From 74114509d940682c0343d911c913750a174d0fd9 Mon Sep 17 00:00:00 2001
From: Lucas McDonald <lucmcdon@amazon.com>
Date: Fri, 6 Nov 2026 19:12:27 +0000
Subject: [PATCH] ci: upload the unit test line coverage

---
 .github/workflows/ci.yml    | 29 +++++++++++++++++++++++++++++
 codebuild/ci/jacoco_lcov.py | 17 +++++++++++++++++
 codebuild/ci/vectors-ci.yml | 11 +++++++++++
 3 files changed, 57 insertions(+)
 create mode 100644 codebuild/ci/jacoco_lcov.py

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9ad9207e..42a5633c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -48,6 +48,7 @@ jobs:
           aws-region: us-west-2
           role-duration-seconds: 3600
       - name: Vector Tests ${{ matrix.platform.distribution }}${{ matrix.version }}
+        id: codebuild
         uses: aws-actions/aws-codebuild-run-build@v1
         timeout-minutes: 60
         with:
@@ -58,6 +59,34 @@ jobs:
           env-vars-for-codebuild: JAVA_ENV_VERSION
         env:
           JAVA_ENV_VERSION: ${{ matrix.platform.distribution }}${{ matrix.version }}
+      - name: Write the line coverage report
+        # The CodeBuild build prints its lcov report, gzipped and base64
+        # encoded, between two marker lines in its log.
+        if: matrix.version == 17
+        env:
+          BUILD_ID: ${{ steps.codebuild.outputs.aws-build-id }}
+        run: |
+          read -r group stream < <(aws codebuild batch-get-builds --ids "$BUILD_ID" \
+            --query 'builds[0].logs.[groupName,streamName]' --output text)
+          token=""
+          : > build.log
+          while :; do
+            page=$(aws logs get-log-events --log-group-name "$group" --log-stream-name "$stream" \
+              --start-from-head ${token:+--next-token "$token"} --output json)
+            jq -r '.events[].message' <<< "$page" >> build.log
+            next=$(jq -r '.nextForwardToken' <<< "$page")
+            [ "$next" = "$token" ] && break
+            token=$next
+          done
+          mkdir -p coverage
+          sed -n '/^LCOV-GZ-BASE64-BEGIN$/,/^LCOV-GZ-BASE64-END$/{//!p}' build.log | base64 -d | gunzip > coverage/esdk.lcov
+          grep -c '^SF:' coverage/esdk.lcov
+      - name: Upload the line coverage report
+        if: matrix.version == 17
+        uses: actions/upload-artifact@v4
+        with:
+          name: local-coverage-esdk
+          path: coverage/*.lcov
   vectorTestsMasterKeyProvider:
     name: Vector Tests MasterKeyProvider
     runs-on: ubuntu-latest
diff --git a/codebuild/ci/jacoco_lcov.py b/codebuild/ci/jacoco_lcov.py
new file mode 100644
index 00000000..a78cd442
--- /dev/null
+++ b/codebuild/ci/jacoco_lcov.py
@@ -0,0 +1,17 @@
+"""Print a JaCoCo XML report as lcov.
+
+Usage: jacoco_lcov.py <jacoco.xml> <source root relative to the repository>
+
+A line counts as hit when its tests covered at least one of its instructions;
+JaCoCo keeps no hit counts.
+"""
+import sys
+import xml.etree.ElementTree as ElementTree
+
+report, source_root = sys.argv[1], sys.argv[2]
+for package in ElementTree.parse(report).getroot().iter("package"):
+    for sourcefile in package.findall("sourcefile"):
+        print("SF:%s/%s/%s" % (source_root, package.get("name"), sourcefile.get("name")))
+        for line in sourcefile.findall("line"):
+            print("DA:%s,%d" % (line.get("nr"), int(line.get("ci")) > 0))
+        print("end_of_record")
diff --git a/codebuild/ci/vectors-ci.yml b/codebuild/ci/vectors-ci.yml
index 363c1d35..cec6b4ee 100644
--- a/codebuild/ci/vectors-ci.yml
+++ b/codebuild/ci/vectors-ci.yml
@@ -32,3 +32,14 @@ phases:
     commands:
       # NOTE: We need to pass the absolute path of the vectors
       - mvn install -T 8 -Dgpg.skip=true -ntp "-DtestVectorZip=file://$CODEBUILD_SRC_DIR/src/test/resources/aws-encryption-sdk-test-vectors/vectors/awses-decrypt/python-2.3.0.zip"
+  post_build:
+    commands:
+      # The GitHub workflow reads the line coverage report back out of this
+      # build's log and uploads it.
+      - |
+        cd "$CODEBUILD_SRC_DIR"
+        if [ -f target/site/jacoco/jacoco.xml ]; then
+          echo LCOV-GZ-BASE64-BEGIN
+          python3 codebuild/ci/jacoco_lcov.py target/site/jacoco/jacoco.xml src/main/java | gzip | base64
+          echo LCOV-GZ-BASE64-END
+        fi