ci: publish Go coverage badge + GitHub Code Quality PR comments (#133)

[EricAndrechek]

Summary

Resolves #133 — coverage publishing now the repo is public. Self-hosted, no third-party SaaS (chosen over Codecov/Coveralls for supply-chain posture, Codecov's ownership churn, and the "two official numbers" problem — full rationale in the issue thread). The coverage gate is unchanged: make cov's thresholds in .testcoverage.yml stay the only merge gate. Everything here is publishing and is non-gating.

1. Go coverage README badge (self-hosted)

• New cov badge subcommand (scripts/cov/main.go) emits a shields.io endpoint JSON for the merged Go total using the exact number the gate computes (same .testcoverage.yml excludes) — the badge can never disagree with the gate.
• A new non-gating badge job (main-push only, the sole holder of contents:write, off a trusted-main checkout) publishes it to an orphan badges branch via scripts/ci/publish-badge.sh. The README reads it over raw.githubusercontent.com.

2. PR drop comments (GitHub Code Quality — native/first-party)

• The coverage job converts the merged Go profile to Cobertura (go tool gocover-cobertura, a new pinned tool dep; -ignore-dirs mirrors the YAML's global excludes) and uploads via actions/upload-code-coverage (code-quality: write). The github-code-quality[bot] posts the aggregate + per-file diff-vs-main comment.
• continue-on-error, so this public-preview feature can never red CI. Fork PRs skip it (no code-quality token, per GitHub's own guard). Code Quality is enabled on the repo (Settings → Code quality).

Notes

• Cold start: the first main run after merge seeds the badge (creates the badges branch) and the Code Quality baseline; PRs opened after that get the bot comment.
• actionlint doesn't recognize the preview code-quality scope yet → suppressed narrowly in .github/actionlint.yaml (a genuine scope typo still fails).
• SDK/TS coverage stays gated but isn't published yet — a small follow-up (language: javascript upload + a second badge JSON).

Validation

• Local make ci green (all Go suites + merged + ts-total gates).
• actionlint / shellcheck / markdownlint / golangci / misspell / go build / go mod tidy clean.
• scripts/ci/publish-badge.sh simulated end-to-end against a bare remote (orphan-create → no-op-on-unchanged → fast-forward-update; caught + fixed a macOS install -D portability bug before it could bite CI).
• Pre-push reviewers (code + docs) → ship_it.
• ⚠️ Only a live run can prove the actual Code Quality upload + bot comment + badge render — I'll watch the first runs after merge.

Closes #133.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@EricAndrechek, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 9 minutes and 54 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ebcef0df-a13a-45a2-a23f-5a381cc55ea4

📥 Commits

Reviewing files that changed from the base of the PR and between 74b2c81 and 0bf1c2f.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (11)

• .github/actionlint.yaml
• .github/workflows/README.md
• .github/workflows/ci.yml
• .testcoverage.yml
• AGENTS.md
• CHANGELOG.md
• README.md
• docs/src/content/docs/development.md
• go.mod
• scripts/ci/publish-badge.sh
• scripts/cov/main.go

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch code-cov

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch code-cov

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

📚 Docs preview is live → https://a6ae2994-wavehouse-docs.wave-rf.workers.dev

• Commit — 0bf1c2f: ci: publish Go coverage badge + GitHub Code Quality PR comments (tracking: re-evaluate coverage reporting / badge after OSS launch #133)
• Author — @EricAndrechek, Claude Opus 4.8 (1M context)
• Committed — 2026-06-10 18:31 (UTC-04:00)
• Deployed — 2026-06-10 18:42 EDT

[github-code-quality]

Code Coverage Overview

Languages: Go

Go

The overall coverage in the code-cov branch is 89%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	code-cov 0bf1c2f	+/-
internal/api/router.go	—	99%	—
internal/policy/policy.go	—	98%	—
internal/discov...ry/discovery.go	—	98%	—
internal/api/ingest.go	—	96%	—
internal/ingest/worker.go	—	95%	—
internal/query/builder.go	—	95%	—
internal/api/query.go	—	89%	—
internal/pipes/pipes.go	—	84%	—
internal/api/cl...ckhouse_exec.go	—	82%	—
cmd/wavehouse/main.go	—	68%	—

---

_{Updated June 10, 2026 22:43 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}