[denniswu28]

Summary

This branch adds coverage with Codecov, a broader CI test matrix, and a weekly dependency-bounds workflow. It's stacked on codex/function-atomic-replay-20260928. CI has never run on this line of branches, because ci.yml only triggered for main and dev.

Taken from #59 (cherry-picked with -x, CI plumbing only)

• One test matrix: Python 3.9–3.14 on Ubuntu, plus 3.9 and 3.14 on macOS. Every job installs sshd and runs the whole suite with HALLMARK_RUN_SSH_TESTS=1. This replaces the separate build and ssh-transport jobs.
• Broader triggers: CI now runs on pull requests into any branch, and on manual dispatch.
• Lint and packaging: a separate lint job, plus twine check --strict on the built distributions.
• Coverage: branch coverage of the hallmark package from every job, combined in a coverage job with a 90% floor. It's uploaded to Codecov through OIDC, and codecov.yml marks Codecov's statuses informational.
• Python 3.9 test fix: the Click 8.1 CliRunner handling in test_cli.py.
• Not ported: the chaos and survey suites and nightly.yml stay in Automate CI coverage, chaos and survey workflow tests #59. Once this merges, Automate CI coverage, chaos and survey workflow tests #59 can drop these five commits.

New here

• The Codecov upload works now. On Automate CI coverage, chaos and survey workflow tests #59 the action never downloaded its CLI from cli.codecov.io, and fail_ci_if_error: false hid that, so Codecov never received a report. The CLI now comes from PyPI (use_pypi: true). A failed upload marks its step failed without failing the job. The first upload from this PR went through OIDC, and Codecov now lists the repository as active.
• Coverage is reported even when tests fail. Before, one failing test skipped the combined report, the Codecov upload and the floor. The test jobs still fail on their own.
• Dependency lower bounds in pyproject.toml: click>=8.1, GitPython>=3.1.30, numpy>=1.21, pandas>=1.5, parse>=1.19, pyyaml>=5.4, requests>=2.26, tqdm>=4.60.
  • Before this there were no bounds, so pip could install pandas 1.3, where to_csv(lineterminator=...) raises a TypeError in repo/dothm.py.
  • These are tested floors, not proven minimums.
• New Dependencies workflow (.github/workflows/dependencies.yml):
  • When it runs: weekly, on demand, and on PRs that change pyproject.toml or the workflow.
  • lowest job (Python 3.9): installs the oldest versions pyproject.toml allows, resolved with uv pip compile --resolution lowest-direct.
  • pre-release job (Python 3.14 and 3.15): installs the newest releases, including pre-releases.
  • Both jobs: run the whole suite with SSH and list the installed versions in the job summary.
  • Caveat: the weekly schedule only starts once the workflow is on main.
• Coverage floor 89%: the combined total on this PR's first run was 90.45%, so the floor is set one point below the whole-number total, following Automate CI coverage, chaos and survey workflow tests #59's rule.
• Authors: adds Tianrui (Dennis) Wu and Arshia Akhtarkavan to pyproject.toml.

Existing failures (CI is red, not caused by this PR)

The base branch tip (a449faa) has 27 failing tests, plus 2 more with Click ≥ 8.5 (every job except Python 3.9). That's 27 failures on the 3.9 jobs and 29 on the others. 326d4fb (the codex branch before the merge) passes all 674. These failures are reported here and not fixed, to keep this PR to CI.

From ee6cbf5 (Add file and folder staging with staged restore), 7:

• test_demo_notebooks.py: demo_cli.ipynb, demo_python.ipynb
• test_hallmark.py:
  • test_checkout_allows_return_to_branch_when_target_files_already_match
  • test_checkout_rebuilds_worktree_for_branch_specific_nested_fmt
  • test_checkout_rejects_directory_at_target_file_path
  • test_checkout_rejects_symlink_destination_escape
  • test_manifest_entries_empty_when_config_has_no_data_fmt

First failing at the merge a449faa, 20:

• test_cli.py: test_cli_add_dot_and_explicit_paths, test_cli_set_config_and_add_dot
• test_hallmark.py:
  • test_checkout_remote_branch
  • test_data_tsv_and_worktree_reconstruction
  • test_load_head_state_without_commits_uses_current_config_and_empty_data
  • test_manifest_frame_normalizes_missing_and_integral_float_values
  • test_repo_add_dot_from_nested_directory_uses_path_components
  • test_repo_add_dot_removes_deleted_files_from_manifest
  • test_repo_add_dot_replaces_manifest_with_current_tree
  • test_repo_add_parse_failure_preserves_existing_format
  • test_repo_add_paths_is_not_supported_yet
  • test_repo_add_pattern_keeps_deleted_manifest_rows
  • test_repo_add_pattern_replaces_manifest_when_fmt_changes
  • test_repo_add_persists_only_sha1_and_path
  • test_repo_add_result_has_expected_length
  • test_repo_add_result_paths_match_standard_files
  • test_repo_status_does_not_walk_dothm_directory
  • test_state_replace_empty_uses_incoming_schema
  • test_state_update_and_replace_share_data_normalization
  • test_state_update_static_format_keeps_only_latest_row

With Click 8.5.0 (released stable), 2 more:

• test_local_add.py::test_add_has_no_force_or_all_option[--force] and [--all]. Line 397 expects No such option: --force, but Click 8.5 prints No such option '--force'.. The pre-release job caught this first.

Most of them expect the old manifest layout (no path column) or hit No file pattern set after staging by path.

Testing

• ruff check . passes; actionlint passes on ci.yml and dependencies.yml.
• Full suite locally (Python 3.13, SSH tests on): 27 failed, 735 passed, 5 xfailed. These are exactly the 27 above.
• Branch coverage locally: 90.24%.
• CI on this PR: lint, distribution-and-docs and coverage pass. All 8 test jobs ran the whole suite with SSH and failed only on the tests listed above.
  • The coverage job ran despite the failures: 90.45% combined, uploaded to Codecov.
• Dependencies on this PR: lowest hit only the 27; pre-release (3.14 and 3.15, pandas 3.1.0rc0, Click 8.5.0) hit the 27 plus the 2 Click failures.
  • Click also warns that CliRunner.isolated_filesystem, used in test_cli.py, is removed in Click 9.0.
• Reproduced the lowest job's steps locally on Python 3.9. It resolved click 8.1.0, GitPython 3.1.30, numpy 1.21.0, pandas 1.5.0, parse 1.19.0, pyyaml 5.4, requests 2.26.0 and tqdm 4.60.0. pip check was clean, and the run had the same 27 failures and no others. With pandas 1.3 there were extra lineterminator failures.

🤖 Generated with Claude Code

[codecov-commenter]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment

Thanks for integrating Codecov - We've got you covered ☂️