Merge pull request #4 from NCAR/dev-ui

Add Codecov coverage reporting and CodeQL security scanning

Author: NihanthCW

.codecov.yml

@@ -0,0 +1,13 @@
+coverage:
+  status:
+    project:
+      default:
+        target: auto      # must not drop below current baseline
+        threshold: 2%     # allow up to 2% drop without failing
+    patch:
+      default:
+        target: 70%       # new code in a PR must be 70% covered
+
+comment:
+  layout: "reach,diff,flags"
+  behavior: default

.github/workflows/codeql.yml

@@ -0,0 +1,28 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1"  # weekly Monday 06:00 UTC
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: python
+
+      - uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:python"

.github/workflows/tests.yml

@@ -14,8 +14,18 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v5
 
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
       - name: Install dependencies
         run: uv sync
 
       - name: Run tests
-        run: uv run pytest tests/ -v --tb=short
+        run: uv run pytest tests/ -v --tb=short --cov --cov-report=xml
+
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v4
+        with:
+          files: ./coverage.xml
+          fail_ci_if_error: false

pyproject.toml

@@ -43,9 +43,23 @@ dependencies = [
 [dependency-groups]
 dev = [
     "pytest>=9.0.2",
+    "pytest-cov>=6.0.0",
     "ruff>=0.9.0",
 ]
 
+[tool.coverage.run]
+source = ["notebooks"]
+omit = [
+    "*/tests/*",
+    "*/.venv/*",
+    "*/helpers/v*_dino_embeddings_lancedb.py",
+    "*/helpers/v*_openclip_embeddings_lancedb.py",
+]
+
+[tool.coverage.report]
+show_missing = true
+skip_empty = true
+
 [tool.marimo.runtime]
 output_max_bytes = 10_000_000