ci: add python-core-coverage gate for band-sdk-core-core by AlexanderZ-Band · Pull Request #636 · band-ai/band-sdk-python

AlexanderZ-Band · 2026-09-14T16:55:00Z

Summary

Adds a CI gate proving this repo's real test suite exercises at least 80% of band-sdk-core-core's lines through the PyO3 binding — separate from this SDK's own coverage.py numbers, from band-sdk-core's own Rust-only floor, and from TypeScript/wasm coverage.

.github/workflows/python-core-coverage.yml: checks out this repo, uv sync's it, resolves the pinned band-sdk-core version via importlib.metadata, checks that exact band-sdk-core-core-v{version} tag out as a sibling (never silently tests against band-sdk-core's main, which is already ahead), and runs just coverage-python-consumer ../band-sdk-python from there. Uploads the LCOV/HTML/summary artifact and writes a per-module job summary.
Triggers on PRs to main touching src/**, tests/**, pyproject.toml, or uv.lock, plus merge_group — same shape as this repo's existing ci.yml.

Baseline

84.75% lines, measured against a real checkout at b060ba19 (5593 tests passed, 610 skipped). Full per-module breakdown and the classify_close/classify_upgrade finding are on INT-1304.

No ratchet: all six Python-adoption tickets (INT-1236, INT-1245, INT-1300, INT-1301, INT-1302, INT-1303) are Done and tested, so 80% is achievable today.

Follow-up (repo admin, out of scope here)

Whether this becomes a required status check is a branch-protection setting, not something this PR can set — flagging for whoever owns main's protection rules once this has run green a few times.

Test plan

Companion PR (band-ai/band-sdk-core#71) implements and verifies coverage-python-consumer directly: local dry run against a real band-sdk-python worktree returns 84.75% lines and passes the gate; --fail-under-lines 99 against the same data returns a non-zero exit, confirming the gate is load-bearing.
This workflow itself needs one real PR run to confirm the cross-repo checkout/tag-resolution steps work under actual GitHub Actions (not just the local dry run) — watch this PR's own run.

Companion PR: band-ai/band-sdk-core#71.

Closes INT-1304.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TmtjU5tgPv9Y6bd238JSBL

Resolves the pinned band-sdk-core version from this repo's own dependency lock, checks that exact band-sdk-core-core-v{version} tag out as a sibling, and runs its coverage-python-consumer recipe against this repo's real test suite -- so a PR here fails if it stops exercising a material part of the shared Rust core, not just this SDK's own coverage.py numbers. Companion PR: band-ai/band-sdk-core#71. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TmtjU5tgPv9Y6bd238JSBL

linear-code · 2026-09-14T16:55:03Z

INT-1304

The path-filtered pull_request trigger correctly doesn't fire on a PR that only touches this workflow file itself, so there was no way to run it on demand to verify the cross-repo checkout/tag-resolution steps under real GitHub Actions before merging. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TmtjU5tgPv9Y6bd238JSBL

Temporary -- exists only to fire the path-filtered pull_request event so the new coverage workflow gets one real GitHub Actions run before merge. Removed in a follow-up commit once confirmed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TmtjU5tgPv9Y6bd238JSBL

The default GITHUB_TOKEN is scoped to this repo only, so the sibling checkout of band-ai/band-sdk-core (private) 404'd on a real run. Mirrors release.yml's existing add-band cross-repo checkout: a create-github-app-token step scoped to just this one repository. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TmtjU5tgPv9Y6bd238JSBL

Confirmed via a real run: the workflow's own logic (checkout, version resolution, App-token generation) all succeed. The remaining failure is that the shared GitHub App isn't installed on band-sdk-core yet -- an org-admin action, not something this branch can fix. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TmtjU5tgPv9Y6bd238JSBL

AlexanderZ-Band · 2026-09-14T17:20:23Z

Ran this workflow for real on GitHub Actions. Its own logic (checkout, uv sync, version resolution, App-token generation) all succeeds. It fails at the band-sdk-core checkout step with:

```
Not Found - https://docs.github.com/rest/apps/apps#get-a-repository-installation-for-the-authenticated-app
```

The shared GitHub App behind `APP_CLIENT_ID`/`APP_PRIVATE_KEY` (same one `release.yml` uses for the `add-band` checkout) isn't installed on `band-sdk-core`. Needs an org admin: GitHub org Settings → GitHub Apps → that app → Configure → Repository access → add `band-sdk-core`. No workflow changes needed after that — full details on INT-1304.

