feat: codecov override with merge squash hash

.github/actions/codecov-merge-upload/action.yml

@@ -0,0 +1,53 @@
+name: 'Codecov Download and Upload'
+description: 'Download coverage artifact from previous PR run and upload to Codecov'
+
+inputs:
+  artifact-name:
+    description: 'Name of the coverage artifact'
+    required: false
+    default: 'pr-build'
+  coverage-path:
+    description: 'Path to coverage files'
+    required: true
+  workflow-path:
+    description: 'Path to workflow file for artifact lookup'
+    required: true
+  override-commit:
+    description: 'Commit SHA to override in Codecov'
+    required: true
+  codecov-token:
+    description: 'Codecov token for uploading'
+    required: true
+  github-token:
+    description: 'GitHub token for artifact operations'
+    required: true
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Find latest successful PR run for this commit
+      id: find-run
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ inputs.github-token }}
+        REPO: ${{ github.repository }}
+        HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        CURRENT_RUN_ID: ${{ github.run_id }}
+        ARTIFACT_NAME: ${{ inputs.artifact-name }}
+        WORKFLOW_PATH: ${{ inputs.workflow-path }}
+      run: ./.github/scripts/find-codecov-artifact.sh
+
+    - name: Download coverage artifact from previous run
+      uses: actions/download-artifact@v4
+      with:
+        name: ${{ inputs.artifact-name }}
+        run-id: ${{ steps.find-run.outputs.run_id }}
+        github-token: ${{ inputs.github-token }}
+        path: ${{ inputs.coverage-path }}
+
+    - name: Upload results to Codecov
+      uses: codecov/codecov-action@v5
+      with:
+        token: ${{ inputs.codecov-token }}
+        override_commit: ${{ inputs.override-commit }}
+

.github/actions/codecov-upload-pr/action.yml

@@ -0,0 +1,35 @@
+name: 'Codecov Upload PR'
+description: 'Upload coverage artifacts during PR and send to Codecov'
+
+inputs:
+  artifact-name:
+    description: 'Name of the coverage artifact'
+    required: false
+    default: 'pr-build'
+  coverage-path:
+    description: 'Path to coverage files'
+    required: true
+  retention-days:
+    description: 'Days to retain the artifact'
+    required: false
+    default: '7'
+  codecov-token:
+    description: 'Codecov token for uploading'
+    required: true
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Upload artifact for PR
+      uses: actions/upload-artifact@v4
+      with:
+        overwrite: true
+        name: ${{ inputs.artifact-name }}
+        path: ${{ inputs.coverage-path }}
+        retention-days: ${{ inputs.retention-days }}
+
+    - name: Upload results to Codecov
+      uses: codecov/codecov-action@v5
+      with:
+        token: ${{ inputs.codecov-token }}
+

