Add code coverage

[kartikjoshi21]

Add Go coverage reporting to CI (end-to-end)

This PR adds automated Go coverage reporting to the CI pipeline.

• Unit and integration tests now generate coverage profiles (one per integration matrix suite).
• It also collects coverage for the Dalec BuildKit frontend by building it with coverage enabled and exporting its covdata during solves.
• A new coverage-report job downloads all profiles, merges them, and uploads a combined report (including an index.html coverage page) as a workflow artifact, plus a summary in the Actions run.

Fixes: #889

[Copilot]

Pull request overview

This PR adds comprehensive code coverage tracking to the CI workflow to support OpenSSF Silver Badge requirements. It instruments both unit and integration tests to collect coverage data, merges the profiles, and generates coverage reports that are displayed in GitHub's step summary.

Changes:

• Modified integration tests to collect coverage data with -covermode=atomic -coverpkg=./... flags
• Modified unit tests to collect coverage data, excluding the /test directory packages
• Added new coverage-report job that merges all coverage profiles and generates summary reports

[Copilot]

Missing version comment for the download-artifact action. All other action uses in this workflow include version comments (e.g., # v6.0.0). Please add a version comment to maintain consistency with the established convention in this file.

Suggested change

	uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
	with:
	name: coverage-unit
	path: coverage
	- name: Download integration coverage artifacts
	uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
	uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # download-artifact pinned SHA
	with:
	name: coverage-unit
	path: coverage
	- name: Download integration coverage artifacts
	uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # download-artifact pinned SHA

[Copilot]

Missing version comment for the download-artifact action. All other action uses in this workflow include version comments (e.g., # v6.0.0). Please add a version comment to maintain consistency with the established convention in this file.

Suggested change

	uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
	with:
	name: coverage-unit
	path: coverage
	- name: Download integration coverage artifacts
	uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
	uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.1.8
	with:
	name: coverage-unit
	path: coverage
	- name: Download integration coverage artifacts
	uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.1.8

[Copilot]

The coverage-report job will not run if either the unit or integration jobs fail, even though those jobs use if: always() to upload coverage artifacts on failure. This means coverage reports won't be generated when tests fail. Consider adding if: always() to the coverage-report job (or using a more specific condition like if: success() || failure()) to ensure coverage reports are generated even when tests fail, which would be valuable for understanding coverage gaps in failing test scenarios.

Suggested change

	- integration
	- integration
	if: ${{ always() }}

[Copilot]

The unquoted variable expansion ${integration_profiles} could potentially cause issues with shell word splitting if any filenames contain spaces or special characters. While the current suite names don't contain spaces, it's a best practice to use an array or quote the variable to make the script more robust. Consider using a bash array: integration_profiles=($(find...)) and then "${integration_profiles[@]}" in the gocovmerge command.

[cpuguy83]

@kartikjoshi21 CI didn't run on this because there was temporarily a conflict (commit is now reverted so no conflict).
Can you rebase to trigger CI?

[kartikjoshi21]

@kartikjoshi21 CI didn't run on this because there was temporarily a conflict (commit is now reverted so no conflict). Can you rebase to trigger CI?

@cpuguy83 Updated the PR, Thanks

[cpuguy83]

Comment from GPT-5.5:

I think frontend coverage is currently being converted with metadata but no counters.

Evidence:

• go tool covdata discovers counter files by filename pattern. Go 1.25 defines counter files as covcounters.<hash>.<pid>.<timestamp> via CounterFileTempl = "%s.%x.%d.%d" and CounterFileRegexp = ^%s.(\S+).(\d+).(\d+)+$`:
  https://github.com/golang/go/blob/go1.25.8/src/internal/coverage/defs.go#L335-L341
• The covdata pod collector scans filenames with that anchored regex and only associates matching counter files with matching covmeta.<hash> files:
  https://github.com/golang/go/blob/go1.25.8/src/internal/coverage/pods/pods.go#L121-L160
• Go's own runtime counter writer uses the same covcounters.<hash>.<pid>.<timestamp> template:
  https://github.com/golang/go/blob/go1.25.8/src/internal/coverage/cfile/emit.go#L365-L371

This PR writes counter files as covcounters.<hash>.<pid>.<timestamp>.<random> in test/testenv/frontend_coverage.go, so they do not match the anchored Go regex and are ignored by go tool covdata textfmt.

That matches the latest CI artifacts: all 14 frontend-*.out profiles are present, but each has 0 covered statements (covered=0, total=6835, pct=0.00). So the frontend profiles are currently contributing denominator, but no executed frontend coverage.

Suggested fix: write counter files using exactly covcounters.<hash>.<pid>.<timestamp> and add an assertion that go tool covdata textfmt produces at least one non-zero frontend coverage block, rather than only checking that covmeta.* / covcounters.* files exist.