ci(coverage): stop swallowing test failures, and drop the unused codecov config

.github/workflows/pull.yml

@@ -114,9 +114,24 @@ jobs:
       - run: |
           export PATH=$PATH:$(go env GOPATH)/bin
           set -o pipefail
-          ./ext-tools/go-acc ./... --covermode=atomic --ignore test,immuclient,immuadmin,helper,fs,cmdtest,sservice,version,tools,webconsole,protomodel,schema,swagger || true
+
+          # Record the test run's exit status rather than discarding it.
+          # This used to end in `|| true`, which meant a failing or panicking
+          # package was swallowed and whatever partial coverage.txt existed was
+          # uploaded anyway — surfacing a genuine test failure as nothing more
+          # than a slightly lower coverage percentage.
+          acc_status=0
+          ./ext-tools/go-acc ./... --covermode=atomic --ignore test,immuclient,immuadmin,helper,fs,cmdtest,sservice,version,tools,webconsole,protomodel,schema,swagger || acc_status=$?
+
+          # Still publish whatever was measured, so a failed run is not also a
+          # blind spot, then fail the job below.
           cat coverage.txt | grep -v "test" | grep -v "schema" | grep -v "protomodel" | grep -v "swagger" | grep -v "webserver.go" | grep -v "immuclient" | grep -v "immuadmin" | grep -v "helper" | grep -v "fs" | grep -v "cmdtest" | grep -v "sservice" | grep -v "version" | grep -v "tools" | grep -v "webconsole" > coverage.out
           ./ext-tools/goveralls -coverprofile=coverage.out -service=gh-ci
+
+          if [ "$acc_status" -ne 0 ]; then
+            echo "::error::go-acc exited ${acc_status}: the test run failed, so the coverage figure above was computed from a partial profile"
+            exit "$acc_status"
+          fi
         env:
           COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/push.yml

@@ -310,11 +310,27 @@ jobs:
 
           export PATH=$PATH:$(go env GOPATH)/bin
           set -o pipefail
-          ./ext-tools/go-acc ./... --covermode=atomic --ignore test,immuclient,immuadmin,helper,fs,cmdtest,sservice,version,tools,webconsole,protomodel,schema,swagger  --tags minio || true
+
+          # Record the test run's exit status rather than discarding it.
+          # This used to end in `|| true`, which meant a failing or panicking
+          # package was swallowed and whatever partial coverage.txt existed was
+          # uploaded anyway — surfacing a genuine test failure as nothing more
+          # than a slightly lower coverage percentage.
+          acc_status=0
+          ./ext-tools/go-acc ./... --covermode=atomic --ignore test,immuclient,immuadmin,helper,fs,cmdtest,sservice,version,tools,webconsole,protomodel,schema,swagger  --tags minio || acc_status=$?
+
+          # Still publish whatever was measured, so a failed run is not also a
+          # blind spot.
           cat coverage.txt | grep -v "test" | grep -v "schema" | grep -v "protomodel" | grep -v "swagger" | grep -v "webserver.go" | grep -v "immuclient" | grep -v "immuadmin" | grep -v "helper" | grep -v "fs" | grep -v "cmdtest" | grep -v "sservice" | grep -v "version" | grep -v "tools" | grep -v "webconsole" > coverage.out
           ./ext-tools/goveralls -coverprofile=coverage.out -service=gh-ci
 
-          # Stop minio
+          # Stop minio. This runs before the failure check below so the
+          # container is always torn down, even when the test run failed.
           docker rm -f minio
+
+          if [ "$acc_status" -ne 0 ]; then
+            echo "::error::go-acc exited ${acc_status}: the test run failed, so the coverage figure above was computed from a partial profile"
+            exit "$acc_status"
+          fi
         env:
           COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}