.github/scripts/find-codecov-artifact.sh

@@ -0,0 +1,78 @@
+#!/bin/bash
+
+# This script finds the latest successful workflow run artifact for a PR commit.
+# 
+# Required environment variables:
+#   REPO: GitHub repository (e.g., owner/repo)
+#   HEAD_SHA: The PR head commit SHA
+#   CURRENT_RUN_ID: The current workflow run ID
+#   ARTIFACT_NAME: Name of the artifact to find
+#   WORKFLOW_PATH: Path to the workflow file to filter by
+#   GITHUB_TOKEN: Required for API authentication
+#
+# Outputs (to $GITHUB_OUTPUT):
+#   run_id: The workflow run ID containing the artifact
+#   artifact_id: The artifact ID
+
+REPO="${REPO:?REPO environment variable is required}"
+HEAD_SHA="${HEAD_SHA:?HEAD_SHA environment variable is required}"
+CURRENT_RUN_ID="${CURRENT_RUN_ID:?CURRENT_RUN_ID environment variable is required}"
+ARTIFACT_NAME="${ARTIFACT_NAME:?ARTIFACT_NAME environment variable is required}"
+WORKFLOW_PATH="${WORKFLOW_PATH:?WORKFLOW_PATH environment variable is required}"
+
+echo "Head SHA: $HEAD_SHA"
+echo "Current run id: $CURRENT_RUN_ID"
+
+# Get all PR runs for this commit (since its runs per Sha 500 should be enough for now)
+json=$(curl -s \
+  -H "Authorization: Bearer $GITHUB_TOKEN" \
+  -H "Accept: application/vnd.github+json" \
+  "https://api.github.com/repos/$REPO/actions/runs?head_sha=$HEAD_SHA&event=pull_request&per_page=500")
+
+# Pick the latest *completed & successful* run that is NOT this run
+run_id=$(echo "$json" | jq -r --arg cur "$CURRENT_RUN_ID" --arg workflow "$WORKFLOW_PATH" '
+  .workflow_runs
+  | map(select(
+    .id != ($cur|tonumber)
+    and .status == "completed"
+    and .conclusion == "success"
+    and .path == $workflow
+  ))
+  | sort_by(.created_at)
+  | last
+  | .id
+')
+
+if [ -z "$run_id" ] || [ "$run_id" = "null" ]; then
+  echo "No previous successful PR run found for $HEAD_SHA" >&2
+  exit 1
+fi
+
+echo "Using run id: $run_id"
+
+# Get artifacts for that run
+artifacts_json=$(curl -s \
+  -H "Authorization: Bearer $GITHUB_TOKEN" \
+  -H "Accept: application/vnd.github+json" \
+  "https://api.github.com/repos/$REPO/actions/runs/$run_id/artifacts")
+
+# Find the artifact ID for the desired artifact name
+artifact_id=$(echo "$artifacts_json" | jq -r --arg name "$ARTIFACT_NAME" '
+  .artifacts
+  | map(select(.name == $name and .expired == false))
+  | sort_by(.created_at)
+  | last
+  | .id
+')
+
+if [ -z "$artifact_id" ] || [ "$artifact_id" = "null" ]; then
+  echo "No non-expired artifact named '$ARTIFACT_NAME' found for run $run_id" >&2
+  echo "Artifacts JSON for debugging:" >&2
+  echo "$artifacts_json" >&2
+  exit 1
+fi
+
+echo "Using artifact id: $artifact_id"
+
+echo "run_id=$run_id" >> "$GITHUB_OUTPUT"
+echo "artifact_id=$artifact_id" >> "$GITHUB_OUTPUT"

.github/workflows/cli-ci.yaml

@@ -54,10 +54,15 @@ jobs:
       - name: Get Coverage
         run: pnpm run --filter wgc coverage
 
-      - name: Upload results to Codecov
-        uses: codecov/codecov-action@v5
+      - name: Upload coverage to Codecov
+        uses: ./.github/actions/codecov-upload-pr
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          artifact-name: pr-build
+          coverage-path: |
+            cli/coverage/clover.xml
+            cli/coverage/coverage-final.json
+          retention-days: 7
+          codecov-token: ${{ secrets.CODECOV_TOKEN }}
 
   build_test_node_matrix:
     timeout-minutes: 10
@@ -115,3 +120,28 @@ jobs:
       - name: 'Some tests failed'
         if: ${{ contains(needs.*.result, 'failure') }}
         run: exit 1
+
+  post-merge:
+    if: >
+      github.event_name == 'pull_request' &&
+      github.event.action == 'closed' &&
+      github.event.pull_request.merged == false
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
+
+      - name: Print merge commit SHA
+        run: |
+          echo "Merge commit SHA: ${{ github.event.pull_request.merge_commit_sha }}"
+
+      - name: Download computed artifact and upload to codecov with merge SHA
+        uses: ./.github/actions/codecov-merge-upload
+        with:
+          artifact-name: pr-build
+          coverage-path: cli/coverage
+          workflow-path: .github/workflows/cli-ci.yaml
+          override-commit: ${{ github.event.pull_request.merge_commit_sha }}
+          codecov-token: ${{ secrets.CODECOV_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}