ci(backend): calculate code coverage baseline in backend checks

[ktursunov]

What

Adds report-only, self-contained code-coverage reporting for src/backend to the Backend Lint & Test workflow — a coverage summary on every backend PR, with no external service and no plan requirement (works on Free).

• Rust workspace (analytics-api, api-gateway, insight-clickhouse, oidc-authn-plugin): cargo-llvm-cov runs the suite under instrumentation (replacing plain cargo test, so tests still run) and emits a single Cobertura report.
• Identity (.NET): dotnet test --collect:"XPlat Code Coverage" on the unit + integration projects; the two Cobertura files are merged with dotnet-coverage.
• Each is rendered to markdown by irongut/CodeCoverageSummary and posted as a sticky PR comment + appended to the Actions job summary. No HTML, no artifacts, no Codecov.

Adds coverlet.collector (dev-only, PrivateAssets=all) to the two Identity test projects so the XPlat Code Coverage collector emits Cobertura.

Baseline (from CI, all tests green)

Component	Line	Notes
Rust workspace	62% (4392/7129)	insight-clickhouse 89%, oidc-authn-plugin 86%, api-gateway 0% (thin binary, no tests), analytics-api mixed
Identity (.NET)	87% (2618/3011), branch 81%	Domain 97%, Api 86%, Infrastructure 83%

Scope / non-goals

Deliberately thin — only calculates and exposes the baseline. Out of scope (future follow-ups under #1384): coverage gates / ratchet, a shared task-runner so local == CI, cargo-nextest, connector (Python) coverage.

GitHub-native coverage (Code Quality) was evaluated and rejected for now: it's a paid Team/Enterprise-Cloud product (GA 2026-07-20, $10/active-committer/mo), not free for public repos, and this org is on Free — the upload API returns HTTP 403 ("Code quality is not enabled for this repository"). The Cobertura we emit would feed it directly (actions/upload-code-coverage) if the org ever upgrades.

Test plan

• backend-checks.yml runs on this PR (touches src/backend/** + the workflow). Both jobs run the full unit (+ integration) suites and post their coverage comments.
• Verified on CI and locally in containers: Rust 315 tests pass; Identity unit + integration pass.

Closes #1384

Summary by CodeRabbit

• Chores
  • Updated backend CI to gate backend-related PRs and cancel in-progress runs for the same workflow/ref, improving build efficiency.
  • Added automated code coverage instrumentation and reporting for backend test runs, including Cobertura output and summarized results in job run notes.
  • Enhanced unit and integration test coverage collection to consistently generate merged coverage artifacts for clearer visibility.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7d2bc879-47fd-449d-ab53-2d57cb4d51f6

📥 Commits

Reviewing files that changed from the base of the PR and between 09003d4 and 151f392.

📒 Files selected for processing (1)

• .github/workflows/backend-checks.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/backend-checks.yml

---

📝 Walkthrough

Walkthrough

The backend CI workflow gains concurrency cancellation and minimal token permissions. Rust test execution is replaced with cargo llvm-cov to produce a Cobertura XML report summarised as markdown in the job summary. Both .NET Identity test projects add the coverlet.collector package, and the CI workflow collects, merges, and summarises .NET coverage the same way.

Changes

Backend CI Code Coverage

Layer / File(s)	Summary
Workflow concurrency and permissions .github/workflows/backend-checks.yml	Adds concurrency group with cancel-in-progress: true, restricts permissions to contents: read, and documents PR/manual dispatch gating.
Rust coverage instrumentation and summary .github/workflows/backend-checks.yml	Adds llvm-tools-preview to the Rust toolchain components; replaces cargo test --all with cargo llvm-cov (Cobertura XML output); appends a markdown coverage table to $GITHUB_STEP_SUMMARY via CodeCoverageSummary with a missing-file fallback.
coverlet.collector package references src/backend/services/identity/tests/Insight.Identity.Tests.Integration/Insight.Identity.Tests.Integration.csproj, src/backend/services/identity/tests/Insight.Identity.Tests.Unit/Insight.Identity.Tests.Unit.csproj	Adds coverlet.collector 6.0.2 with PrivateAssets=all to both .NET test projects so dotnet test can emit Cobertura coverage without transitive exposure.
.NET coverage collection, merge, and summary .github/workflows/backend-checks.yml	Extends integration test step with --collect "XPlat Code Coverage" into ./coverage; adds dotnet-coverage merge step producing merged.cobertura.xml; generates and appends markdown summary to the job summary with if: always() and fallback.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related issues

• #1384 – Add code coverage calculation for src/backend (Rust + .NET): This PR directly implements all acceptance criteria from that issue: cargo-llvm-cov for Rust, coverlet.collector + dotnet-coverage merge for .NET Identity, and per-stack summaries posted to the GitHub Actions job summary.
• #1410: The PR adds exactly the cargo llvm-cov and coverlet.collector coverage infrastructure that issue #1410 proposes for the backend, laying the groundwork for coverage-based gating and enforcement.

