From 1d6c059ec60c44b72f29a34ac1eb1545bbd21c2e Mon Sep 17 00:00:00 2001
From: Alexis Cruveiller <alexis@carbonfact.com>
Date: Fri, 31 Jul 2026 18:09:23 +0200
Subject: [PATCH] ci(codecov): hold coverage statuses until both uploads land

Coverage arrives in two uploads from two independent jobs: the backend suite
(--cov=app, ~3100 lines) and the client suite (--cov=pyroclient, ~135 lines).
With no codecov.yml in the repo the project status was evaluated on the first
upload to arrive, so whenever the client job finished first the check compared a
3-file report against the full base, reported a ~2.5% project drop and failed the
PR, then silently recovered once the backend upload landed.

That produced four spurious failures across two PRs in a day, each resolving on
its own within minutes, which trains reviewers to ignore a red check.

notify.after_n_builds holds statuses and the PR comment until both uploads are
in, so they are only ever computed on a complete report. Both upload steps now
carry a flag so each job's contribution is identifiable and a genuinely missing
upload shows up as such rather than silently lowering the total. The project
status also gets a 0.5% threshold so small unavoidable swings do not block.

Validated against https://codecov.io/validate ("Valid!"); note after_n_builds is
only accepted under codecov.notify, not per status.
---
 .github/workflows/tests.yml |  2 ++
 codecov.yml                 | 31 +++++++++++++++++++++++++++++++
 2 files changed, 33 insertions(+)
 create mode 100644 codecov.yml

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 60b1ac5e..bd9d3f0b 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -51,6 +51,7 @@ jobs:
         uses: codecov/codecov-action@v7
         with:
           files: ./coverage-src.xml
+          flags: backend
           token: ${{ secrets.CODECOV_TOKEN }}
           fail_ci_if_error: true
 
@@ -81,6 +82,7 @@ jobs:
         uses: codecov/codecov-action@v7
         with:
           files: ./coverage.xml
+          flags: client
           token: ${{ secrets.CODECOV_TOKEN }}
           fail_ci_if_error: true
 
diff --git a/codecov.yml b/codecov.yml
new file mode 100644
index 00000000..84341bda
--- /dev/null
+++ b/codecov.yml
@@ -0,0 +1,31 @@
+# Coverage arrives in two uploads from two independent jobs: the backend suite (--cov=app,
+# ~3100 lines) and the client suite (--cov=pyroclient, ~135 lines). Without this config the
+# project status is evaluated as soon as the first upload lands, so whenever the client job
+# finishes first the check compares a 3-file report against the full base, reports a ~2.5%
+# project drop and fails the PR, then silently recovers once the backend upload arrives.
+#
+# notify.after_n_builds holds every status and the PR comment until both uploads are in, so they
+# are only ever computed on a complete report. The flags exist so each job's contribution is
+# identifiable in the Codecov UI, and so a missing upload shows up as such instead of silently
+# lowering the total.
+codecov:
+  notify:
+    after_n_builds: 2
+
+coverage:
+  status:
+    project:
+      default:
+        # Small unavoidable swings (a refactor moving covered lines around) should not block.
+        threshold: 0.5%
+
+comment:
+  after_n_builds: 2
+
+flags:
+  backend:
+    paths:
+      - src/app/
+  client:
+    paths:
+      - client/pyroclient/