include-hidden-files: true

.github/workflows/lint.yml

@@ -12,10 +12,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
 

.github/workflows/python-integ.yml

@@ -18,17 +18,17 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           submodules: false
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ inputs.python-version || '3.11' }}
 
       - name: Cache uv dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cache/uv
           key: ${{ runner.os }}-uv-${{ hashFiles('./test-server/python-v3-server/**/pyproject.toml') }}
@@ -42,7 +42,7 @@ jobs:
         run: make install
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: arn:aws:iam::370957321024:role/S3EC-Python-Github-test-role
           aws-region: us-west-2
@@ -55,3 +55,24 @@ jobs:
         env:
           CI_S3_BUCKET: ${{ vars.CI_S3_BUCKET }}
           CI_KMS_KEY_ALIAS: ${{ vars.CI_KMS_KEY_ALIAS }}
+
+      - name: Generate coverage HTML report
+        if: always()
+        run: uv run coverage html -d coverage-report
+
+      - name: Upload coverage report
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-report
+          path: coverage-report/
+
+      - name: Check coverage threshold
+        run: |
+          THRESHOLD=93
+          ACTUAL=$(uv run coverage report --format=total)
+          echo "Coverage: ${ACTUAL}% (threshold: ${THRESHOLD}%)"
+          if [ "$ACTUAL" -gt "$THRESHOLD" ]; then
+            echo "::warning::Coverage is ${ACTUAL}%, consider updating --fail-under to ${ACTUAL} in python-integ.yml"
+          fi
+          uv run coverage report --fail-under=$THRESHOLD

.github/workflows/test-server.yml

@@ -19,14 +19,14 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           submodules: false
           token: ${{ secrets.PAT_FOR_SPEC }}
 
       # There are a lot of submodules here
       # This initializes the checkouts in parallel (--jobs)
-      # rather than in series the way actions/checkout@v5 does it.
+      # rather than in series the way actions/checkout@v6 does it.
 
       - name: Get CPU count
         id: cpu-count
@@ -89,7 +89,7 @@ jobs:
 
       # Cache Gradle dependencies and build outputs
       - name: Cache Gradle packages
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.gradle/caches
@@ -100,7 +100,7 @@ jobs:
             ${{ runner.os }}-gradle-
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: arn:aws:iam::370957321024:role/S3EC-Python-Github-test-role
           aws-region: us-west-2
@@ -133,7 +133,7 @@ jobs:
 
       - name: Upload server logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: server-logs
           path: |
@@ -144,7 +144,7 @@ jobs:
 
       - name: Upload results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: results
           path: test-server/java-tests/build/reports/tests/integ

.gitignore

@@ -55,3 +55,5 @@ smithy-java-core/out
 
 # test server
 *.pid
+.coverage
+coverage-report/

Makefile

@@ -20,16 +20,16 @@ format:
 	uv run black src/ test/
 	uv run ruff check --fix src/ test/
 
-# Run all tests
+# Run all tests with combined coverage
 test: test-unit test-integration
 
-# Run unit tests
+# Run unit tests (creates .coverage report)
 test-unit:
-	uv run pytest test/ --ignore=test/integration/ --verbose
+	uv run pytest test/ --ignore=test/integration/ --verbose --cov=src/s3_encryption --cov-report=term-missing
 
-# Run integration tests
+# Run integration tests (appends to .coverage report from test-unit)
 test-integration:
-	uv run pytest test/integration/ --verbose
+	uv run pytest test/integration/ --verbose --cov=src/s3_encryption --cov-append --cov-report=term-missing
 
 # Clean up cache files
 clean:

pyproject.toml

@@ -17,6 +17,7 @@ dependencies = [
 [project.optional-dependencies]
 test = [
     "pytest>=8.4.1",
+    "pytest-cov>=6.1.1",
 ]
 dev = [
     "black>=24.3.0,<27.0.0",
@@ -61,3 +62,9 @@ known-first-party = ["s3_encryption"]
 [tool.ruff.lint.per-file-ignores]
 "test/**/*.py" = ["D100", "D101", "D102", "D103", "D104", "E501"]
 "src/s3_encryption/pipelines.py" = ["E501"]
+
+[tool.coverage.run]
+source = ["src/s3_encryption"]
+
+[tool.coverage.report]
+show_missing = true