Add code coverage

[kartikjoshi21]

Add CI coverage reporting (unit + integration)

This PR adds Go coverage tracking to the existing CI

1. Integration matrix now runs go test ./test with coverage (-covermode=atomic -coverpkg=./...) and uploads per-suite profiles (coverage-integration-*).
2. Unit job now generates coverage/unit.out and uploads it (coverage-unit).
3. New coverage-report job downloads artifacts, merges profiles, generates summary.txt + index.html, and posts total coverage in the GitHub Step Summary (also uploads coverage-report artifact).

Fixes: #889

[Copilot]

Pull request overview

This PR adds comprehensive code coverage tracking to the CI workflow to support OpenSSF Silver Badge requirements. It instruments both unit and integration tests to collect coverage data, merges the profiles, and generates coverage reports that are displayed in GitHub's step summary.

Changes:

• Modified integration tests to collect coverage data with -covermode=atomic -coverpkg=./... flags
• Modified unit tests to collect coverage data, excluding the /test directory packages
• Added new coverage-report job that merges all coverage profiles and generates summary reports

[Copilot]

Missing version comment for the download-artifact action. All other action uses in this workflow include version comments (e.g., # v6.0.0). Please add a version comment to maintain consistency with the established convention in this file.

Suggested change

	uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
	with:
	name: coverage-unit
	path: coverage
	- name: Download integration coverage artifacts
	uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
	uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # download-artifact pinned SHA
	with:
	name: coverage-unit
	path: coverage
	- name: Download integration coverage artifacts
	uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # download-artifact pinned SHA

[Copilot]

Missing version comment for the download-artifact action. All other action uses in this workflow include version comments (e.g., # v6.0.0). Please add a version comment to maintain consistency with the established convention in this file.

Suggested change

	uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
	with:
	name: coverage-unit
	path: coverage
	- name: Download integration coverage artifacts
	uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
	uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.1.8
	with:
	name: coverage-unit
	path: coverage
	- name: Download integration coverage artifacts
	uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.1.8

[Copilot]

The coverage-report job will not run if either the unit or integration jobs fail, even though those jobs use if: always() to upload coverage artifacts on failure. This means coverage reports won't be generated when tests fail. Consider adding if: always() to the coverage-report job (or using a more specific condition like if: success() || failure()) to ensure coverage reports are generated even when tests fail, which would be valuable for understanding coverage gaps in failing test scenarios.

Suggested change

	- integration
	- integration
	if: ${{ always() }}

[Copilot]

The unquoted variable expansion ${integration_profiles} could potentially cause issues with shell word splitting if any filenames contain spaces or special characters. While the current suite names don't contain spaces, it's a best practice to use an array or quote the variable to make the script more robust. Consider using a bash array: integration_profiles=($(find...)) and then "${integration_profiles[@]}" in the gocovmerge command.

[cpuguy83]

Isn't this reporting coverage of what get called on the client side but not the actual frontend?
We would need to build the frontend with coverage instrumentation, and then extract the data out of it (maybe if coverage is enabled we can inject the metadata into the result object and extract it in the test client invocation?).

https://go.dev/doc/build-cover