Enforcing Test Coverage Thresholds with SonarQube and Codecov

pytest --cov=src --cov-report=xml:coverage.xml

jest --coverage --coverageReporters=lcov

<!-- pom.xml -->
<plugin>
  <groupId>org.jacoco</groupId>
  <artifactId>jacoco-maven-plugin</artifactId>
  <executions>
    <execution>
      <goals>
        <goal>prepare-agent</goal>
      </goals>
    </execution>
    <execution>
      <id>report</id>
      <phase>test</phase>
      <goals>
        <goal>report</goal>
      </goals>
    </execution>
  </executions>
</plugin>

<!-- Report path in sonar-project.properties -->
sonar.coverage.jacoco.xmlReportPaths=target/site/jacoco/jacoco.xml

dotnet test --collect:<span class="hljs-string">"XPlat Code Coverage" -- DataCollectionRunSettings.DataCollectors.DataCollector.Configuration.Format=cobertura

sonar.cs.opencover.reportsPaths=**/TestResults/**/*.xml

Condition: Coverage on new code
Operator: is less than
Value: 80%

Coverage (overall): is less than 50%          // Baseline floor
New Bugs: is greater than 0                   // Zero new bugs policy
New Vulnerabilities: is greater than 0        // Zero new vulnerabilities
New Code Smells (BLOCKER): is greater than 0  // Block blockers only

- name: SonarQube Quality Gate check
  uses: SonarSource/sonarqube-quality-gate-action@master
  timeout-minutes: 5
  env:
    SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
    SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}

Quality Gate FAILED
- Coverage on new code: 58.3% (required ≥ 80%)

# .github/workflows/test.yml
- name: Run tests
  run: pytest --cov=src --cov-report=xml:coverage.xml

- name: Upload coverage to Codecov
  uses: codecov/codecov-action@v4
  with:
    token: ${{ secrets.CODECOV_TOKEN }}
    files: coverage.xml
    flags: unittests
    fail_ci_if_error: true

# codecov.yml (repo root)
coverage:
  # Overall coverage targets
  status:
    project:
      default:
        # Fail if overall coverage drops by more than 1%
        threshold: 1%
        target: 75%    # Must be at or above 75%
        
    # Patch coverage: only changed files
    patch:
      default:
        # Fail if new lines are less than 70% covered
        target: 70%
        threshold: 0%  # No tolerance — new code must meet the target

comment:
  layout: "reach, diff, flags, files"
  behavior: default
  require_changes: false  # Post comment even when coverage doesn't change
  
ignore:
  - "tests/**"
  - "migrations/**"
  - "**/__init__.py"
  - "conftest.py"

# codecov.yml
flags:
  unit:
    paths:
      - src/
    after_n_builds: 1
    
  integration:
    paths:
      - src/
    after_n_builds: 1

coverage:
  status:
    project:
      unit:
        target: 80%
        flags:
          - unit
      integration:
        target: 60%  # Integration tests cover less per line
        flags:
          - integration

- name: Upload unit coverage
  uses: codecov/codecov-action@v4
  with:
    files: unit-coverage.xml
    flags: unit

- name: Upload integration coverage
  uses: codecov/codecov-action@v4
  with:
    files: integration-coverage.xml
    flags: integration

# Month 1: Start with current coverage (say 45%)
target: 45%

# Month 2: Raise by 5%
target: 50%

# Month 3
target: 55%

# Continue quarterly until you reach your target
target: 80%

# scripts/update-coverage-target.py
import json
import yaml

# Read current coverage
with open('coverage/coverage-summary.json') as f:
    summary = json.load(f)
current = summary['total']['lines']['pct']

# Read codecov.yml
with open('codecov.yml') as f:
    config = yaml.safe_load(f)

# Ratchet up by 5%, cap at 85%
new_target = min(85.0, current + 5.0)
config['coverage']['status']['project']['default']['target'] = f"{new_target:.0f}%"

with open('codecov.yml', 'w') as f:
    yaml.dump(config, f)

print(f"Coverage target updated: {current:.1f}% → {new_target:.0f}%")

# codecov.yml
ignore:
  - "migrations/**"
  - "scripts/**"
  - "**/__main__.py"
  - "**/conftest.py"
  - "tests/**"          # Test files themselves
  - "**/*.generated.*"  # Generated code

# sonar-project.properties
sonar.exclusions=**/migrations/**,**/generated/**
sonar.coverage.exclusions=**/config/**,**/scripts/**,**/cli/**

## Coverage Report

| Files Changed | Coverage |
|---|---|
| src/auth/processor.py | 85% ✅ |
| src/payments/gateway.py | 62% ⚠️ |

Overall: 73.2% (↓ 0.8% from main)
Patch: 74.1% ✅ (target: 70%)

## Quality Gate: ❌ FAILED

- Coverage on new code: 62% (required ≥ 80%)
- src/payments/gateway.py: Only 12/30 new lines covered

# Code that's explicitly excluded from coverage requirements
# reason: AWS Lambda handler — tested via integration tests, not unit tests
def lambda_handler(event, context):  # pragma: no cover
    return process_event(event)

/* istanbul ignore next */
function devOnlyHelper() {
  // Only used in development, not in production code paths
}