Poem

🐇 Hop hop, the coverage grows,
In XML and markdown it flows.
Rust runs cov, .NET collects,
Merged and merged until it checks —
The job summary blooms with stats,
All green! No room for coverage gaps! 🌿

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title accurately summarizes the main change: adding automated code coverage calculation to the backend CI workflow as a foundational, report-only baseline.
Linked Issues check	✅ Passed	All acceptance criteria from #1384 are met: coverage is collected for both Rust (cargo-llvm-cov) and .NET (Coverlet), summaries are rendered to markdown and posted via job summary, coverage is report-only and never fails backend-checks, and baseline coverage is established.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to implementing code coverage collection and reporting for the backend, aligning with #1384 objectives—no unrelated modifications are present.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/backend-checks.yml:
- Line 59: The GitHub Actions in the workflow file use floating version
references instead of full commit SHAs, which violates supply-chain integrity
policy. Replace the floating refs for taiki-e/install-action@cargo-llvm-cov and
any other actions pinned to version tags like `@v1.3.0` with their corresponding
full commit SHA hashes. This applies to all instances across the workflow file
where actions use floating refs to ensure all third-party actions are pinned to
immutable commit SHAs.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: cc4ff2eb-7973-4d3a-9b30-ef37848b1bbf

📥 Commits

Reviewing files that changed from the base of the PR and between cf3161e and 09003d4.

📒 Files selected for processing (3)

• .github/workflows/backend-checks.yml
• src/backend/services/identity/tests/Insight.Identity.Tests.Integration/Insight.Identity.Tests.Integration.csproj
• src/backend/services/identity/tests/Insight.Identity.Tests.Unit/Insight.Identity.Tests.Unit.csproj

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify no non-SHA action refs remain in this workflow.
# Expected: zero matches for third-party `uses:` refs not pinned to 40-char SHA.
rg -nP '^\s*-\s*uses:\s*[^@\s]+@(?!(?:[0-9a-f]{40})$).+$' .github/workflows/backend-checks.yml

Repository: constructorfabric/insight

Length of output: 327

---

🏁 Script executed:

# Display the workflow file around the mentioned lines with context
sed -n '55,145p' .github/workflows/backend-checks.yml | cat -n

Repository: constructorfabric/insight

Length of output: 4069

---

🏁 Script executed:

# Display the workflow file around line 139 to verify the third unpinned action
sed -n '135,145p' .github/workflows/backend-checks.yml | cat -n

Repository: constructorfabric/insight

Length of output: 569

---

Pin third-party GitHub Actions to full commit SHAs.

Lines 59, 73, and 139 use floating refs (@cargo-llvm-cov, @v1.3.0), which violates the current policy and weakens supply-chain integrity.

Suggested changes

-      - uses: taiki-e/install-action@cargo-llvm-cov
+      - uses: taiki-e/install-action@<FULL_40_CHAR_COMMIT_SHA>

-      - name: Coverage summary
-        uses: irongut/CodeCoverageSummary@v1.3.0
+      - name: Coverage summary
+        uses: irongut/CodeCoverageSummary@<FULL_40_CHAR_COMMIT_SHA>

-      - name: Coverage summary
-        uses: irongut/CodeCoverageSummary@v1.3.0
+      - name: Coverage summary
+        uses: irongut/CodeCoverageSummary@<FULL_40_CHAR_COMMIT_SHA>

🧰 Tools

🪛 zizmor (1.25.2)

[error] 59-59: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/backend-checks.yml at line 59, The GitHub Actions in the
workflow file use floating version references instead of full commit SHAs, which
violates supply-chain integrity policy. Replace the floating refs for
taiki-e/install-action@cargo-llvm-cov and any other actions pinned to version
tags like `@v1.3.0` with their corresponding full commit SHA hashes. This applies
to all instances across the workflow file where actions use floating refs to
ensure all third-party actions are pinned to immutable commit SHAs.

Source: Linters/SAST tools