AlexanderZ-Band

Automated review (my-code-review): 6 findings — 4 issue, 1 nit, 1 suggestion. See inline comments. (Submitted as COMMENT, not REQUEST_CHANGES: GitHub blocks requesting changes on one's own PR.)

- Reject a pre-release band-sdk-core pin (e.g. a .devN version) before attempting the cross-repo checkout, with a clear message -- dev pre-releases publish to PyPI but are never tagged in git, so the checkout would otherwise fail on a nonexistent ref with a generic git error. - Add tests/test_python_core_coverage_workflow.py asserting the pin step's shape, the checkout ref interpolation, the pre-release guard, and step ordering (mirrors tests/docker/test_kit_publish_workflow.py's existing yaml.BaseLoader pattern). - Add an else branch to the coverage-summary step so a failure before summary.txt exists leaves a diagnostic line in the job summary instead of silently producing nothing. - Extract the duplicated git-HTTPS-auth line into a small composite action (.github/actions/git-https-auth), and set REPORT_DIR once at job level instead of repeating the report path four times. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TmtjU5tgPv9Y6bd238JSBL

AlexanderZ-Band

Cycle 2 of /my-code-review (fixed-criteria pass, second cycle after cycle-1's 6 fixes). 8 new findings: 1 real bug (E, graceful-degradation break when the checkout is skipped), 1 test-quality gap (D), 1 runtime-safety defense-in-depth note (C), 3 style/hygiene (A), 2 design/reuse (B). Logical Bugs (F) re-verified guard polarity, the injection surface, and multi-line -c argument passing empirically and found nothing further. (Submitted as COMMENT, not REQUEST_CHANGES: GitHub blocks requesting changes on one's own PR.)

- Guard "Write coverage summary" against a missing band-sdk-core/ checkout: drop its working-directory (which fails the step outright when absent) and reference the path directly, so the graceful fallback message still reaches the job summary instead of erroring. - Pass the resolved version to the pre-release guard via the environment instead of bash-splicing it into the embedded Python three times, removing the (currently unreachable, but unenforced) literal-injection surface. - Hoist the "band-sdk-core-core-v" tag prefix into a job-level env var, single-sourced between the guard's error message and the checkout ref. - Declare packaging as an explicit dev dependency (was only present transitively) since the guard depends on it directly. - Extend the workflow's structural tests: execute the real guard script via subprocess against stable/dev version strings instead of only checking for substrings, and cover the new env-var single sources of truth and the working-directory fix. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TmtjU5tgPv9Y6bd238JSBL

AlexanderZ-Band and others added 4 commits September 14, 2026 20:16

AlexanderZ-Band commented Sep 14, 2026

View reviewed changes

AlexanderZ-Band and others added 2 commits September 14, 2026 21:10

fix: run coverage guard test with Git Bash on Windows

f4ed698

AlexanderZ-Band requested review from a team, amit-gazal-band, bandzalkin and nir-singher-band and removed request for amit-gazal-band, bandzalkin and nir-singher-band September 15, 2026 11:33

AlexanderZ-Band added 9 commits September 15, 2026 16:22

fix: use scoped key for Core coverage checkout

a7651e2

fix: bump Core coverage dependency

a0bf60c

ci: report weekly Core coverage

ea8b00e

fix: skip cancelled weekly coverage reports

b66931b

ci: report manual Core coverage runs

50e859d

ci: clarify Core coverage digests

3ef1a51

chore: schedule Core coverage for Sunday night

f9f24d8

ci: improve Core coverage email layout

f778a0a

style: format Core coverage report files

5b17eb1

Navigation Menu

Uh oh!

ci: add python-core-coverage gate for band-sdk-core-core - #636

ci: add python-core-coverage gate for band-sdk-core-core#636
AlexanderZ-Band wants to merge 17 commits into
mainfrom
int-1304-add-80-band-sdk-core-coverage-gate-from-band-sdk-python

AlexanderZ-Band commented Sep 14, 2026

Uh oh!

linear-code Bot commented Sep 14, 2026

Uh oh!

AlexanderZ-Band commented Sep 14, 2026

Uh oh!

AlexanderZ-Band left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

AlexanderZ-Band left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

AlexanderZ-Band commented Sep 14, 2026

Summary

Baseline

Follow-up (repo admin, out of scope here)

Test plan

Uh oh!

linear-code Bot commented Sep 14, 2026

Uh oh!

AlexanderZ-Band commented Sep 14, 2026

Uh oh!

AlexanderZ-Band left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

AlexanderZ-Band left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant