feat(ci): new coverage flow

As suggested in https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

.github/actions/automatic-updates/action.yml

@@ -69,6 +69,7 @@ runs:
       run: |
         go test -v ./... -covermode=count -coverprofile=coverage.out
         go tool cover -func=coverage.out -o=coverage.out
+        grep -o -P '(?<=\(statements\))(.+)(?=%)' coverage.out | xargs > coverage
         touch badge.out
     - name: Go Coverage Badge
       uses: ./.github/actions/coverage-badge
@@ -89,7 +90,7 @@ runs:
       run: |
         git config --local user.email "$CI_EMAIL"
         git config --local user.name "$CI_USER"
-        git add -A && git commit -m 'chore: nightly coverage badge update' && echo "badge=1" >> $GITHUB_ENV || echo "No changes to coverage badge"
+        git add -A -f && git commit -m 'chore: nightly coverage changed' && echo "badge=1" >> $GITHUB_ENV || echo "No changes to coverage"
 
     # Git push
     - name: Push changes

.github/actions/e2e-build/action.yml

@@ -29,4 +29,18 @@ runs:
 
   - name: Test
     shell: bash
-    run: make
+    run: |
+      COVERAGE_OPTS="-covermode=count -coverprofile=coverage.out" make build
+
+  - name: Save coverage PR value
+    shell: bash
+    run: |
+      mkdir -p ./pr
+      go tool cover -func=coverage.out -o=coverage.out
+      grep -o -P '(?<=\(statements\))(.+)(?=%)' coverage.out | xargs > ./pr/coverage
+      echo ${{ github.event.number }} > ./pr/id
+
+  - uses: actions/upload-artifact@v2
+    with:
+      name: pr
+      path: pr/

.github/workflows/comment-pr.yaml

@@ -0,0 +1,67 @@
+name: Comment on the pull request
+
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+on:
+  workflow_run:
+    workflows: ["build"]
+    types:
+      - completed
+
+jobs:
+  upload:
+    runs-on: ubuntu-latest
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+    steps:
+      - name: 'Download coverage artifact'
+        uses: actions/[email protected]
+        with:
+          script: |
+            var artifacts = await github.actions.listWorkflowRunArtifacts({
+               owner: context.repo.owner,
+               repo: context.repo.repo,
+               run_id: ${{github.event.workflow_run.id }},
+            });
+            var matchArtifact = artifacts.data.artifacts.filter((artifact) => {
+              return artifact.name == "pr"
+            })[0];
+            var download = await github.actions.downloadArtifact({
+               owner: context.repo.owner,
+               repo: context.repo.repo,
+               artifact_id: matchArtifact.id,
+               archive_format: 'zip',
+            });
+            var fs = require('fs');
+            fs.writeFileSync('${{github.workspace}}/pr.zip', Buffer.from(download.data));
+      - run: unzip pr.zip
+
+      - name: 'Comment on PR'
+        uses: actions/github-script@v3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            var fs = require('fs');
+            const coverage = Number(fs.readFileSync('./coverage'));
+            const issue_number = Number(fs.readFileSync('./id'));
+            const main_coverage_result = await github.request('https://raw.githubusercontent.com/' + context.repo.owner + '/' + context.repo.repo + '/main/coverage')
+            const main_cov_num = Number(main_coverage_result.data)
+            diff = Math.round((coverage - main_cov_num + Number.EPSILON) * 100) / 100
+
+            if(diff > 0){
+              await github.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue_number,
+                body: ':heavy_check_mark: Unit test coverage report - coverage increased from ' + main_cov_num + '% to ' + coverage + '% (**+' + diff + '%**)'
+              })
+            }else if(diff < 0){
+              await github.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue_number,
+                body: ':warning: Unit test coverage report - coverage decreased from ' + main_cov_num + '% to ' + coverage + '% (**' + diff + '%**)'
+              })
+            }

.gitignore

@@ -141,8 +141,9 @@ anaconda-mode/
 # Test binary, build with 'go test -c'
 *.test
 
-# Output of the go coverage tool, specifically when used with LiteIDE
-*.out
+# Output of the go coverage tool
+coverage.out
+coverage
 
 ### Vim ###
 # swap

coverage

@@ -0,0 +1 @@
+34.2

script/Makefile

@@ -243,11 +243,7 @@ endif
 
 test: do-build
 	@echo "####### Running unit test..."
-	go test ./...
-
-test-fmt: do-build
-	@echo "####### Running unit test..."
-	go test -v ./... -json 2>&1 | gotestfmt
+	go test ./... $(COVERAGE_OPTS)
 
 #
 # Common tests that do not require any customized operator setting. They can leverage a unique namespaced operator installation to reduce