ci(windows): measure MSVC coverage with covdbg

.covdbg.yaml

@@ -0,0 +1,14 @@
+# MSVC coverage for ci-build.yml: the same sources as before (examples/, src/, tools/),
+# without the broker test hook's private copy of the broker.
+---
+version: 1
+source_root: "."
+coverage:
+  default:
+    files:
+      include:
+        - "examples/**"
+        - "src/**"
+        - "tools/**"
+      exclude:
+        - "src/platform/windows/broker/**"

.github/workflows/ci-build.yml

@@ -22,14 +22,14 @@ env:
   COMMIT: ${{ inputs.release_commit }}
   FREEBSD_CLANG_VERSION: 19
   FREEBSD_VERSION: '15.1'
-  OPENCPPCOVERAGE_VERSION: '0.9.9.0'
   PYTHON_VERSION: ${{ inputs.python_version }}
 
 jobs:
   build:
     name: Build (${{ matrix.name }})
     permissions:
       contents: read
+      id-token: write  # covdbg identifies this repository by the job's OIDC token
     runs-on: ${{ matrix.os }}
     defaults:
       run:
@@ -225,20 +225,15 @@ jobs:
             mingw-w64-${{ matrix.toolchain }}-ninja
             mingw-w64-${{ matrix.toolchain }}-toolchain
 
-      - name: Setup Dependencies Windows MSVC
-        if: matrix.kind == 'msvc'
-        run: |
-          choco install opencppcoverage --version=${{ env.OPENCPPCOVERAGE_VERSION }} --yes --no-progress
-
-          $openCppCoverageDir = "${env:ProgramFiles}\OpenCppCoverage"
-          if (!(Test-Path (Join-Path $openCppCoverageDir "OpenCppCoverage.exe"))) {
-            $openCppCoverageDir = "${env:ProgramFiles(x86)}\OpenCppCoverage"
-          }
-          if (!(Test-Path (Join-Path $openCppCoverageDir "OpenCppCoverage.exe"))) {
-            throw "OpenCppCoverage.exe was not found after Chocolatey install."
-          }
-
-          $openCppCoverageDir | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+      # GitHub issues no OIDC token to pull requests from forks, so MSVC coverage is measured on
+      # pushes and on pull requests from branches of this repository; fork pull requests run the tests only.
+      - name: Setup covdbg
+        if: >-
+          matrix.kind == 'msvc' &&
+          (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+        uses: liasoft/setup-covdbg@6116a52a8ce697108056ce4b4cd2429424a231b1  # v1.0.0
+        with:
+          version: 'latest'
 
       - name: Setup Windows coverage inspection tools
         if: matrix.kind == 'msvc'
@@ -433,59 +428,32 @@ jobs:
       - name: Run tests MSVC
         id: test_msvc
         if: matrix.kind == 'msvc'
+        env:
+          MEASURE_COVERAGE: >-
+            ${{ github.event_name != 'pull_request' ||
+            github.event.pull_request.head.repo.full_name == github.repository }}
+        working-directory: cmake-build-ci/tests
         run: |
-          $openCppCoverage = (Get-Command OpenCppCoverage.exe -ErrorAction SilentlyContinue).Source
-          if (!$openCppCoverage) {
-            $candidates = @(
-              "${env:ProgramFiles}\OpenCppCoverage\OpenCppCoverage.exe",
-              "${env:ProgramFiles(x86)}\OpenCppCoverage\OpenCppCoverage.exe"
-            )
-            $openCppCoverage = $candidates | Where-Object { Test-Path $_ } | Select-Object -First 1
-          }
-          if (!$openCppCoverage) {
-            throw "OpenCppCoverage.exe was not found."
-          }
-
-          # The broker test hook compiles a private copy only for failure injection.
-          & $openCppCoverage `
-            --sources "$env:GITHUB_WORKSPACE\examples" `
-            --sources "$env:GITHUB_WORKSPACE\src" `
-            --sources "$env:GITHUB_WORKSPACE\tools" `
-            --excluded_sources "$env:GITHUB_WORKSPACE\src\platform\windows\broker" `
-            "--export_type=cobertura:$env:GITHUB_WORKSPACE\cmake-build-ci\reports\coverage.xml" `
-            --working_dir "$env:GITHUB_WORKSPACE\cmake-build-ci\tests" `
-            -- `
-            "$env:GITHUB_WORKSPACE\cmake-build-ci\tests\$env:CMAKE_BUILD_CONFIG\test_libvirtualhid.exe" `
-            --gtest_color=yes `
+          $testExe = ".\$env:CMAKE_BUILD_CONFIG\test_libvirtualhid.exe"
+          $testArgs = @(
+            "--gtest_color=yes",
             "--gtest_output=xml:$env:GITHUB_WORKSPACE\cmake-build-ci\reports\junit.xml"
-
-      - name: Normalize MSVC coverage paths
-        if: >-
-          always() &&
-          matrix.kind == 'msvc' &&
-          (steps.test_msvc.outcome == 'success' || steps.test_msvc.outcome == 'failure')
-        run: |
-          $coveragePath = Join-Path $env:GITHUB_WORKSPACE "cmake-build-ci\reports\coverage.xml"
-          if (!(Test-Path $coveragePath)) {
-            return
-          }
-
-          [xml] $coverage = Get-Content $coveragePath
-          $workspace = $env:GITHUB_WORKSPACE.Replace('\', '/')
-          foreach ($node in $coverage.SelectNodes('//*[@filename]')) {
-            $filename = $node.GetAttribute('filename').Replace('\', '/')
-            if ($filename.StartsWith("${workspace}/")) {
-              $filename = $filename.Substring($workspace.Length + 1)
-            }
-
-            $node.SetAttribute('filename', $filename)
+          )
+          if ($env:MEASURE_COVERAGE -ne 'true') {
+            & $testExe @testArgs
+            exit $LASTEXITCODE
           }
 
