Use undercover to enforce changes in MR has coverage

.gitlab/ci/rails.gitlab-ci.yml

@@ -519,10 +519,26 @@ rspec:coverage:
     paths:
       - coverage/index.html
       - coverage/assets/
+      - coverage/lcov/
       - tmp/memory_test/
     reports:
       cobertura: coverage/coverage.xml
 
+rspec:undercoverage:
+  extends:
+    - .coverage-base
+    - .rails:rules:rspec-undercoverage
+  stage: post-test
+  needs: ["rspec:coverage"]
+  script:
+    - if [ -n "$CI_MERGE_REQUEST_SOURCE_BRANCH_SHA" ]; then
+        echo "Checking out \$CI_MERGE_REQUEST_SOURCE_BRANCH_SHA ($CI_MERGE_REQUEST_SOURCE_BRANCH_SHA) instead of \$CI_COMMIT_SHA (merge result commit $CI_COMMIT_SHA) so we can use $CI_MERGE_REQUEST_DIFF_BASE_SHA for undercoverage in this merged result pipeline";
+        git checkout -f ${CI_MERGE_REQUEST_SOURCE_BRANCH_SHA};
+      else
+        echo "Using \$CI_COMMIT_SHA ($CI_COMMIT_SHA) for this non-merge result pipeline.";
+      fi;
+    - run_timed_command "scripts/undercoverage"
+
 rspec:feature-flags:
   extends:
     - .coverage-base

.gitlab/ci/rules.gitlab-ci.yml

@@ -67,6 +67,9 @@
 .if-merge-request-labels-run-review-app: &if-merge-request-labels-run-review-app
   if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-review-app/'
 
+.if-merge-request-labels-skip-undercoverage: &if-merge-request-labels-skip-undercoverage
+  if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:skip-undercoverage/'
+
 .if-security-merge-request: &if-security-merge-request
   if: '$CI_PROJECT_NAMESPACE == "gitlab-org/security" && $CI_MERGE_REQUEST_IID'
 
@@ -1359,6 +1362,16 @@
     - <<: *if-merge-request-labels-run-all-rspec
       when: always
 
+.rails:rules:rspec-undercoverage:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-merge-request-labels-skip-undercoverage
+      allow_failure: true
+    - <<: *if-merge-request-labels-run-all-rspec
+    - <<: *if-merge-request-approved
+    - changes: *backend-patterns
+
 .rails:rules:default-branch-schedule-nightly--code-backstage:
   rules:
     - <<: *if-default-branch-schedule-nightly

Gemfile

@@ -405,7 +405,9 @@ end
 
 group :development, :test, :coverage do
   gem 'simplecov', '~> 0.18.5', require: false
+  gem 'simplecov-lcov', '~> 0.8.0', require: false
   gem 'simplecov-cobertura', '~> 1.3.1', require: false
+  gem 'undercover', '~> 0.4.4', require: false
 end
 
 # Gems required in omnibus-gitlab pipeline

Gemfile.lock

@@ -645,6 +645,8 @@ GEM
       concurrent-ruby (~> 1.0)
     i18n_data (0.8.0)
     icalendar (2.4.1)
+    imagen (0.1.8)
+      parser (>= 2.5, != 2.5.1.1)
     invisible_captcha (1.1.0)
       rails (>= 4.2)
     ipaddress (0.8.3)
@@ -1197,6 +1199,7 @@ GEM
     simplecov-cobertura (1.3.1)
       simplecov (~> 0.8)
     simplecov-html (0.12.3)
+    simplecov-lcov (0.8.0)
     sixarm_ruby_unaccent (1.2.0)
     slack-messenger (2.3.4)
     snowplow-tracker (0.6.1)
@@ -1312,6 +1315,10 @@ GEM
       concurrent-ruby (~> 1.0)
     u2f (0.2.1)
     uber (0.1.0)
+    undercover (0.4.4)
+      imagen (>= 0.1.8)
+      rainbow (>= 2.1, < 4.0)
+      rugged (>= 0.27, < 1.3)
     unf (0.1.4)
       unf_ext
     unf_ext (0.0.7.7)
@@ -1626,6 +1633,7 @@ DEPENDENCIES
   simple_po_parser (~> 1.1.2)
   simplecov (~> 0.18.5)
   simplecov-cobertura (~> 1.3.1)
+  simplecov-lcov (~> 0.8.0)
   slack-messenger (~> 2.3.4)
   snowplow-tracker (~> 0.6.1)
   solargraph (~> 0.43)
@@ -1648,6 +1656,7 @@ DEPENDENCIES
   toml-rb (~> 2.0)
   truncato (~> 0.7.11)
   u2f (~> 0.2.1)
+  undercover (~> 0.4.4)
   unf (~> 0.1.4)
   unleash (~> 3.2.2)
   valid_email (~> 0.1)

doc/development/pipelines.md

@@ -220,6 +220,20 @@ The `* as-if-jh` jobs are run in addition to the regular EE-context jobs. The `j
 The intent is to ensure that a change doesn't introduce a failure after the `gitlab-org/gitlab` project is synced to
 the `gitlab-jh/gitlab` project.
 
+## `undercover` RSpec test
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/74859) in GitLab 14.6.
+
+The `rspec:undercoverage` job runs [`undercover`](https://rubygems.org/gems/undercover)
+to detect, and fail if any changes introduced in the merge request has zero coverage.
+
+The `rsepc:undercoverage` job obtains coverage data from the `rspec:coverage`
+job.
+
+In the event of an emergency, or false positive from this job, add the
+`pipeline:skip-undercoverage` label to the merge request to allow this job to
+fail.
+
 ## PostgreSQL versions testing
 
 Our test suite runs against PG12 as GitLab.com runs on PG12 and

scripts/undercoverage

+#!/usr/bin/env bash
+
+bundle exec undercover -c "${CI_MERGE_REQUEST_DIFF_BASE_SHA:-$(git merge-base origin/master HEAD)}"

spec/simplecov_env.rb

@@ -2,6 +2,7 @@
 
 require 'simplecov'
 require 'simplecov-cobertura'
+require 'simplecov-lcov'
 require_relative '../lib/gitlab/utils'
 
 module SimpleCovEnv
@@ -18,10 +19,13 @@ module SimpleCovEnv
   end
 
   def configure_formatter
+    SimpleCov::Formatter::LcovFormatter.config.report_with_single_file = true
+
     SimpleCov.formatters = SimpleCov::Formatter::MultiFormatter.new([
       SimpleCov::Formatter::SimpleFormatter,
       SimpleCov::Formatter::HTMLFormatter,
-      SimpleCov::Formatter::CoberturaFormatter
+      SimpleCov::Formatter::CoberturaFormatter,
+      SimpleCov::Formatter::LcovFormatter
     ])
   end