Add test coverage tooling, real tests, and Codecov reporting

.github/workflows/ci.yml

@@ -11,51 +11,95 @@ on:
 env:
   NODE_VERSION: 22.x
 
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}
+
+permissions:
+  contents: read
+
 jobs:
-  build:
+  test:
+    name: Lint, Test & Coverage
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
+    - name: Checkout
+      uses: actions/checkout@v4
 
-    - name: Setup Node.js ${{ env.NODE_VERSION }}
-      uses: actions/setup-node@v2
+    - name: Setup pnpm
+      uses: pnpm/action-setup@v4
       with:
-        node-version: ${{ env.NODE_VERSION }}
+        version: 11
 
-    - name: Setup pnpm
-      uses: pnpm/action-setup@v2.0.1
+    - name: Setup Node.js ${{ env.NODE_VERSION }}
+      uses: actions/setup-node@v4
       with:
-        version: latest
+        node-version: ${{ env.NODE_VERSION }}
+        cache: pnpm
 
     - name: Install Dependencies
-      run: pnpm install
+      run: pnpm install --frozen-lockfile
 
     - name: Lint
       run: pnpm run lint
 
     - name: Build
       run: pnpm run build
 
+    - name: Coverage gate self-tests
+      run: node --test scripts/check-coverage.test.mjs
+
+    - name: Test with coverage (full suite)
+      run: pnpm run coverage
+
+    # Uploaded before the gate, and regardless of whether the suite passed, so
+    # Codecov still receives a report from a run with failing tests. A missing or
+    # unreadable report is a real problem and still fails the job.
+    - name: Upload coverage to Codecov
+      if: '!cancelled()'
+      uses: codecov/codecov-action@v5
+      with:
+        files: coverage/lcov.info
+        flags: ember-core
+        fail_ci_if_error: true
+        token: ${{ secrets.CODECOV_TOKEN }}
+
+    # Kept so the raw report can be pulled down with `gh run download` and read
+    # for exactly which statements are uncovered. The gate output only gives a
+    # per-file percentage, which is not enough to aim at a specific branch.
+    - name: Upload coverage report
+      if: '!cancelled()'
+      uses: actions/upload-artifact@v4
+      with:
+        name: coverage-report
+        path: coverage/
+        retention-days: 7
+
+    - name: Enforce 100% coverage gate
+      run: pnpm run coverage:check
+
   npm_publish:
-    needs: build
+    needs: test
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/')
     steps:
-    - uses: actions/checkout@v2
+    - name: Checkout
+      uses: actions/checkout@v4
 
-    - name: Setup Node.js ${{ env.NODE_VERSION }}
-      uses: actions/setup-node@v2
+    - name: Setup pnpm
+      uses: pnpm/action-setup@v4
       with:
-        node-version: ${{ env.NODE_VERSION }}
+        version: 11
 
-    - name: Setup pnpm
-      uses: pnpm/action-setup@v2.0.1
+    - name: Setup Node.js ${{ env.NODE_VERSION }}
+      uses: actions/setup-node@v4
       with:
-        version: latest
+        node-version: ${{ env.NODE_VERSION }}
+        cache: pnpm
 
     - name: Install Dependencies
-      run: pnpm install
+      run: pnpm install --frozen-lockfile
 
     - name: Build
       run: pnpm run build
@@ -67,24 +111,29 @@ jobs:
       run: npm publish --access public
 
   github_publish:
-    needs: build
+    needs: test
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/')
+    permissions:
+      contents: read
+      packages: write
     steps:
-      - uses: actions/checkout@v2
+      - name: Checkout
+        uses: actions/checkout@v4
 
-      - name: Setup Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@v2
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
         with:
-          node-version: ${{ env.NODE_VERSION }}
+          version: 11
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v2.0.1
+      - name: Setup Node.js ${{ env.NODE_VERSION }}
+        uses: actions/setup-node@v4
         with:
-          version: latest
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
 
       - name: Install Dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Build
         run: pnpm run build