-          foreach ($source in $coverage.SelectNodes('//source')) {
-            $source.InnerText = '.'
+          # .covdbg.yaml selects the same sources as before; covdbg writes repository-relative paths.
+          covdbg --config "$env:GITHUB_WORKSPACE\.covdbg.yaml" --propagate-exit-code `
+            --output "$env:GITHUB_WORKSPACE\cmake-build-ci\coverage.covdb" $testExe @testArgs
+          $testExit = $LASTEXITCODE
+          covdbg convert --input "$env:GITHUB_WORKSPACE\cmake-build-ci\coverage.covdb" --format COBERTURA `
+            --output "$env:GITHUB_WORKSPACE\cmake-build-ci\reports\coverage.xml"
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
           }
-
-          $coverage.Save($coveragePath)
+          exit $testExit
 
       - name: Generate gcov report
         id: test_report

.github/workflows/ci-results.yml

@@ -51,11 +51,11 @@ jobs:
           path: _reports
 
       - name: Debug coverage file
-        if: matrix.has_coverage
+        if: matrix.has_coverage && hashFiles('_reports/coverage.xml') != ''
         run: cat _reports/coverage.xml
 
       - name: Upload test coverage
-        if: matrix.has_coverage
+        if: matrix.has_coverage && hashFiles('_reports/coverage.xml') != ''
         uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5  # v7.1.1
         with:
           disable_search: true

.github/workflows/ci.yml

@@ -90,6 +90,7 @@ jobs:
       - setup_release
     permissions:
       contents: read
+      id-token: write  # covdbg identifies this repository by the job's OIDC token
     uses: ./.github/workflows/ci-build.yml
     with:
       python_version: ${{ needs.setup_release.outputs.python_version }}

docs/development.md

@@ -9,7 +9,8 @@ sources and, when enabled, the diagnostic control model. GCC and Clang coverage
 instrumentation is confined to the tests directory. The normal library,
 examples, tools, and brokers remain free of coverage instrumentation, including
 when they are packaged from a build that also runs tests. MSVC coverage uses
-OpenCppCoverage rather than compiler instrumentation.
+covdbg, which reads the test binary and its PDB, rather than compiler
+instrumentation.
 
 ## Windows library and tests
 

tests/CMakeLists.txt

@@ -24,7 +24,7 @@ endif()
 set(TEST_BINARY test_libvirtualhid)
 
 # Recompile the library for coverage without instrumenting installed targets.
-# MSVC coverage is collected externally with OpenCppCoverage.
+# MSVC coverage is collected externally with covdbg.
 if(NOT CMAKE_CXX_COMPILER_ID STREQUAL "MSVC")
     add_compile_options(-fprofile-arcs -ftest-coverage -ggdb -O0)
     add_link_options(-fprofile-arcs -ftest-coverage)