feat(build/pipelines): add go/covdata pipeline

[maxgio92]

It produces a statements by functions based-coverage percentage report via the go tool covdata, leveraging coverage data generated during functional tests run using a go binary built with coverage instrumentation using the -cover build flag.

It requires:

• the test pipeline to have GOCOVERDIR environment variable set to match the go/covdata's cover-dir input (defaulted to /home/build).
• the binary to be built with -cover build flag.

For instance:

# crane.yaml
...
subpackages:
  - name: ${{package.name}}-cover
    pipeline:
      - uses: go/build
        with:
          packages: ./cmd/crane
          extra-args: -cover
          ldflags: -buildid= -X github.com/google/go-containerregistry/cmd/crane/cmd.Version=${{package.version}} -X github.com/google/go-containerregistry/pkg/v1/remote/transport.Version=${{package.version}}
          output: crane
    test:
      environment:
        contents:
          packages:
            - jq
        environment:
          GOCOVERDIR: /home/build
      pipeline:
        - name: Verify Crane installation
          runs: |
            crane version || exit 1
            crane --help
        - name: Fetch and verify manifest
          runs: |
            crane manifest chainguard/static | jq '.schemaVersion' | grep '2' || exit 1
        - name: List tags for a public image
          runs: |
            crane ls chainguard/static | grep -E 'latest|v[0-9]+.[0-9]+.[0-9]+' || exit 1
        - name: Validate image existence
          runs: |
            crane digest chainguard/static:latest && echo "Image exists" || exit 1
        - name: Pull and save an image locally
          runs: |
            crane pull chainguard/static:latest static_latest.tar || exit 1
            [ -f static_latest.tar ] || exit 1
        - uses: go/covdata

$ make test/crane
...
2025/02/27 19:23:10 INFO Statements coverage: 14.2%

This data can be used as it is or coverage data files be further extracted for processing.

[joshrwolf]

I guess it kinda sucks that:

        environment:
          GOCOVERDIR: /home/build

can't be defined via the pipeline, perhaps we can add to the docs that this is required to be set before the tests (as you've done in the sample via the environment contents), and that it must match what is set into the pipeline, if it differs from /home/build

^ doesn't need to happen this PR though!

[maxgio92]

Yeah @joshrwolf. At least when you run the binary if it's not set the warning is printed every time you executed as it's instrumented and it expects it to write cov data to somewhere.

Anyway it's documented here: https://github.com/chainguard-dev/melange/pull/1821/files#diff-bb78a791d5667a268875ef41c994590b3188c3f9308f7a5a76bfce450026ace6R62

and with #1699 it will ensured it'll be always up to date.